feat(cilium): loadbalancer mode default to dsr and allow configurability

Signed-off-by: Devin Buhl <devin@buhl.casa>

bootstrap/templates/kubernetes/apps/kube-system/cilium/app/helm-values.yaml.j2

@@ -43,7 +43,7 @@ l2announcements:
   #% endif %#
 loadBalancer:
   algorithm: maglev
-  mode: snat
+  mode: "#{ bootstrap_loadbalancer_mode|default('dsr', true) }#"
 localRedirectPolicy: true
 operator:
   replicas: 1

bootstrap/templates/kubernetes/apps/network/ingress-nginx/external/helmrelease.yaml.j2

@@ -30,7 +30,11 @@ spec:
         annotations:
           external-dns.alpha.kubernetes.io/hostname: "external.${SECRET_DOMAIN}"
           lbipam.cilium.io/ips: "#{ bootstrap_cloudflare.tunnel.ingress_vip }#"
+        #% if bootstrap_loadbalancer_mode in ['dsr']  %#
         externalTrafficPolicy: Cluster
+        #% else %#
+        externalTrafficPolicy: Local
+        #% endif %#
       ingressClassResource:
         name: external
         default: false

bootstrap/templates/kubernetes/apps/network/ingress-nginx/internal/helmrelease.yaml.j2

@@ -27,7 +27,11 @@ spec:
       service:
         annotations:
           lbipam.cilium.io/ips: "#{ bootstrap_cloudflare.ingress_vip }#"
+        #% if bootstrap_loadbalancer_mode in ['dsr']  %#
         externalTrafficPolicy: Cluster
+        #% else %#
+        externalTrafficPolicy: Local
+        #% endif %#
       ingressClassResource:
         name: internal
         default: true

bootstrap/templates/kubernetes/apps/network/k8s-gateway/app/helmrelease.yaml.j2

@@ -29,5 +29,9 @@ spec:
       port: 53
       annotations:
         lbipam.cilium.io/ips: "#{ bootstrap_cloudflare.gateway_vip }#"
+      #% if bootstrap_loadbalancer_mode in ['dsr']  %#
       externalTrafficPolicy: Cluster
+      #% else %#
+      externalTrafficPolicy: Local
+      #% endif %#
     watchedResources: ["Ingress", "Service"]