add Ansible Flatcar and platform bootstrap

ansible/roles/cilium_bootstrap/defaults/main.yml

@@ -0,0 +1,7 @@
+---
+cilium_enabled: false
+cilium_namespace: kube-system
+cilium_chart_version: 1.20.0
+cilium_values_file: "{{ k3d_workspace }}/deployments/cilium/cilium-values.yaml"
+cilium_k8s_service_host: ""
+cilium_k8s_service_port: 6443

ansible/roles/cilium_bootstrap/tasks/main.yml

@@ -0,0 +1,48 @@
+---
+- name: Require a reachable Kubernetes API endpoint
+  ansible.builtin.assert:
+    that:
+      - cilium_k8s_service_host | length > 0
+      - cilium_k8s_service_port | int > 0
+    fail_msg: Set cilium_k8s_service_host and cilium_k8s_service_port for kube-proxy replacement.
+
+- name: Verify kube-proxy is disabled
+  ansible.builtin.raw: "{{ k3d_tool_dir }}/kubectl -n kube-system get daemonset kube-proxy"
+  become_user: "{{ k3d_user }}"
+  register: kube_proxy_check
+  changed_when: false
+  failed_when: false
+
+- name: Refuse Cilium replacement when kube-proxy is present
+  ansible.builtin.assert:
+    that:
+      - kube_proxy_check.rc != 0
+    fail_msg: kube-proxy is present. Create the cluster with a kube-proxy-free profile first.
+
+- name: Add the Cilium Helm repository
+  ansible.builtin.raw: "{{ k3d_tool_dir }}/helm repo add cilium https://helm.cilium.io/"
+  become_user: "{{ k3d_user }}"
+  changed_when: false
+
+- name: Update Helm repositories
+  ansible.builtin.raw: "{{ k3d_tool_dir }}/helm repo update"
+  become_user: "{{ k3d_user }}"
+  changed_when: false
+
+- name: Install Cilium with kube-proxy replacement
+  ansible.builtin.raw: >-
+    {{ k3d_tool_dir }}/helm upgrade --install cilium cilium/cilium
+    --namespace {{ cilium_namespace }}
+    --version {{ cilium_chart_version }}
+    --values {{ cilium_values_file }}
+    --set kubeProxyReplacement=true
+    --set k8sServiceHost={{ cilium_k8s_service_host }}
+    --set k8sServicePort={{ cilium_k8s_service_port }}
+    --wait --timeout 10m
+  become_user: "{{ k3d_user }}"
+
+- name: Wait for Cilium agents
+  ansible.builtin.raw: >-
+    {{ k3d_tool_dir }}/kubectl -n {{ cilium_namespace }} rollout status
+    daemonset/cilium --timeout=300s
+  become_user: "{{ k3d_user }}"