# Nested k3d profile.
# k3d nodes are Docker containers sharing a directly reachable bridge network.
# Native routing avoids the nested VXLAN service path that previously blocked
# pod access to ClusterIP services.
routingMode: native
autoDirectNodeRoutes: true

# K3s allocates pod addresses from this cluster-wide CIDR. Native routing
# requires the CIDR so Cilium can distinguish pod traffic from underlay traffic.
ipv4NativeRoutingCIDR: 10.42.0.0/16

# Nested nodes need BPF masquerading for return traffic across the Docker
# bridge. Keep socket load-balancing in the node namespace for this profile.
bpf:
  masquerade: true

socketLB:
  hostNamespaceOnly: true

# Ansible supplies k8sServiceHost and k8sServicePort during bootstrap because
# the published workstation port is dynamically allocated by k3d.