add environment-specific cilium profiles

deployments/cilium/values/common.yaml

@@ -0,0 +1,16 @@
+# Shared Cilium settings for every cluster profile.
+# Environment-specific routing and API endpoint settings live under profiles/.
+kubeProxyReplacement: true
+
+ipam:
+  mode: kubernetes
+
+hubble:
+  enabled: true
+  relay:
+    enabled: true
+  ui:
+    enabled: true
+
+operator:
+  replicas: 1

deployments/cilium/values/profiles/flatcar-k3s.yaml

@@ -0,0 +1,14 @@
+# Dedicated VM profile.
+# Geneve tunneling is the portable default when the VM network does not have
+# explicit routes for the Kubernetes pod CIDR between nodes.
+routingMode: tunnel
+tunnelProtocol: geneve
+
+# Dedicated VMs do not need the nested-container socket-LB workaround.
+socketLB:
+  hostNamespaceOnly: false
+
+# Set these for an ArgoCD-managed installation, or override them through
+# Ansible when the control-plane address is environment-specific.
+k8sServiceHost: "REPLACE_WITH_CONTROL_PLANE_API_IP"
+k8sServicePort: 6443

deployments/cilium/values/profiles/k3d.yaml

@@ -0,0 +1,21 @@
+# Nested k3d profile.
+# k3d nodes are Docker containers sharing a directly reachable bridge network.
+# Native routing avoids the nested VXLAN service path that previously blocked
+# pod access to ClusterIP services.
+routingMode: native
+autoDirectNodeRoutes: true
+
+# K3s allocates pod addresses from this cluster-wide CIDR. Native routing
+# requires the CIDR so Cilium can distinguish pod traffic from underlay traffic.
+ipv4NativeRoutingCIDR: 10.42.0.0/16
+
+# Nested nodes need BPF masquerading for return traffic across the Docker
+# bridge. Keep socket load-balancing in the node namespace for this profile.
+bpf:
+  masquerade: true
+
+socketLB:
+  hostNamespaceOnly: true
+
+# Ansible supplies k8sServiceHost and k8sServicePort during bootstrap because
+# the published workstation port is dynamically allocated by k3d.