cilium, argo

talos/cilium/cilium-values.yaml

@@ -44,10 +44,12 @@ tunnelProtocol: vxlan
 # Without this, LoadBalancer IPs are assigned but unreachable from outside the cluster.
 l2announcements:
   enabled: true
+  interface: ens18
 
 # Also enable L2 pod announcements so Cilium handles ARP for pod IPs directly
 l2podAnnouncements:
   enabled: true
+  interface: ens18
 
 # ─── IP pools (defined as CRDs post-install, but referenced here for docs) ───
 # Pool 1: ingress-nginx   10.1.71.80 - 10.1.71.89
@@ -55,6 +57,39 @@ l2podAnnouncements:
 # Apply these after Cilium is healthy:
 #   kubectl apply -f talos/cilium/ip-pools.yaml
 
+# ─── Talos security context overrides ───────────────────────────────────────
+# Talos permanently blocks SYS_MODULE and SYS_BOOT at the OS level regardless
+# of pod security settings. Cilium's default caps include SYS_MODULE which
+# causes clean-cilium-state to fail with "unable to apply caps".
+# These overrides replace the default cap sets with Talos-compatible ones.
+securityContext:
+  capabilities:
+    ciliumAgent:
+      - CHOWN
+      - KILL
+      - NET_ADMIN
+      - NET_RAW
+      - IPC_LOCK
+      - SYS_ADMIN
+      - SYS_RESOURCE
+      - DAC_OVERRIDE
+      - FOWNER
+      - SETGID
+      - SETUID
+      - PERFMON
+      - BPF
+    cleanCiliumState:
+      - NET_ADMIN
+      - SYS_ADMIN
+      - SYS_RESOURCE
+      - BPF
+
+# Talos mounts cgroups differently — disable auto-mount and point at host root
+cgroup:
+  autoMount:
+    enabled: false
+  hostRoot: /sys/fs/cgroup
+
 # ─── Operator ────────────────────────────────────────────────────────────────
 operator:
   replicas: 1   # single-replica is fine for homelab; avoids scheduling issues on 3-node CP
@@ -80,7 +115,7 @@ gatewayAPI:
 # ─── Security ────────────────────────────────────────────────────────────────
 # Restrict host namespace access — pods can't escape to host network by default
 hostNamespaceAccess:
-  enabled: false
+  enabled: true
 
 # Enable network policies (default deny is applied per-namespace by ArgoCD apps)
 policyEnforcementMode: default

talos/cilium/ip-pools.yaml

@@ -42,4 +42,4 @@ spec:
   nodeSelector:
     matchLabels: {}
   interfaces:
-    - eth0
+    - ens18