Normalize Cilium devices before bandwidth-manager activation

[devantler]

🤖 Generated by the Daily AI Engineer

Summary

Make Cilium's production device selection homogeneous across every managed node before the default-off bandwidth manager is activated.

Motivation

The current Hetzner overlay intentionally pins private-network devices as enp7s0 eth1: workers use enp7s0, while control planes use eth1. That protects the existing WireGuard and mutual-auth path, but Cilium's bandwidth-manager guidance requires each manually listed device name to exist consistently on every managed node. Enabling #2608 before resolving this mismatch could leave one node class without the expected FQ qdisc or fail the agent roll.

Proposed solution

Reconfirm the live six-node inventory, then choose the smallest safe homogeneous strategy: normalize the private NIC name in Talos, or adopt a supported auto-detection/selection mechanism that still resolves only the private-network NIC on both node classes. Keep the bandwidth-manager component off until the strategy is proven.

Acceptance criteria

• Live read-only inventory records the private-network interface name and address on every control-plane and worker node.
• The chosen selection is homogeneous for all Cilium-managed nodes and preserves private-IP primary-device behavior.
• Local and production renders validate in both default and staged states.
• WireGuard, strict mode, SPIRE mutual-auth, Cilium health, and external egress assumptions are explicitly preserved.
• Rollout is one node at a time in a low-traffic window with a documented rollback.
• Post-roll verification proves Cilium Ready and the expected bandwidth-manager device on every node before feat(cilium): stage bandwidth manager with BBR #2608 activation proceeds.

Alternatives considered

• Keep the heterogeneous manual list: rejected for bandwidth-manager activation because upstream requires consistent names.
• Remove devices immediately: rejected because that pin currently prevents the public-NIC mutual-auth failure documented in the overlay.

Part of #2029. Blocks activation of #2608. Rough size: medium.

[coderabbitai]

🔗 Related PRs

#2370 - fix(autoscaling): break the DaemonSet-VPA node ratchet; keep Longhorn storage off autoscale nodes [merged]
#2462 - feat(talos): WireGuard server listener on control planes (WS3 phase 1) [merged]
#2465 - docs: design for requiring VPN in front of critical services [merged]
#2474 - refactor: name patch fragments by intent and codify patch naming rules [merged]
#2524 - feat: enable the Hetzner floating-IP stable API endpoint on prod [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!