Enable Cilium Envoy ingress and L2 load balancing

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

README.md

@@ -82,6 +82,22 @@ update_containers.sh
 - `composectl.py` infers Compose stack names and paths from `compose-services/`.
 - `update_containers.sh` is a compatibility shim that delegates to the Python tool.
 
+## Developer workstation tools
+
+On this Linux workstation, install the repository's Kubernetes and infrastructure CLI tools with Homebrew:
+
+```bash
+brew install hashicorp/tap/terraform helm kubernetes-cli jq sops age
+brew tap siderolabs/tap
+brew install siderolabs/tap/talosctl@1.14
+brew tap devantler-tech/tap
+brew install --cask devantler-tech/tap/ksail
+```
+
+Terraform, Helm, kubectl, and Talosctl are used for cluster provisioning and operations; `jq` supports the documented command examples; SOPS and age support the repository's encrypted-secret workflow. The Talosctl formula is pinned to the 1.14 minor line used by this cluster. KSail is also configured as a workspace MCP server in the root `.mcp.json`; keep the Homebrew binary on `PATH` so VS Code can launch it.
+
+Compose operations additionally need Docker or Podman. This workstation uses its OS-managed Podman package; install Podman through the OS package manager when setting up another Linux machine, or use `brew install podman` if managing that CLI with Homebrew. Homebrew versions are workstation tooling, not deployment pins: deployed versions remain defined in the repository's Compose, Helm, and Terraform configuration.
+
 ## Runtime support
 
 The CLI detects and uses whichever runtime is available:
@@ -190,7 +206,7 @@ The Kubernetes path accepts a `nodes` list containing any number of control-plan
 
 11. Confirm Argo CD discovers `infrastructure/cilium`, `infrastructure/longhorn`, and `services/vaultwarden`, and that the Longhorn StorageClass is available before relying on Vaultwarden persistence.
 
-Talos uses its default CNI during bootstrap so Argo CD can start. Cilium is then reconciled as the first infrastructure application. Confirm the LAN interface and address pool before enabling production LoadBalancer services. Longhorn also requires a validated disk or mount on the storage node.
+Talos uses its default CNI during bootstrap so Argo CD can start. Cilium is then reconciled as the first infrastructure application. Cilium's Envoy ingress controller is enabled in shared-load-balancer mode; Ingress resources must set `spec.ingressClassName: cilium`. The Cilium LoadBalancer IP pool is `10.0.0.10–10.0.0.89`, announced over `enp1s0` with an L2 announcement policy. Keep that range reserved from DHCP and other static assignments, and recheck the interface and pool if the node network changes. Longhorn also requires a validated disk or mount on the storage node.
 
 The Terraform Talos provider uses one generated machine-secrets bundle for the whole node list. If the nodes were previously configured with another Talos CA, reset/reinstall them or restore the matching Terraform state before applying. Terraform state contains the generated Talos credentials and must remain private.
 

infrastructure/cilium/templates/l2-announcement-policy.yaml

@@ -0,0 +1,10 @@
+apiVersion: cilium.io/v2alpha1
+kind: CiliumL2AnnouncementPolicy
+metadata:
+  name: loadbalancer-services
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  interfaces:
+    - "^enp1s0$"
+  loadBalancerIPs: true

infrastructure/cilium/templates/loadbalancer-ippool.yaml

@@ -0,0 +1,10 @@
+apiVersion: cilium.io/v2alpha1
+kind: CiliumLoadBalancerIPPool
+metadata:
+  name: home-services
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  blocks:
+    - start: 10.0.0.10
+      stop: 10.0.0.89

infrastructure/cilium/values.yaml

@@ -43,12 +43,14 @@ cilium:
   externalIPs:
     enabled: true
 
+  ingressController:
+    enabled: true
+    default: false
+    loadbalancerMode: shared
+
   operator:
     replicas: 1
 
   # The LAN interface is enp1s0 on both Talos nodes.
   devices:
     - enp1s0
-
-# Configure a CiliumLoadBalancerIPPool and L2AnnouncementPolicy after
-# confirming the unused address range in the cluster LAN.