add environment-specific cilium profiles

deployments/cilium/values/profiles/k3d.yaml

@@ -0,0 +1,21 @@
+# Nested k3d profile.
+# k3d nodes are Docker containers sharing a directly reachable bridge network.
+# Native routing avoids the nested VXLAN service path that previously blocked
+# pod access to ClusterIP services.
+routingMode: native
+autoDirectNodeRoutes: true
+
+# K3s allocates pod addresses from this cluster-wide CIDR. Native routing
+# requires the CIDR so Cilium can distinguish pod traffic from underlay traffic.
+ipv4NativeRoutingCIDR: 10.42.0.0/16
+
+# Nested nodes need BPF masquerading for return traffic across the Docker
+# bridge. Keep socket load-balancing in the node namespace for this profile.
+bpf:
+  masquerade: true
+
+socketLB:
+  hostNamespaceOnly: true
+
+# Ansible supplies k8sServiceHost and k8sServicePort during bootstrap because
+# the published workstation port is dynamically allocated by k3d.