# Cilium Helm values — rendered by the Ansible bootstrap (T-1.3).
# PARITY CONTRACT (docs/02): the fields marked [parity] MUST equal the
# platform/cilium HelmRelease values, or Flux and the bootstrap fight over the CNI.
---
# [parity] k3s kube-proxy is disabled → Cilium replaces it (ADR-0001/0002).
kubeProxyReplacement: true
# [parity] = the k3s API endpoint (primary node IP). The Flux HelmRelease's
# k8sServiceHost "REPLACE-ME" must be set to this same value.
k8sServiceHost: "{{ k3s_api_host }}"
k8sServicePort: {{ k3s_api_port }}

# Ingress via Gateway API — no Traefik (docs/09, ADR-0002).
gatewayAPI:
  enabled: true

# Egress-class steering (ADR-0002; VPN model ADR-0013, Phase 2/3).
egressGateway:
  enabled: true

# Egress Gateway REQUIRES masquerade (ipv4 + eBPF). eBPF masquerade is the correct
# pairing with kubeProxyReplacement. [parity] must match platform/cilium HelmRelease.
enableIPv4Masquerade: true
bpf:
  masquerade: true

# Flow observability / isolation audit (ADR-0002).
hubble:
  enabled: true
  relay:
    enabled: true
  ui:
    enabled: true

# Ingress VIP announcement on the NAT LAN. IP pool / CiliumL2AnnouncementPolicy
# (from the reserved 10.73.0.240-.250 range) is authored by WS-NET in Phase 2.
l2announcements:
  enabled: true

# k3s ships its own cgroup mount; point Cilium at it instead of auto-mounting.
cgroup:
  autoMount:
    enabled: false
  hostRoot: /run/cilium/cgroupv2

operator:
  replicas: {{ cilium_operator_replicas }}