Initial argo deployment

cluster/platform/cilium-config/application.yaml

@@ -0,0 +1,48 @@
+# ------------------------------------------------------------------------------
+# Platform: Cilium — Helm upgrade + LB IPAM + Gateway API
+# Wave 4 — no dependencies, Cilium is pre-installed via Talos bootstrap
+#
+# This Application does two things:
+#   1. Manages Cilium itself via Helm (enables Gateway API, keeps config in git)
+#   2. Applies LB pool and L2 announcement manifests
+#
+# On first sync, ArgoCD will upgrade Cilium in-place with --reuse-values
+# plus our additions (gatewayAPI.enabled, l2announcements, etc.).
+# Cilium operator and daemonset will rolling-restart automatically.
+#
+# IP Allocation:
+#   10.1.71.80       — ingress-nginx (reserved, not from pool)
+#   10.1.71.81       — Cilium Gateway (reserved, not from pool)
+#   10.1.71.82-.89   — ingress-nginx LB pool (future additional controllers)
+#   10.1.71.90-.99   — Cilium Gateway LB pool
+# ------------------------------------------------------------------------------
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cilium-config
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "4"
+spec:
+  project: default
+  sources:
+    # Source 1: Cilium Helm chart — manages Cilium itself
+    - repoURL: https://helm.cilium.io
+      chart: cilium
+      targetRevision: 1.17.4
+      helm:
+        valuesFiles:
+          - $values/cluster/platform/cilium-config/values.yaml
+    # Source 2: Our repo — provides the values file and manifests
+    - repoURL: https://gitea.mk-labs.cloud/rblundon/homelab.git
+      targetRevision: main
+      ref: values
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: kube-system
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - ServerSideApply=true

cluster/platform/cilium-config/manifests/lb-pool.yaml

@@ -0,0 +1,66 @@
+# ------------------------------------------------------------------------------
+# Cilium LB IPAM — IP Address Pools
+#
+# Pool 1: ingress-nginx pool  — 10.1.71.80 - 10.1.71.89
+# Pool 2: cilium-gateway pool — 10.1.71.90 - 10.1.71.99
+#
+# Pools are separated so ingress-nginx and Gateway API services never
+# compete for the same IPs. Each pool uses a serviceSelector to ensure
+# IPs are only assigned to the right controller.
+# ------------------------------------------------------------------------------
+
+# Pool for ingress-nginx LoadBalancer service
+apiVersion: cilium.io/v2alpha1
+kind: CiliumLoadBalancerIPPool
+metadata:
+  name: ingress-nginx-pool
+  namespace: kube-system
+spec:
+  blocks:
+    - start: 10.1.71.80
+      stop: 10.1.71.89
+  serviceSelector:
+    matchLabels:
+      app.kubernetes.io/name: ingress-nginx
+
+---
+# Pool for Cilium Gateway API — only assigned to Gateway-owned services
+# Cilium automatically labels Gateway services with io.cilium.gateway/owning-gateway
+apiVersion: cilium.io/v2alpha1
+kind: CiliumLoadBalancerIPPool
+metadata:
+  name: cilium-gateway-pool
+  namespace: kube-system
+spec:
+  blocks:
+    - start: 10.1.71.90
+      stop: 10.1.71.99
+  serviceSelector:
+    matchExpressions:
+      - key: io.cilium.gateway/owning-gateway
+        operator: Exists
+
+---
+# L2 Announcement Policy — ARP on server VLAN for both pools
+apiVersion: cilium.io/v2alpha1
+kind: CiliumL2AnnouncementPolicy
+metadata:
+  name: fastpass-l2-policy
+  namespace: kube-system
+spec:
+  loadBalancerIPs: true
+  # All nodes participate — Cilium handles failover automatically
+  interfaces:
+    - ^eth[0-9]+
+
+---
+# GatewayClass — tells Kubernetes that Cilium handles Gateway resources
+# This is the entry point for all Gateway API routing
+apiVersion: gateway.networking.k8s.io/v1
+kind: GatewayClass
+metadata:
+  name: cilium
+spec:
+  controllerName: io.cilium/gateway-controller
+  description: Cilium Gateway API implementation (eBPF-native)
+

cluster/platform/cilium-config/values.yaml

@@ -0,0 +1,57 @@
+# ------------------------------------------------------------------------------
+# Cilium Helm Values — fastpass cluster
+# Chart: https://helm.cilium.io
+# Version: 1.17.4
+#
+# These values are applied as a Helm upgrade over the bootstrap install.
+# --reuse-values is implicit via ArgoCD's Helm source — existing values
+# from the Talos bootstrap are preserved; we only override what's listed here.
+#
+# Talos bootstrap values (already set, do not need repeating):
+#   kubeProxyReplacement: true
+#   k8sServiceHost: 10.1.71.65
+#   k8sServicePort: 6443
+#   ipam.mode: kubernetes
+#   tunnel: vxlan
+# ------------------------------------------------------------------------------
+
+# Enable Gateway API support — this is the key addition
+# Cilium operator will register as a GatewayClass controller automatically
+gatewayAPI:
+  enabled: true
+
+# L2 announcements — ARP-based LB IP advertisement on the server VLAN
+l2announcements:
+  enabled: true
+
+# Rate limiting for L2 announcements — important with many services
+# Tune up if you see "rate limit exceeded" in cilium-operator logs
+k8sClientRateLimit:
+  qps: 20
+  burst: 40
+
+# ExternalIPs advertisement
+externalIPs:
+  enabled: true
+
+# Hubble observability — worth enabling for visibility into cluster traffic
+hubble:
+  enabled: true
+  relay:
+    enabled: true
+  ui:
+    enabled: true
+  metrics:
+    enabled:
+      - dns
+      - drop
+      - tcp
+      - flow
+      - port-distribution
+      - httpV2
+
+# Prometheus metrics
+prometheus:
+  enabled: true
+  serviceMonitor:
+    enabled: false  # enable once Prometheus operator is in-cluster