Stage default-off Cilium bandwidth manager with BBR #2607

🤖 Generated by the Daily AI Engineer

Summary

Stage the first #2029 datapath slice as a provider-scoped, default-off Kustomize component that enables Cilium's bandwidth manager and host-namespace-only BBR together.

Motivation

Cilium is now pinned to 1.20.0-pre.4, so the parent's version gate is met. Enabling these values directly would roll every Cilium agent in production because rollOutCiliumPods: true; the feature-flag-first contract therefore needs a zero-impact staging slice before a controlled activation.

Proposed solution

Add a Hetzner-only Cilium component that patches:

bandwidthManager:
  enabled: true
  bbr: true
  bbrHostNamespaceOnly: true

Keep the component unreferenced by default so current local and production renders remain byte-for-byte equivalent. Validate the opt-in state by temporarily composing it into the Hetzner controller overlay, where the existing base already enables WireGuard. Activation and live soak remain a separate short-lived child after this staging PR merges.

Acceptance criteria

• A Hetzner-scoped Kustomize component enables bandwidthManager.enabled and bandwidthManager.bbr together.
• bandwidthManager.bbrHostNamespaceOnly stays true until pod-BBR prerequisite Stage eBPF host-routing prerequisites for pod BBR #2609 has merged and soaked.
• The component is default-off; committed local and production cluster renders do not change.
• A temporary opt-in render proves both values are true while WireGuard remains enabled.
• Static validation passes for local, production, and the temporary opt-in state.
• Comments document the kernel prerequisite, qdisc/agent-roll impact, rollback, and the separate activation/soak follow-up.
• bpf.masquerade and netkit remain out of scope.
• Activation remains blocked until homogeneous device-selection issue Normalize Cilium devices before bandwidth-manager activation #2610 is complete.

Alternatives considered

• Enable the values directly: rejected for this slice because it would combine staging with a production-wide Cilium agent roll.
• Put the values in the shared base: rejected because this optimization is only approved for the Hetzner/WireGuard path.

Additional context

Part of #2029. Rough size: small. The activation follow-up must wait for #2609 and #2610, run in a low-traffic window, and verify Cilium status plus unexpected Hubble drops after the one-node-at-a-time roll.