- The k8s-gateway values were read with `yq -y`, a flag only the Python yq has. The vmtest image installs Alpine's `yq`, which is yq-go (mikefarah), so the talos phase would fail there. Without the flag both print a document helm accepts, as the Cilium values line already relies on. - A cni-confdir pod left from an earlier run (Failed or Succeeded) made `kubectl apply` a no-op and the wait time out. The step deletes it first. - The Cilium HelmRelease comment named itself the only place Cilium is configured; the site patch's cilium-site ConfigMap is the other. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>