Stage eBPF host-routing prerequisites for pod BBR

[devantler]

🤖 Generated by the Daily AI Engineer

Summary

Stage the datapath prerequisites that let Cilium BBR apply to ordinary pod network namespaces, while keeping the current production render unchanged by default.

Motivation

The default-off bandwidth-manager slice in #2608 can safely use bandwidthManager.bbrHostNamespaceOnly: true, but Cilium's documented pod-BBR path additionally requires eBPF host routing. The current Hetzner topology uses tunnel routing and intentionally leaves bpf.masquerade disabled, so removing the host-only guard before those prerequisites are proven would roll every Cilium agent without delivering pod BBR.

Proposed solution

Add a separate default-off Hetzner component for the smallest compatible eBPF host-routing / masquerade configuration. Validate it with the existing kube-proxy replacement, WireGuard tunnel, strict-mode, and private-NIC settings before any production activation.

Acceptance criteria

• Current committed local and production renders remain unchanged.
• A temporary opt-in render proves the complete pod-BBR prerequisite set.
• Compatibility with tunnel-mode WireGuard, strict mode, kube-proxy replacement, and existing device selection is documented and statically validated.
• bandwidthManager.bbrHostNamespaceOnly remains true until this prerequisite has merged and passed a separate live soak.
• Activation and rollback are separate, low-traffic-window changes with Cilium status and Hubble verification.
• No netkit migration is included.

Alternatives considered

• Enable pod BBR directly in feat(cilium): stage bandwidth manager with BBR #2608: rejected because the current datapath does not meet the documented prerequisites.
• Bundle the prerequisite with activation: rejected because it would combine multiple production-wide datapath changes in one roll.

Part of #2029. Blocks pod-scope activation of #2608. Rough size: medium.

[coderabbitai]

🔗 Related PRs

#2336 - feat(homepage): run inside a user namespace (hostUsers: false) [merged]
#2465 - docs: design for requiring VPN in front of critical services [merged]
#2474 - refactor: name patch fragments by intent and codify patch naming rules [merged]
#2527 - feat: install the OpenFeature Operator (runtime feature-flag layer) [merged]
#2569 - feat(policy): opt proven stateless apps into user namespaces [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!