Update Cilium application configuration to ignore differences for hubble-server-certs Secret, add Helm value files for better management, and enhance Argo CD kustomization with resource ordering and sync options.

talos/talconfig.yaml

@@ -4,6 +4,16 @@ talosVersion: v1.12.5
 kubernetesVersion: v1.31.1
 allowSchedulingOnControlPlanes: true
 
+# kube-vip fronts the Kubernetes API at this IP (see clusters/noble/apps/kube-vip).
+# Without these SANs, TLS to https://192.168.50.230:6443 fails (cert does not match).
+# Talos API (talosctl -e) also uses endpoint; include VIP in machine cert SANs.
+additionalApiServerCertSans:
+  - 192.168.50.230
+  - kube.noble.lab.pcenicni.dev
+
+additionalMachineCertSans:
+  - 192.168.50.230
+
 # Use Cilium installed via GitOps (no bundled Talos CNI).
 cniConfig:
   name: none