A number of fixes to get things running

infrastructure/cilium/templates/namespace.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cilium
+  labels:
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/audit: privileged
+    pod-security.kubernetes.io/warn: privileged

infrastructure/cilium/values.yaml

@@ -1,12 +1,42 @@
 # Confirm the interface and address pool before enabling L2 announcements.
 cilium:
   kubeProxyReplacement: true
-  k8sServiceHost: 10.0.0.99
-  k8sServicePort: 6443
+  k8sServiceHost: localhost
+  k8sServicePort: 7445
 
   ipam:
     mode: kubernetes
 
+  bpf:
+    hostLegacyRouting: true
+
+  cgroup:
+    autoMount:
+      enabled: false
+    hostRoot: /sys/fs/cgroup
+
+  extraConfig:
+    direct-routing-device: enp1s0
+
+  securityContext:
+    capabilities:
+      ciliumAgent:
+        - CHOWN
+        - KILL
+        - NET_ADMIN
+        - NET_RAW
+        - IPC_LOCK
+        - SYS_ADMIN
+        - SYS_RESOURCE
+        - DAC_OVERRIDE
+        - FOWNER
+        - SETGID
+        - SETUID
+      cleanCiliumState:
+        - NET_ADMIN
+        - SYS_ADMIN
+        - SYS_RESOURCE
+
   l2announcements:
     enabled: true
 
@@ -16,9 +46,9 @@ cilium:
   operator:
     replicas: 1
 
-# Replace with the LAN interface on both Talos nodes.
+  # The LAN interface is enp1s0 on both Talos nodes.
   devices:
-    - "<lan-interface>"
+    - enp1s0
 
 # Configure a CiliumLoadBalancerIPPool and L2AnnouncementPolicy after
 # confirming the unused address range in the cluster LAN.