Stage default-off Cilium bandwidth manager with BBR

[devantler]

🤖 Generated by the Daily AI Engineer

Summary

Stage the first #2029 datapath slice as a provider-scoped, default-off Kustomize component that enables Cilium's bandwidth manager and host-namespace-only BBR together.

Motivation

Cilium is now pinned to 1.20.0-pre.4, so the parent's version gate is met. Enabling these values directly would roll every Cilium agent in production because rollOutCiliumPods: true; the feature-flag-first contract therefore needs a zero-impact staging slice before a controlled activation.

Proposed solution

Add a Hetzner-only Cilium component that patches:

bandwidthManager:
  enabled: true
  bbr: true
  bbrHostNamespaceOnly: true

Keep the component unreferenced by default so current local and production renders remain byte-for-byte equivalent. Validate the opt-in state by temporarily composing it into the Hetzner controller overlay, where the existing base already enables WireGuard. Activation and live soak remain a separate short-lived child after this staging PR merges.

Acceptance criteria

• A Hetzner-scoped Kustomize component enables bandwidthManager.enabled and bandwidthManager.bbr together.
• bandwidthManager.bbrHostNamespaceOnly stays true until pod-BBR prerequisite Stage eBPF host-routing prerequisites for pod BBR #2609 has merged and soaked.
• The component is default-off; committed local and production cluster renders do not change.
• A temporary opt-in render proves both values are true while WireGuard remains enabled.
• Static validation passes for local, production, and the temporary opt-in state.
• Comments document the kernel prerequisite, qdisc/agent-roll impact, rollback, and the separate activation/soak follow-up.
• bpf.masquerade and netkit remain out of scope.
• Activation remains blocked until homogeneous device-selection issue Normalize Cilium devices before bandwidth-manager activation #2610 is complete.

Alternatives considered

• Enable the values directly: rejected for this slice because it would combine staging with a production-wide Cilium agent roll.
• Put the values in the shared base: rejected because this optimization is only approved for the Hetzner/WireGuard path.

Additional context

Part of #2029. Rough size: small. The activation follow-up must wait for #2609 and #2610, run in a low-traffic window, and verify Cilium status plus unexpected Hubble drops after the one-node-at-a-time roll.

[coderabbitai]

🔗 Related PRs

#2313 - feat(vpa): enable VPA for kube-system and kyverno workloads (prod) [merged]
#2370 - fix(autoscaling): break the DaemonSet-VPA node ratchet; keep Longhorn storage off autoscale nodes [merged]
#2445 - feat(kubescape): route runtime-detection alerts to Headlamp, Slack, and Coroot [merged]
#2475 - feat(autoscaling): add the SIG descheduler for pod rebalancing and node consolidation [merged]
#2527 - feat: install the OpenFeature Operator (runtime feature-flag layer) [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!