chore(cilium): Limit l2adv to workers

kustomize-bases/cilium/l2-advertisement.yaml

@@ -5,3 +5,7 @@ metadata:
   name: l2adv
 spec:
   loadBalancerIPs: true
+  nodeSelector:
+    matchExpressions:
+      - key: node-role.kubernetes.io/control-plane
+        operator: DoesNotExist

kustomize-bases/cilium/values.yaml

@@ -42,16 +42,6 @@ hubble:
   ui:
     enabled: true
 
-envoy:
-  enabled: true
-  securityContext:
-    capabilities:
-      keepCapNetBindService: true
-      envoy:
-      - NET_ADMIN
-      - SYS_ADMIN
-      - NET_BIND_SERVICE
-
 gatewayAPI:
   enabled: true
   enableAlpn: true