feat: enable cilium l2 load balancing in freight cluster

kubernetes/main/core/kube-system/cilium/app/helm-release.yaml

@@ -0,0 +1,30 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cilium
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: cilium
+      version: 1.16.4
+      sourceRef:
+        kind: HelmRepository
+        name: cilium
+        namespace: flux-system
+  values:
+    l2announcements:
+      enabled: true
+    k8sClientRateLimit:
+      qps: 43
+      burst: 86
+    kubeProxyReplacement: true
+    k8sServiceHost: 192.168.10.40
+    k8sServicePort: 6443
+    devices: enp+
+    enableRuntimeDeviceDetection: true
+    externalIPs:
+      enabled: true
+    rollOutCiliumPods: true

kubernetes/main/core/kube-system/cilium/app/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ./helm-release.yaml

kubernetes/main/core/kube-system/cilium/config/kustomization.yaml

@@ -0,0 +1,5 @@
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ./l2.yaml

kubernetes/main/core/kube-system/cilium/config/l2.yaml

@@ -0,0 +1,24 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/cilium.io/ciliuml2announcementpolicy_v2alpha1.json
+apiVersion: "cilium.io/v2alpha1"
+kind: CiliumL2AnnouncementPolicy
+metadata:
+  name: policy
+spec:
+  nodeSelector:
+    matchExpressions:
+      - key: node-role.kubernetes.io/control-plane
+        operator: DoesNotExist
+  interfaces: ["^enp.*"]
+  loadBalancerIPs: true
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/cilium.io/ciliumloadbalancerippool_v2alpha1.json
+apiVersion: cilium.io/v2alpha1
+kind: CiliumLoadBalancerIPPool
+metadata:
+  name: main-pool
+spec:
+  allowFirstLastIPs: "Yes"
+  blocks:
+    - # same subnet as nodes
+      start: 192.168.10.70
+      stop: 192.168.1.89

kubernetes/main/core/kube-system/cilium/ks.yaml

@@ -0,0 +1,57 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cilium
+  namespace: flux-system
+spec:
+  targetNamespace: kube-system
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  path: ./kubernetes/thin/apps/kube-system/cilium/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-cluster
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
+  postBuild:
+    substitute: {}
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+      - kind: Secret
+        name: cluster-secrets
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cilium-config
+  namespace: flux-system
+spec:
+  targetNamespace: kube-system
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  path: ./kubernetes/thin/apps/kube-system/cilium/config
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-cluster
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
+  postBuild:
+    substitute: {}
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+      - kind: Secret
+        name: cluster-secrets
+  dependsOn:
+  - name: cilium

kubernetes/main/core/kube-system/kustomization.yaml

@@ -1,4 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- ./local-path-config.yaml
+- ./local-path-config.yaml
+- ./cilium/ks.yaml