fix(just): pre-create cilium connectivity-test namespaces privileged

[jvcorredor]

Summary

just smoke always failed at the smoke-cilium step. cilium-cli creates its test namespaces — cilium-test-1 plus the cilium-test-ccnp* pair for the CiliumClusterwideNetworkPolicy tests — with no PodSecurity labels, so they inherit the cluster-wide default Talos ships (enforce: baseline). The connectivity-test fixtures require NET_RAW, hostNetwork, and hostPort, all forbidden under baseline:

pods "client-...-88p57" is forbidden: violates PodSecurity "baseline:latest":
non-default capabilities (container "client" must not include "NET_RAW")

Every test pod was rejected at admission, the deployments never got a replica, and cilium-cli timed out (replicas count is zero).

Fix

The smoke-cilium recipe now pre-creates all three test namespaces labelled privileged before invoking cilium connectivity test; cilium-cli reuses an existing namespace as-is.

cilium-cli's --namespace-labels flag was tried first but only labels the primary test namespace — the auxiliary cilium-test-ccnp* namespaces still inherited baseline and failed. Pre-creating covers all of them uniformly. The namespace names track cilium-cli's convention for the default --test-concurrency 1.

create --dry-run=client | apply + label --overwrite are idempotent, so a namespace left over from a prior failed run is handled cleanly.

Context

Version-independent — this recipe would fail identically on any Cilium release. It surfaced while verifying the Cilium 1.19.4 upgrade (#198): the upgrade is healthy, but its just smoke acceptance criterion was not actually satisfiable as the recipe stood.

Testing

• just --list renders smoke-cilium with its intended one-line description.
• Partial verification done: with the namespaces pre-labelled, the connectivity-test fixtures are admitted and run (previously 0 pods). A full just smoke run against the rockingham cluster to confirm the whole matrix passes is in progress.

Closes: #211

🤖 Generated with Claude Code