Autonomous session: Phase-2 platform authoring + Flux bootstrap progress

Author-only Phase-2 components (platform suspended; cluster untouched):
- platform/longhorn: 3-replica SC + bulk external-mount indirection (R-STATE)
- platform/monitoring: kube-prometheus-stack + Loki + Alloy (dev-trimmed) + 8 alert rules (R-OBS)
- platform/cilium: parity fix (k8sServiceHost=10.73.0.11 + masquerade) safe to adopt Phase 2
- conformance: partial L2 tests (worker hit session limit; incomplete — see DECISIONS-LOG K2)
- bootstrap/gitea: fix rootless-podman perms (host bind-mount -> named volume)

Flux installed on the cluster; host Gitea up + repo pushed; GitRepository BLOCKED by
host firewalld (VM->10.73.0.1:3000) — needs one operator sudo command (DECISIONS-LOG).
Known issue K1: cluster-vars substitution-var case mismatch (fix before un-suspend).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

platform/cilium/values.yaml

@@ -1,13 +1,47 @@
-# Cilium Helm values — PLACEHOLDER skeleton (Phase 0). Authoritative values live inline in
-# helmrelease.yaml for now; this file documents the knobs WS-NET must set in Phase 1/2.
+# Cilium Helm values — REFERENCE COPY of the parity set (docs/02 Cilium-ownership contract).
 #
-# MUST match the Ansible bootstrap (docs/02) for the fields the bootstrap also sets.
+# The AUTHORITATIVE values that Flux reconciles are inlined in helmrelease.yaml. This file is a
+# readable, un-nested mirror of that value set so WS-NET can diff it against the live cluster and
+# the Ansible bootstrap render at a glance. Keep the two in sync.
 #
-# kubeProxyReplacement: true            # k3s kube-proxy disabled (ADR-0001/0002)
-# k8sServiceHost / k8sServicePort       # = Ansible bootstrap API endpoint (WS-INFRA contract)
-# gatewayAPI.enabled: true              # ingress via Gateway API, no Traefik (docs/09)
-# egressGateway.enabled: true           # egress-class steering (ADR-0002, VPN model ADR-0013)
-# hubble.{enabled,relay,ui}             # flow observability + isolation audit
-# l2announcements.enabled: true         # ingress VIP on flat LAN (docs/09, OQ-1)
-# ipam / ipv4NativeRoutingCIDR          # TODO: pin to the cluster pod/LAN CIDRs at bring-up
-# encryption (wireguard/ipsec)          # TODO(WS-SEC/WS-NET): decide east-west encryption later
+# SOURCE OF TRUTH (all [parity] fields MUST equal these):
+#   infra/ansible/roles/cilium/templates/cilium-values.yaml.j2
+#   infra/ansible/roles/cilium/defaults/main.yml   (cilium_version: 1.16.5, k3s_api_host/port)
+#
+# chart version (helmrelease.yaml chart.spec.version): 1.16.5   # [parity] = cilium_version
+
+# [parity] k3s kube-proxy disabled → Cilium replaces it (ADR-0001/0002)
+kubeProxyReplacement: true
+# [parity] = the k3s API endpoint (primary control-plane node IP) + port
+k8sServiceHost: "10.73.0.11"
+k8sServicePort: 6443
+# [parity] ingress via Gateway API, no Traefik (docs/09)
+gatewayAPI:
+  enabled: true
+# [parity] egress-class steering (ADR-0002; VPN model ADR-0013)
+egressGateway:
+  enabled: true
+# [parity] Egress Gateway REQUIRES masquerade; ipv4 + eBPF is the Phase-1 crash fix — keep BOTH
+enableIPv4Masquerade: true
+bpf:
+  masquerade: true
+# [parity] flow observability / isolation audit
+hubble:
+  enabled: true
+  relay:
+    enabled: true
+  ui:
+    enabled: true
+# [parity] ingress VIP announcement on the flat LAN (docs/09, OQ-1)
+l2announcements:
+  enabled: true
+# [parity] k3s provides the cgroupv2 mount; do not auto-mount
+cgroup:
+  autoMount:
+    enabled: false
+  hostRoot: /run/cilium/cgroupv2
+# NON-parity (Flux/prod may differ; dev sets 1 to save RAM) — omitted from the HelmRelease:
+#   operator.replicas
+#
+# TODO (Phase 2, WS-NET): ipam / ipv4NativeRoutingCIDR pinned to cluster CIDRs; east-west
+#   encryption (wireguard/ipsec) decision (WS-SEC/WS-NET).