cilium, argo

talos/cilium/cilium-values.yaml

@@ -44,10 +44,12 @@ tunnelProtocol: vxlan
 # Without this, LoadBalancer IPs are assigned but unreachable from outside the cluster.
 l2announcements:
   enabled: true
+  interface: ens18
 
 # Also enable L2 pod announcements so Cilium handles ARP for pod IPs directly
 l2podAnnouncements:
   enabled: true
+  interface: ens18
 
 # ─── IP pools (defined as CRDs post-install, but referenced here for docs) ───
 # Pool 1: ingress-nginx   10.1.71.80 - 10.1.71.89
@@ -55,6 +57,39 @@ l2podAnnouncements:
 # Apply these after Cilium is healthy:
 #   kubectl apply -f talos/cilium/ip-pools.yaml
 
+# ─── Talos security context overrides ───────────────────────────────────────
+# Talos permanently blocks SYS_MODULE and SYS_BOOT at the OS level regardless
+# of pod security settings. Cilium's default caps include SYS_MODULE which
+# causes clean-cilium-state to fail with "unable to apply caps".
+# These overrides replace the default cap sets with Talos-compatible ones.
+securityContext:
+  capabilities:
+    ciliumAgent:
+      - CHOWN
+      - KILL
+      - NET_ADMIN
+      - NET_RAW
+      - IPC_LOCK
+      - SYS_ADMIN
+      - SYS_RESOURCE
+      - DAC_OVERRIDE
+      - FOWNER
+      - SETGID
+      - SETUID
+      - PERFMON
+      - BPF
+    cleanCiliumState:
+      - NET_ADMIN
+      - SYS_ADMIN
+      - SYS_RESOURCE
+      - BPF
+
+# Talos mounts cgroups differently — disable auto-mount and point at host root
+cgroup:
+  autoMount:
+    enabled: false
+  hostRoot: /sys/fs/cgroup
+
 # ─── Operator ────────────────────────────────────────────────────────────────
 operator:
   replicas: 1   # single-replica is fine for homelab; avoids scheduling issues on 3-node CP
@@ -80,7 +115,7 @@ gatewayAPI:
 # ─── Security ────────────────────────────────────────────────────────────────
 # Restrict host namespace access — pods can't escape to host network by default
 hostNamespaceAccess:
-  enabled: false
+  enabled: true
 
 # Enable network policies (default deny is applied per-namespace by ArgoCD apps)
 policyEnforcementMode: default

talos/cilium/ip-pools.yaml

@@ -42,4 +42,4 @@ spec:
   nodeSelector:
     matchLabels: {}
   interfaces:
-    - eth0
+    - ens18

talos/talhelper/talconfig.yaml

@@ -41,7 +41,6 @@ patches:
                 usernames: []
                 runtimeClasses: []
                 namespaces:
-                  - kube-system
                   - argocd
                   - cert-manager
                   - ingress-nginx
@@ -53,8 +52,20 @@ patches:
         servers:
           - 10.1.71.21   # sundial — local NTP
 
-      # DNS search domain so short names resolve inside the cluster
+      # Sysctls required for Cilium eBPF on Talos
+      # bpf_jit_harden: 2 (Talos default) blocks Cilium's eBPF programs
+      # unprivileged_bpf_disabled: 1 (Talos default) blocks BPF for unprivileged containers
+      # perf_event_paranoid: 3 (Talos default) too restrictive for Cilium observability
+      sysctls:
+        net.core.bpf_jit_harden: "0"
+        kernel.unprivileged_bpf_disabled: "0"
+        kernel.perf_event_paranoid: "1"
+
+      # DNS — point at world-drive (UDM Pro), which forwards local.mk-labs.cloud
+      # to monorail and handles external resolution via DoH
       network:
+        nameservers:
+          - 10.1.71.1
         extraHostEntries: []
 
       # Talos manages kubelet — these flags are additive
@@ -90,7 +101,7 @@ controlPlane:
           # VIP — floats across all three control plane nodes
           # Talos handles VIP natively; no keepalived needed
           interfaces:
-            - interface: eth0
+            - interface: ens18
               vip:
                 ip: 10.1.71.65
 
@@ -102,7 +113,7 @@ nodes:
     controlPlane: true
     installDisk: /dev/sda
     networkInterfaces:
-      - interface: eth0
+      - interface: ens18
         addresses:
           - 10.1.71.66/24
         routes:
@@ -117,7 +128,7 @@ nodes:
     controlPlane: true
     installDisk: /dev/sda
     networkInterfaces:
-      - interface: eth0
+      - interface: ens18
         addresses:
           - 10.1.71.67/24
         routes:
@@ -132,7 +143,7 @@ nodes:
     controlPlane: true
     installDisk: /dev/sda
     networkInterfaces:
-      - interface: eth0
+      - interface: ens18
         addresses:
           - 10.1.71.68/24
         routes:
@@ -148,7 +159,7 @@ nodes:
     controlPlane: false
     installDisk: /dev/sda
     networkInterfaces:
-      - interface: eth0
+      - interface: ens18
         addresses:
           - 10.1.71.69/24
         routes:
@@ -161,7 +172,7 @@ nodes:
     controlPlane: false
     installDisk: /dev/sda
     networkInterfaces:
-      - interface: eth0
+      - interface: ens18
         addresses:
           - 10.1.71.70/24
         routes:
@@ -174,7 +185,7 @@ nodes:
     controlPlane: false
     installDisk: /dev/sda
     networkInterfaces:
-      - interface: eth0
+      - interface: ens18
         addresses:
           - 10.1.71.71/24
         routes: