Commit crowdsec-firewall-bouncer headless-service fix (was uncommitted)

This fix for the EPERM ClusterIP-from-hostNetwork issue (Cilium socketLB
hostNamespaceOnly + hostNetwork bouncer + ClusterIP VIP) was made and
verified earlier but never committed - ArgoCD's selfHeal kept reverting
the live ConfigMap back to the broken crowdsec-service URL against git's
stale version, causing a fresh bouncer pod to crash-loop with the original
EPERM error again.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

infrastructure/crowdsec/manifests/firewall-bouncer.yaml

@@ -2,6 +2,34 @@
 # Blocks malicious IPs before they reach Cilium eBPF processing
 # Requires: hostNetwork + privileged (nftables management)
 # Image: community Docker build of cs-firewall-bouncer (no official image exists)
+#
+# api_url points at a headless Service (below), not the normal ClusterIP
+# crowdsec-service. Cilium's socketLB is configured hostNamespaceOnly (see
+# infrastructure/cilium/values.yaml, needed for Istio ambient compatibility),
+# which means socket-level Service translation/policy enforcement applies to
+# host-namespace traffic - and this bouncer runs hostNetwork: true, so it IS
+# host-namespace traffic. Connecting to a ClusterIP VIP from there gets an
+# immediate EPERM on connect() (confirmed live 2026-08-17, been broken since
+# this DaemonSet was first deployed 2026-03-03 - not a regression from any
+# recent change). A headless Service resolves straight to pod IPs via DNS -
+# no VIP, nothing for socket-LB to intercept - and connects cleanly.
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: crowdsec-lapi-headless
+  namespace: crowdsec
+spec:
+  clusterIP: None
+  selector:
+    k8s-app: crowdsec
+    type: lapi
+    version: v1
+  ports:
+    - name: lapi
+      port: 8080
+      protocol: TCP
+      targetPort: 8080
 ---
 apiVersion: v1
 kind: ConfigMap
@@ -14,7 +42,7 @@ data:
     update_frequency: 10s
     log_mode: stdout
     log_level: info
-    api_url: http://crowdsec-service.crowdsec.svc:8080/
+    api_url: http://crowdsec-lapi-headless.crowdsec.svc:8080/
     api_key: ${API_KEY}
     insecure_skip_verify: false
     disable_ipv6: false