* fix(etcd): ensure consistent certificate permissions on first etcd node
The etcd certificate generation script runs on the first etcd node and
creates certs with default ownership and permissions. Subsequent copy
tasks set explicit ownership and permissions on the remaining etcd
nodes, resulting in inconsistent permissions across the cluster.
This can cause issues such as etcd backup jobs failing on the first
node due to missing read access to certificate files.
Add an ansible.builtin.file task after cert generation to explicitly
set the correct ownership and permissions on the first etcd node.
* fix(etcd): guard client certificate permissions
* fix(etcd): set certificate permissions during installation
* fix: correct CiliumBGPNodeConfigOverride CRD wait condition and deprecate legacy BGP Peering Policy
- Fix copy-paste bug where cilium_bgp_advertisements was used instead of
cilium_bgp_node_config_overrides when waiting for the
CiliumBGPNodeConfigOverride CRD. This caused the CRD readiness check
to be skipped when only node config overrides were configured.
- Add deprecation notices across docs, sample inventory, and defaults
to guide users away from the legacy v2alpha1 CiliumBGPPeeringPolicy
toward the supported BGP v2 API variables.
* fix(cilium): simplify BGP node override condition
Dasmat Hansda