fix cilium routing and cluster dns

ansible/README.md

@@ -32,8 +32,14 @@ ansible-playbook \
 
 The playbook installs pinned k3d, kubectl, and Helm binaries, starts Docker,
 creates the k3d cluster, writes the core user's kubeconfig, fetches a copy into
-the local `artifacts/` directory, installs ArgoCD from a pinned official
-manifest, and applies the GitOps root Application from `deployments/argocd/`.
+the local `artifacts/` directory, merges that config into the operator's
+default `~/.kube/config`, selects the new context as current, installs ArgoCD
+from a pinned official manifest, and applies the GitOps root Application from
+`deployments/argocd/`. The merge preserves existing contexts and the playbook
+verifies the selected context before continuing.
+
+Set `kubeconfig_import_enabled: false` when the fetched artifact should not
+change the operator's default kubeconfig.
 
 By default the playbook copies the current repository from the Ansible
 controller to the host. For a private repository, set
@@ -41,22 +47,35 @@ controller to the host. For a private repository, set
 `bootstrap_repo_ssh_private_key` through Ansible Vault. The private key task is
 marked `no_log` and is removed after the checkout.
 
+When k3d exports its kubeconfig, it may use `0.0.0.0` as the API server host.
+Ansible rewrites that host to `kubeconfig_server_host`, which defaults to the
+Flatcar host address, while preserving the dynamically assigned API port. The
+rewritten endpoint is verified before the config is merged into the default
+kubeconfig.
+
 For the optional Cilium path, set these variables in the inventory:
 
 ```yaml
 cilium_enabled: true
 k3d_config_source: "{{ playbook_dir }}/../local-quickstart/k3d-cilium-cluster-config.yaml"
 cilium_k8s_service_host: 192.168.60.252
-cilium_k8s_service_port: 6443
+cilium_k8s_service_port: 0
 ```
 
 The Cilium role refuses to proceed if a kube-proxy DaemonSet is present. It
-passes the API endpoint explicitly to Helm and waits for the Cilium DaemonSet.
+derives the dynamically published k3d API port from the new cluster's
+kubeconfig, passes the API endpoint explicitly to Helm, and waits for the
+Cilium DaemonSet.
 
 The playbook does not create Slack or Discord credentials. Those will be added
 through a separate opt-in Ansible secret toggle so ordinary bootstrap remains
 credential-free.
 
+If CoreDNS cannot resolve external names from a nested Docker network, set
+`k3d_dns_servers` to DNS servers reachable from the Flatcar host. Ansible
+creates the supported K3s `coredns-custom` ConfigMap and restarts CoreDNS so
+ArgoCD can resolve the Git server and Falcosidekick can resolve its webhook.
+
 Validate the playbook before connecting to a host:
 
 ```bash