Enable Cilium Envoy ingress and L2 load balancing

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

README.md

@@ -206,7 +206,7 @@ The Kubernetes path accepts a `nodes` list containing any number of control-plan
 
 11. Confirm Argo CD discovers `infrastructure/cilium`, `infrastructure/longhorn`, and `services/vaultwarden`, and that the Longhorn StorageClass is available before relying on Vaultwarden persistence.
 
-Talos uses its default CNI during bootstrap so Argo CD can start. Cilium is then reconciled as the first infrastructure application. Confirm the LAN interface and address pool before enabling production LoadBalancer services. Longhorn also requires a validated disk or mount on the storage node.
+Talos uses its default CNI during bootstrap so Argo CD can start. Cilium is then reconciled as the first infrastructure application. Cilium's Envoy ingress controller is enabled in shared-load-balancer mode; Ingress resources must set `spec.ingressClassName: cilium`. The Cilium LoadBalancer IP pool is `10.0.0.10–10.0.0.89`, announced over `enp1s0` with an L2 announcement policy. Keep that range reserved from DHCP and other static assignments, and recheck the interface and pool if the node network changes. Longhorn also requires a validated disk or mount on the storage node.
 
 The Terraform Talos provider uses one generated machine-secrets bundle for the whole node list. If the nodes were previously configured with another Talos CA, reset/reinstall them or restore the matching Terraform state before applying. Terraform state contains the generated Talos credentials and must remain private.
 

infrastructure/cilium/templates/l2-announcement-policy.yaml

@@ -0,0 +1,10 @@
+apiVersion: cilium.io/v2alpha1
+kind: CiliumL2AnnouncementPolicy
+metadata:
+  name: loadbalancer-services
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  interfaces:
+    - "^enp1s0$"
+  loadBalancerIPs: true

infrastructure/cilium/templates/loadbalancer-ippool.yaml

@@ -0,0 +1,10 @@
+apiVersion: cilium.io/v2alpha1
+kind: CiliumLoadBalancerIPPool
+metadata:
+  name: home-services
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  blocks:
+    - start: 10.0.0.10
+      stop: 10.0.0.89

infrastructure/cilium/values.yaml

@@ -43,12 +43,14 @@ cilium:
   externalIPs:
     enabled: true
 
+  ingressController:
+    enabled: true
+    default: false
+    loadbalancerMode: shared
+
   operator:
     replicas: 1
 
   # The LAN interface is enp1s0 on both Talos nodes.
   devices:
     - enp1s0
-
-# Configure a CiliumLoadBalancerIPPool and L2AnnouncementPolicy after
-# confirming the unused address range in the cluster LAN.