add environment-specific cilium profiles

ansible/README.md

@@ -57,15 +57,24 @@ For the optional Cilium path, set these variables in the inventory:
 
 ```yaml
 cilium_enabled: true
+cilium_profile: k3d
 k3d_config_source: "{{ playbook_dir }}/../local-quickstart/k3d-cilium-cluster-config.yaml"
 cilium_k8s_service_host: 192.168.60.252
 cilium_k8s_service_port: 0
 ```
 
-The Cilium role refuses to proceed if a kube-proxy DaemonSet is present. It
-derives the dynamically published k3d API port from the new cluster's
-kubeconfig, passes the API endpoint explicitly to Helm, and waits for the
-Cilium DaemonSet.
+The Cilium role selects the shared values from
+`deployments/cilium/values/common.yaml` and the profile from
+`deployments/cilium/values/profiles/{{ cilium_profile }}.yaml`. Supported
+profiles are `k3d` and `flatcar-k3s`. It refuses to proceed if a kube-proxy
+DaemonSet is present, derives the dynamically published k3d API port from the
+new cluster's kubeconfig, passes the API endpoint explicitly to Helm, and waits
+for the Cilium DaemonSet.
+
+Use `cilium_profile: flatcar-k3s` for a dedicated VM deployment. Review the
+profile's routing assumptions and provide a stable control-plane API address.
+The dedicated VM profile defaults to Geneve tunneling. Native routing should
+only be selected when the VM network routes the pod CIDR between nodes.
 
 The playbook does not create Slack or Discord credentials. Those will be added
 through a separate opt-in Ansible secret toggle so ordinary bootstrap remains

ansible/bootstrap-flatcar-k3d.yml

@@ -7,6 +7,7 @@
   vars:
     argocd_enabled: true
     cilium_enabled: false
+    cilium_profile: k3d
 
   pre_tasks:
     - name: Read host operating system identity

ansible/inventory.flatcar-k3d.example.yml

@@ -8,6 +8,7 @@ all:
           ansible_ssh_private_key_file: ~/.ssh/REPLACE_WITH_KEY
           ansible_become_method: sudo
           cilium_enabled: false
+          cilium_profile: k3d
           cilium_k8s_service_host: REPLACE_WITH_REACHABLE_API_IP
           # Set to zero for k3d so Ansible derives the published API port from
           # the kubeconfig created during cluster bootstrap.

ansible/roles/cilium_bootstrap/defaults/main.yml

@@ -2,7 +2,9 @@
 cilium_enabled: false
 cilium_namespace: kube-system
 cilium_chart_version: 1.20.0
-cilium_values_file: "{{ k3d_workspace }}/deployments/cilium/cilium-values.yaml"
+cilium_profile: k3d
+cilium_common_values_file: "{{ k3d_workspace }}/deployments/cilium/values/common.yaml"
+cilium_profile_values_file: "{{ k3d_workspace }}/deployments/cilium/values/profiles/{{ cilium_profile }}.yaml"
 cilium_k8s_service_host: ""
 # k3d publishes the API on a dynamically allocated host port. A value of zero
 # makes the role derive that port from the kubeconfig created by k3d.

ansible/roles/cilium_bootstrap/tasks/main.yml

@@ -19,6 +19,12 @@
       - cilium_k8s_service_port | int > 0
     fail_msg: Set cilium_k8s_service_host and cilium_k8s_service_port for kube-proxy replacement.
 
+- name: Require a supported Cilium profile
+  ansible.builtin.assert:
+    that:
+      - cilium_profile in ['k3d', 'flatcar-k3s']
+    fail_msg: cilium_profile must be k3d or flatcar-k3s.
+
 - name: Verify kube-proxy is disabled
   ansible.builtin.raw: "{{ k3d_tool_dir }}/kubectl -n kube-system get daemonset kube-proxy"
   become_user: "{{ k3d_user }}"
@@ -47,7 +53,8 @@
     {{ k3d_tool_dir }}/helm upgrade --install cilium cilium/cilium
     --namespace {{ cilium_namespace }}
     --version {{ cilium_chart_version }}
-    --values {{ cilium_values_file }}
+    --values {{ cilium_common_values_file }}
+    --values {{ cilium_profile_values_file }}
     --set kubeProxyReplacement=true
     --set k8sServiceHost={{ cilium_k8s_service_host }}
     --set k8sServicePort={{ cilium_k8s_service_port }}