# platform/cilium

**Cilium** — CNI, kube-proxy replacement, Gateway API ingress, Egress Gateway, and Hubble.

- **Governing ADR:** [ADR-0002 — CNI, network policy & ingress: Cilium + Gateway API](../../../home-network-k3s/decisions/adr-0002-cni-cilium.md)
- **Spec:** [docs/03 — Networking](../../../home-network-k3s/docs/03-networking-isolation-and-egress.md),
  [docs/09 — DNS & Ingress](../../../home-network-k3s/docs/09-dns-and-ingress.md)
- **Serves:** R-NET-01..07, R-DNS-01, R-SEC-02
- **Owner:** WS-NET (bootstrap shared with WS-INFRA)

## What this stub is

A Flux `HelmRelease` + `HelmRepository` stub with placeholder values. **No cluster exists** (Phase 0);
this does not reconcile. Cilium replaces k3s' bundled **flannel + kube-proxy + Traefik**
(ADR-0001/0002).

## Bootstrap vs. GitOps (important)

Per [docs/02](../../../home-network-k3s/docs/02-environments-and-provisioning.md), Cilium's **initial**
install is done by the **Ansible k3s bootstrap** (Phase 1, WS-INFRA), because a cluster needs a CNI
before Flux can run. This HelmRelease **manages Cilium configuration thereafter**. The Helm values
here MUST stay consistent with the Ansible bootstrap values (`kubeProxyReplacement`, `k8sServiceHost`,
`k8sServicePort`) — otherwise Flux and the bootstrap fight. **Coordinate this contract with WS-INFRA.**

## TODO (later phases — not Phase 0)

- **Phase 1 (WS-INFRA/WS-NET):** align Helm values with the Ansible bootstrap; pin chart version.
- **Phase 2 (WS-NET):** default-deny network baseline; Egress Gateway policies; L2 announcement IP
  pool + `CiliumL2AnnouncementPolicy` for the ingress VIP; Hubble metrics → kube-prometheus-stack.
- **Phase 3 (WS-NET):** egress-class routing integration with the VPN gateway (ADR-0013).