Refactor noble cluster configurations by removing deprecated Argo CD application management files and transitioning to a streamlined Ansible-driven installation approach. Update kustomization.yaml files to reflect the new structure, ensuring clarity on resource management. Introduce new namespaces and configurations for cert-manager, external-secrets, and logging components, enhancing the overall deployment process. Add detailed README.md documentation for each component to guide users through the setup and management of the noble lab environment.

clusters/noble/bootstrap/cilium/values.yaml

@@ -0,0 +1,44 @@
+# Cilium on Talos — phase 1: bring up CNI while kube-proxy still runs.
+# See README.md for install order (before MetalLB scheduling) and optional kube-proxy replacement.
+#
+# Chart: cilium/cilium — pin version in helm command (e.g. 1.16.6).
+# Ref: https://www.talos.dev/latest/kubernetes-guides/network/deploying-cilium/
+
+ipam:
+  mode: kubernetes
+
+kubeProxyReplacement: "false"
+
+# Host-network components cannot use kubernetes.default ClusterIP; Talos KubePrism (enabled by default)
+# on 127.0.0.1:7445 proxies to healthy apiservers and avoids flaky dials to cluster.controlPlane.endpoint (VIP).
+# Ref: https://www.talos.dev/latest/kubernetes-guides/configuration/kubeprism/
+k8sServiceHost: "127.0.0.1"
+k8sServicePort: "7445"
+
+securityContext:
+  capabilities:
+    ciliumAgent:
+      - CHOWN
+      - KILL
+      - NET_ADMIN
+      - NET_RAW
+      - IPC_LOCK
+      - SYS_ADMIN
+      - SYS_RESOURCE
+      - DAC_OVERRIDE
+      - FOWNER
+      - SETGID
+      - SETUID
+    cleanCiliumState:
+      - NET_ADMIN
+      - SYS_ADMIN
+      - SYS_RESOURCE
+
+cgroup:
+  autoMount:
+    enabled: false
+  hostRoot: /sys/fs/cgroup
+
+# Workaround: Talos host DNS forwarding + bpf masquerade can break CoreDNS; see Talos Cilium guide "Known issues".
+bpf:
+  masquerade: false