fix(cilium): set socketLB.hostNamespaceOnly to true

[martinohmann]

See: https://gist.github.com/joemiller/68ab3f7a7a08e4a9d5ad5d023cb14fc2
Docs: https://docs.cilium.io/en/stable/network/kubernetes/kubeproxy-free/#socket-loadbalancer-bypass-in-pod-namespace

Might even fix #379 too.

[github-actions]

kustomization changes in kubernetes/storage

--- kubernetes/storage/apps/kube-system/cilium/app Kustomization: flux-system/cilium HelmRelease: kube-system/cilium

+++ kubernetes/storage/apps/kube-system/cilium/app Kustomization: flux-system/cilium HelmRelease: kube-system/cilium

@@ -71,7 +71,9 @@

         enabled: true
         trustCRDsExist: true
     rollOutCiliumPods: true
     routingMode: native
     securityContext:
       privileged: true
+    socketLB:
+      hostNamespaceOnly: true
 

[github-actions]

helmrelease changes in kubernetes/storage

--- HelmRelease: kube-system/cilium ConfigMap: kube-system/cilium-config

+++ HelmRelease: kube-system/cilium ConfigMap: kube-system/cilium-config

@@ -54,12 +54,13 @@

   ipv4-native-routing-cidr: 10.132.0.0/16
   devices: bond0
   enable-runtime-device-detection: 'true'
   kube-proxy-replacement: 'true'
   kube-proxy-replacement-healthz-bind-address: 0.0.0.0:10256
   bpf-lb-sock: 'false'
+  bpf-lb-sock-hostns-only: 'true'
   bpf-lb-sock-terminate-pod-connections: 'false'
   nodeport-addresses: ''
   enable-health-check-nodeport: 'true'
   enable-health-check-loadbalancer-ip: 'false'
   node-port-bind-protection: 'true'
   enable-auto-protect-node-port-range: 'true'
--- HelmRelease: kube-system/cilium DaemonSet: kube-system/cilium

+++ HelmRelease: kube-system/cilium DaemonSet: kube-system/cilium

@@ -16,13 +16,13 @@

     rollingUpdate:
       maxUnavailable: 2
     type: RollingUpdate
   template:
     metadata:
       annotations:
-        cilium.io/cilium-configmap-checksum: a91320b34fa1dac6e798d8a5f7f3b3bd4c887fd6f1c277802547e750b8a1e9f1
+        cilium.io/cilium-configmap-checksum: 08084ec1b9d685c9bcc6706c436fa7fb86a7f95187871993d06041421fd8fb2c
       labels:
         k8s-app: cilium
         app.kubernetes.io/name: cilium-agent
         app.kubernetes.io/part-of: cilium
     spec:
       securityContext:
--- HelmRelease: kube-system/cilium Deployment: kube-system/cilium-operator

+++ HelmRelease: kube-system/cilium Deployment: kube-system/cilium-operator

@@ -20,13 +20,13 @@

       maxSurge: 25%
       maxUnavailable: 100%
     type: RollingUpdate
   template:
     metadata:
       annotations:
-        cilium.io/cilium-configmap-checksum: a91320b34fa1dac6e798d8a5f7f3b3bd4c887fd6f1c277802547e750b8a1e9f1
+        cilium.io/cilium-configmap-checksum: 08084ec1b9d685c9bcc6706c436fa7fb86a7f95187871993d06041421fd8fb2c
       labels:
         io.cilium/app: operator
         name: cilium-operator
         app.kubernetes.io/part-of: cilium
         app.kubernetes.io/name: cilium-operator
     spec:

[github-actions]

kustomization changes in kubernetes/main

--- kubernetes/main/apps/kube-system/cilium/app Kustomization: flux-system/cilium HelmRelease: kube-system/cilium

+++ kubernetes/main/apps/kube-system/cilium/app Kustomization: flux-system/cilium HelmRelease: kube-system/cilium

@@ -119,7 +119,9 @@

         enabled: true
         trustCRDsExist: true
     rollOutCiliumPods: true
     routingMode: native
     securityContext:
       privileged: true
+    socketLB:
+      hostNamespaceOnly: true
 

[github-actions]

helmrelease changes in kubernetes/main

--- HelmRelease: kube-system/cilium ConfigMap: kube-system/cilium-config

+++ HelmRelease: kube-system/cilium ConfigMap: kube-system/cilium-config

@@ -54,12 +54,13 @@

   enable-local-redirect-policy: 'true'
   ipv4-native-routing-cidr: 10.42.0.0/16
   enable-runtime-device-detection: 'true'
   kube-proxy-replacement: 'true'
   kube-proxy-replacement-healthz-bind-address: 0.0.0.0:10256
   bpf-lb-sock: 'false'
+  bpf-lb-sock-hostns-only: 'true'
   bpf-lb-sock-terminate-pod-connections: 'false'
   nodeport-addresses: ''
   enable-health-check-nodeport: 'true'
   enable-health-check-loadbalancer-ip: 'false'
   node-port-bind-protection: 'true'
   enable-auto-protect-node-port-range: 'true'
--- HelmRelease: kube-system/cilium DaemonSet: kube-system/cilium

+++ HelmRelease: kube-system/cilium DaemonSet: kube-system/cilium

@@ -16,13 +16,13 @@

     rollingUpdate:
       maxUnavailable: 2
     type: RollingUpdate
   template:
     metadata:
       annotations:
-        cilium.io/cilium-configmap-checksum: 968a68154bbe2b3a461ef7664c3e7b9ef5209437f68ff5db0d1c86d9aa717100
+        cilium.io/cilium-configmap-checksum: 03da2c1cd70e1fde6b7128a1f8c1d92cb79325432a1726b2c28cc4dacfcf2809
       labels:
         k8s-app: cilium
         app.kubernetes.io/name: cilium-agent
         app.kubernetes.io/part-of: cilium
     spec:
       securityContext:
--- HelmRelease: kube-system/cilium Deployment: kube-system/cilium-operator

+++ HelmRelease: kube-system/cilium Deployment: kube-system/cilium-operator

@@ -20,13 +20,13 @@

       maxSurge: 25%
       maxUnavailable: 100%
     type: RollingUpdate
   template:
     metadata:
       annotations:
-        cilium.io/cilium-configmap-checksum: 968a68154bbe2b3a461ef7664c3e7b9ef5209437f68ff5db0d1c86d9aa717100
+        cilium.io/cilium-configmap-checksum: 03da2c1cd70e1fde6b7128a1f8c1d92cb79325432a1726b2c28cc4dacfcf2809
       labels:
         io.cilium/app: operator
         name: cilium-operator
         app.kubernetes.io/part-of: cilium
         app.kubernetes.io/name: cilium-operator
     spec: