talos: add dummy0 interface claiming BGP-pool prefixes (AnyIP for ICMP)

Cilium's eBPF LB intercepts TCP/UDP destined for Service VIPs before
the kernel routing path, but ICMP/ICMPv6 isn't intercepted — packets
hit the kernel, the kernel has no interface owning the LB IP, default
route forwards back to the UDM, BGP routes back to a node, loop until
hop-limit exceeded. The "AnyIP" routing fix is to put the LB pool
prefixes on a dummy interface so the kernel claims them as local and
answers ICMP directly. Documented in the MetalLB BGP guide and in
Talos's machine.network.interfaces.dummy schema.

Applied to all four nodes (k8s-1/2/3/edge) since traffic may land on
any of them; the dummy interface is per-node. The /24 + /64 covers
the full bgp-pool range, future-proofing against new LB allocations
without further node config changes.

This is a kernel-network change — applying the patch requires a
rolling reboot of each node (talosctl patch --mode=auto + drain,
wait for Ceph HEALTH_OK between nodes per the wait-for-ceph rule).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

kubernetes/talos/patches/k8s-1.yaml

@@ -35,6 +35,18 @@ machine:
         addresses:
           - 10.99.0.1/29
         mtu: 9000
+      # Dummy interface claiming the BGP-pool prefixes so the kernel sees
+      # LB VIPs as locally owned. Cilium's eBPF LB intercepts TCP/UDP but
+      # not ICMP/ICMPv6, so ICMP to an LB VIP otherwise hits the kernel
+      # routing path, gets forwarded out the default route, and loops
+      # back via BGP until hop-limit exceeded. With the LB prefixes on
+      # dummy0 the kernel answers directly. AnyIP routing pattern; see
+      # cilium-ebpf-lb-icmp-ttl-loop-quirk wiki note.
+      - interface: dummy0
+        dummy: true
+        addresses:
+          - 10.2.99.0/24
+          - fd99::/64
   install:
     disk: /dev/vda
   certSANs:

kubernetes/talos/patches/k8s-2.yaml

@@ -19,6 +19,12 @@ machine:
         addresses:
           - 10.99.0.2/29
         mtu: 9000
+      # See k8s-1.yaml for the dummy0 / AnyIP rationale.
+      - interface: dummy0
+        dummy: true
+        addresses:
+          - 10.2.99.0/24
+          - fd99::/64
   install:
     disk: /dev/vda
   certSANs:

kubernetes/talos/patches/k8s-3.yaml

@@ -19,6 +19,12 @@ machine:
         addresses:
           - 10.99.0.3/29
         mtu: 9000
+      # See k8s-1.yaml for the dummy0 / AnyIP rationale.
+      - interface: dummy0
+        dummy: true
+        addresses:
+          - 10.2.99.0/24
+          - fd99::/64
   install:
     disk: /dev/vda
   certSANs:

kubernetes/talos/patches/k8s-edge.yaml

@@ -29,6 +29,18 @@ machine:
         dhcp: true
         dhcpOptions:
           routeMetric: 4096
+      # Dummy interface claiming the BGP-pool prefixes so the kernel sees
+      # LB VIPs as locally owned. Cilium's eBPF LB intercepts TCP/UDP but
+      # not ICMP/ICMPv6, so ICMP to an LB VIP otherwise hits the kernel
+      # routing path, gets forwarded out the default route, and loops
+      # back via BGP until hop-limit exceeded. With the LB prefixes on
+      # dummy0 the kernel answers directly. AnyIP routing pattern; see
+      # cilium-ebpf-lb-icmp-ttl-loop-quirk wiki note.
+      - interface: dummy0
+        dummy: true
+        addresses:
+          - 10.2.99.0/24
+          - fd99::/64
   install:
     disk: /dev/vda
   certSANs: