M1: Install Cilium CNI with eBPF mode and Hubble

[CodeBuildder]

Goal

Install Cilium as the CNI with kube-proxy replacement and enable Hubble for network observability.

Tasks

• Install Cilium CLI on host (brew install cilium-cli)
• Install Cilium via Helm with flags:
  • kubeProxyReplacement=true
  • k8sServiceHost and k8sServicePort pointing to master
  • hubble.relay.enabled=true
  • hubble.ui.enabled=true
• Populate security/cilium/ values if using Helm
• Run cilium status — verify all components healthy
• Run cilium connectivity test — verify pod-to-pod connectivity

Acceptance criteria

• kubectl get nodes shows all 3 nodes in Ready state
• cilium status shows all green
• hubble observe returns live flow data
• kube-proxy pods absent from kube-system

Depends on

#3