docs(cilium): state the alert's map scope and complete the lockstep refs

Two optional points from the second review on #495.

The PrometheusRule alerts on cilium_bpf_map_pressure without filtering on
map_name, so it covers conntrack, NAT and LB maps as well as the policy
map. That is intended — running out of any of them degrades the datapath
— but the PR is framed around the policy map, so a reader could take the
narrow reading. Say so in the file.

The cross-references between the three copies of bpf-policy-map-max were
one-directional: helmrelease.yaml and patches/cilium-cni.yaml each named
only one other site, while talos/cilium.yaml named both. Each now names
the other two.

Not taken: the suggestion to quote policyMapMax as "65536". The chart
declares it `type: [null, integer]` in its values schema
(helm show values cilium --version 1.20.0), so an integer is correct and
a quoted string would be the schema violation.

Co-Authored-By: Claude Bot <claude-bot@renner.uno>

kubernetes/apps/monitoring-rules/prometheusrule-cilium.yaml

@@ -10,6 +10,13 @@ metadata:
 spec:
   groups:
     - name: cilium.rules
+      # Both alerts are map-agnostic on purpose. cilium_bpf_map_pressure is
+      # emitted per map type — policy, conntrack, NAT, LB — distinguished by
+      # the map_name label, and running out of any of them degrades the
+      # datapath. The policy map is merely the one that has bitten us.
+      # Cilium only exports the metric for maps above
+      # policyMapPressureMetricsThreshold (chart default 0.1), so quiet maps
+      # produce no series rather than a flood of near-zero ones.
       rules:
         - alert: CiliumBPFMapPressureHigh
           # cilium_bpf_map_pressure is used/capacity for the fullest map of

kubernetes/infrastructure/cilium/helmrelease.yaml

@@ -60,6 +60,8 @@ spec:
       # Bootstrap installs Cilium from the inline manifest in
       # kubernetes/talos/patches/cilium-cni.yaml, so bpf-policy-map-max there
       # must move with this value or a cold rebuild starts with the old size.
+      # kubernetes/talos/cilium.yaml carries a third copy of the same key.
+      # Nothing enforces any of this; grep bpf-policy-map-max before changing it.
       policyMapMax: 65536
       # Let pods reach the cluster's own LoadBalancer external IPs; Cilium
       # redirects the socket directly to the backend pod instead of sending

kubernetes/talos/patches/cilium-cni.yaml

@@ -321,9 +321,10 @@ cluster:
           bpf-map-dynamic-size-ratio: "0.0025"
           # bpf-policy-map-max specifies the maximum number of entries in endpoint
           # policy map (per endpoint). Keep in lockstep with values.bpf.policyMapMax
-          # in kubernetes/infrastructure/cilium/helmrelease.yaml: bootstrap installs
-          # Cilium from this inline manifest, so a lower value here means a cold
-          # rebuild comes up with a map that overflows until Flux reconciles.
+          # in kubernetes/infrastructure/cilium/helmrelease.yaml, and with the third
+          # copy in kubernetes/talos/cilium.yaml: bootstrap installs Cilium from this
+          # inline manifest, so a lower value here means a cold rebuild comes up with
+          # a map that overflows until Flux reconciles.
           bpf-policy-map-max: "65536"
           # bpf-policy-stats-map-max specifies the maximum number of entries in global
           # policy stats map