add environment-specific cilium profiles

2026-08-16 20:04:14 -04:00
parent 1a372b7eac
commit 6c79340d9a
14 changed files with 188 additions and 56 deletions
@@ -57,15 +57,24 @@ For the optional Cilium path, set these variables in the inventory:

 ```yaml
 cilium_enabled: true
+cilium_profile: k3d
 k3d_config_source: "{{ playbook_dir }}/../local-quickstart/k3d-cilium-cluster-config.yaml"
 cilium_k8s_service_host: 192.168.60.252
 cilium_k8s_service_port: 0
 ```

-The Cilium role refuses to proceed if a kube-proxy DaemonSet is present. It
-derives the dynamically published k3d API port from the new cluster's
-kubeconfig, passes the API endpoint explicitly to Helm, and waits for the
-Cilium DaemonSet.
+The Cilium role selects the shared values from
+`deployments/cilium/values/common.yaml` and the profile from
+`deployments/cilium/values/profiles/{{ cilium_profile }}.yaml`. Supported
+profiles are `k3d` and `flatcar-k3s`. It refuses to proceed if a kube-proxy
+DaemonSet is present, derives the dynamically published k3d API port from the
+new cluster's kubeconfig, passes the API endpoint explicitly to Helm, and waits
+for the Cilium DaemonSet.
+
+Use `cilium_profile: flatcar-k3s` for a dedicated VM deployment. Review the
+profile's routing assumptions and provide a stable control-plane API address.
+The dedicated VM profile defaults to Geneve tunneling. Native routing should
+only be selected when the VM network routes the pod CIDR between nodes.

 The playbook does not create Slack or Discord credentials. Those will be added
 through a separate opt-in Ansible secret toggle so ordinary bootstrap remains