feat(talos): Add cilium bgpControlPlane support and CNI security settings (#1296)

* fix: Use cilium cni install values for Talos

* fix: Use cilium cni install values for Talos

* feat: Add cilium bgpControlPlane support for Talos

* feat: Add cilium bgpControlPlane support for Talos

* feat: Add LB cidr var for Talos BGPCP

* feat: Add jinja template for cilium-bgp.yaml

* Add cilium bgpControlPlane support for Talos

* feat: Add cilium bgpControlPlane example config for Talos

* fix: Remove invalid fields from bgp peering policy

* fix: Add serviceSelector to bgp peering policy

* Update bootstrap/templates/partials/cilium-values-full.partial.yaml.j2

* Update bootstrap/templates/partials/cilium-values-init.partial.yaml.j2

* Update bootstrap/templates/partials/cilium-values-full.partial.yaml.j2

* Update bootstrap/templates/partials/cilium-values-init.partial.yaml.j2

---------

Co-authored-by: Devin Buhl <onedr0p@users.noreply.github.com>

bootstrap/templates/kubernetes/apps/kube-system/cilium/app/cilium-bgp.yaml.j2

@@ -0,0 +1,33 @@
+---
+# https://docs.cilium.io/en/latest/network/bgp-control-plane/
+apiVersion: cilium.io/v2alpha1
+kind: CiliumBGPPeeringPolicy
+metadata:
+  name: policy
+spec:
+  nodeSelector:
+    matchLabels:
+      kubernetes.io/os: linux
+  virtualRouters:
+    - localASN: {{ distribution.talos.bgp.local_asn }}
+      neighbors:
+        {% if distribution.talos.bgp.peers %}
+        {% for item in distribution.talos.bgp.peers %}
+        - peerAddress: "{{ item }}/32"
+          peerASN: {{ distribution.talos.bgp.peer_asn }}
+        {% endfor %}
+        {% else %}
+        - peerAddress: "{{ nodes.host_network | nthhost(1) }}/32"
+          peerASN: {{ distribution.talos.bgp.peer_asn }}
+        {% endif %}
+      serviceSelector:
+        matchExpressions:
+          - {key: somekey, operator: NotIn, values: ['never-used-value']}
+---
+apiVersion: cilium.io/v2alpha1
+kind: CiliumLoadBalancerIPPool
+metadata:
+  name: pool
+spec:
+  cidrs:
+    - cidr: "${LOADBALANCER_CIDR}"

bootstrap/templates/kubernetes/apps/kube-system/cilium/app/kustomization.yaml.j2

@@ -2,7 +2,11 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  {% if not feature_gates.dual_stack_ipv4_first %}
+  {% if distribution.talos.bgp.enabled %}
+  - ./cilium-bgp.yaml
+  {% endif %}
+  {% if ( (not distribution.talos.bgp.enabled) and
+          (feature_gates.dual_stack_ipv4_first) ) %}
   - ./cilium-l2.yaml
   {% endif %}
   - ./helmrelease.yaml