W5 (FINAL): Cilium 1.19.7->1.20.1 (+GW-API CRDs v1.6.1), Longhorn 1.11->1.12.1 (pre-k8s-1.36)

Cilium 1.20 is mandatory for k8s 1.36. GW-API CRDs v1.4.1->v1.6.1 (direct, never v1.5.x).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

infra/ansible/roles/cilium/defaults/main.yml

@@ -5,14 +5,14 @@
 # (kubeProxyReplacement, k8sServiceHost/Port) are templated from k3s_api_host.
 
 # Pin inside the platform/cilium HelmRelease window (>=1.16.0 <1.17.0).
-cilium_version: "1.19.7"
+cilium_version: "1.20.1"
 cilium_chart_repo_name: "cilium"
 cilium_chart_repo_url: "https://helm.cilium.io/"
 cilium_namespace: "kube-system"
 
 # Gateway API CRDs (standard channel) must exist BEFORE Cilium with gatewayAPI.enabled.
 # Cilium 1.16 targets Gateway API v1.2.x.
-gateway_api_version: "v1.4.1"
+gateway_api_version: "v1.6.1"
 gateway_api_crd_urls:
   - "https://github.com/kubernetes-sigs/gateway-api/releases/download/{{ gateway_api_version }}/standard-install.yaml"
   # TLSRoute (experimental) is required by Cilium's Gateway API support.