---
# cilium role defaults (ADR-0002, docs/02 Cilium-ownership contract).
# This role performs the INITIAL Cilium install; the Flux platform/cilium
# HelmRelease adopts config afterward. The parity-critical values
# (kubeProxyReplacement, k8sServiceHost/Port) are templated from k3s_api_host.

# Pin inside the platform/cilium HelmRelease window (>=1.16.0 <1.17.0).
cilium_version: "1.16.5"
cilium_chart_repo_name: "cilium"
cilium_chart_repo_url: "https://helm.cilium.io/"
cilium_namespace: "kube-system"

# Gateway API CRDs (standard channel) must exist BEFORE Cilium with gatewayAPI.enabled.
# Cilium 1.16 targets Gateway API v1.2.x.
gateway_api_version: "v1.2.1"
gateway_api_crd_urls:
  - "https://github.com/kubernetes-sigs/gateway-api/releases/download/{{ gateway_api_version }}/standard-install.yaml"
  # TLSRoute (experimental) is required by Cilium's Gateway API support.
  - "https://raw.githubusercontent.com/kubernetes-sigs/gateway-api/{{ gateway_api_version }}/config/crd/experimental/gateway.networking.k8s.io_tlsroutes.yaml"

# Local kubeconfig fetched from the primary. *.kubeconfig is gitignored.
cilium_kubeconfig: "{{ playbook_dir }}/../.cache/dev.kubeconfig"
cilium_values_path: "{{ playbook_dir }}/../.cache/cilium-values.yaml"

# dev: single operator replica to save RAM (PHASE1-SCOPE RAM ceiling). NOT a
# parity field — Flux may differ here; only kubeProxyReplacement/k8sServiceHost
# /k8sServicePort must match the HelmRelease.
cilium_operator_replicas: 1