cilium: Fix tunnel option - #392

Signed-off-by: Andrei Kvapil <[email protected]>

Signed-off-by: Andrei Kvapil <[email protected]>

Signed-off-by: Andrei Kvapil <[email protected]>

Signed-off-by: Andrei Kvapil <[email protected]>

…ed API

CAPK v0.1.10 pins kubevirt.io/api v1.5.0, whose
VirtualMachineInstanceMigrationSpec carries only vmiName; upstream cozystack#392
sets priority against v1.9.0. The typed migration does not compile against
the pinned API, which is why the patch builds it unstructured.

Assisted-by: LLM
Signed-off-by: Yan Bondarenko <[email protected]>

…ed API

CAPK v0.1.10 pins kubevirt.io/api v1.5.0, whose
VirtualMachineInstanceMigrationSpec carries only vmiName; upstream cozystack#392
sets priority against v1.9.0. The typed migration does not compile against
the pinned API, which is why the patch builds it unstructured.

Assisted-by: LLM
Signed-off-by: Yan Bondarenko <[email protected]>

## What this PR does

CAPK v0.1.10 handles host eviction by draining and deleting the guest
VMI. It also looks up the physical host name in the guest cluster, and a
recreated guest can remain cordoned. Backport CAPK #374, #389 and #392
onto the current provider API and runtime, with separate bounded
submission, active migration and fallback windows, and ordinary VMIM
objects without a priority, a field the pinned `kubevirt.io/api` v1.5.0
does not carry. The submitted VMIM deadline survives reconciliation;
expired, invalid or legacy marker values enter the existing fallback
path.

Add the manager build to the package pipeline, read its digest pin
through the provider imageUrl override, and ship VMIM create permission
in the compressed provider manifest. Source tests and four packaging
checks pass, including failed-build pin preservation and the rendered
ConfigMap payload. The regression tests include unprocessed submissions,
legacy and invalid deadline values, repeated reconciles, and a fresh
active migration window after submission expiry. The updated manager
also cross-compiles for linux/amd64 with Go1.26.4. The previous OCI
build predates the submission-deadline correction and does not validate
an image containing this change. The updated source still needs the
maintainer-owned image build described below.

The checked-in pin still identifies the original upstream image, so
installing this source chart directly does not enable the backport. The
regular main and release builds now include this package, stamp the
built image digest, and package that exact artifact; the release
workflow also commits the generated pin. Pre-merge E2E validation needs
a maintainer-owned build because fork publication only allows image
repositories already present in the base tree.

### Downstream repositories

- [x] No downstream repository is affected by this change
- [ ] [cozystack/website](https://github.com/cozystack/website) -
follow-up:
- [ ]
[cozystack/terraform-provider-cozystack](https://github.com/cozystack/terraform-provider-cozystack)
- follow-up:
- [ ]
[cozystack/ansible-cozystack](https://github.com/cozystack/ansible-cozystack)
- follow-up:
- [ ] [cozystack/ccp](https://github.com/cozystack/ccp) - follow-up:
- [ ] [cozystack/talm](https://github.com/cozystack/talm) - follow-up:
- [ ] [cozystack/cozyhr](https://github.com/cozystack/cozyhr) -
follow-up:
- [ ] [cozystack/cozy-proxy](https://github.com/cozystack/cozy-proxy) -
follow-up:
- [ ]
[cozystack/cozystack-telemetry-server](https://github.com/cozystack/cozystack-telemetry-server)
- follow-up:
- [ ]
[cozystack/external-apps-example](https://github.com/cozystack/external-apps-example)
- follow-up:
- [ ] [cozystack/examples](https://github.com/cozystack/examples) -
follow-up:
- [ ] [cozystack/community](https://github.com/cozystack/community) -
follow-up:

### Release note

```release-note
fix(cluster-api): attempt live migration before drain/delete on External eviction, use the guest node name for fallback drain, and uncordon recreated guests.
```


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **New Features**
- Added a Cluster API Provider KubeVirt image pinned to version 0.1.10.
- Added migration-first workload eviction with fallback draining and
node recovery.
  - Added permission to create virtual machine migration resources.
  - Included the provider image in builds and deployment templates.

- **Bug Fixes**
- Preserved migration deadlines across retries and improved recovery
after interrupted or completed migrations.
  - Added a bounded wait for migrations before falling back to draining.

- **Documentation**
- Documented the provider image version, patches, build process, and
release considerations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

…ed API

CAPK v0.1.10 pins kubevirt.io/api v1.5.0, whose
VirtualMachineInstanceMigrationSpec carries only vmiName; upstream #392
sets priority against v1.9.0. The typed migration does not compile against
the pinned API, which is why the patch builds it unstructured.

Assisted-by: LLM
Signed-off-by: Yan Bondarenko <[email protected]>
(cherry picked from commit bc2ba10)