---
# cilium role defaults (ADR-0002, docs/02 Cilium-ownership contract).
# This role performs the INITIAL Cilium install; the Flux platform/cilium
# HelmRelease adopts config afterward. The parity-critical values
# (kubeProxyReplacement, k8sServiceHost/Port) are templated from
# k3s_apiserver_endpoint / k3s_api_port (group_vars/all.yml).
#
# k8sServiceHost IS THE HA VIP, NOT THE FOUNDER (changed 2026-09-06). It reads
# k3s_apiserver_endpoint — which derives from kube_vip_address, so it is dev 192.168.1.49 /
# prod 192.168.2.9 — and deliberately NOT k3s_api_host, the founder's own node IP. Those two
# were one variable until 2026-09-06, and the conflation is what left all three prod
# cilium-agents dialing k3s-prod-1 on an HA cluster. Do not re-merge them.
#
# THIS ROLE THEREFORE DEPENDS ON THE VIP EXISTING. playbooks/site.yml runs kube-vip.yml
# before cilium.yml and roles/kube_vip blocks until the VIP answers on 6443.

# Exact pin — MUST equal the platform/cilium HelmRelease chart.spec.version (1.20.1, an
# exact pin, not a range). Renovate bumps both together.
cilium_version: "1.20.1"
cilium_chart_repo_name: "cilium"
cilium_chart_repo_url: "https://helm.cilium.io/"
cilium_namespace: "kube-system"

# Gateway API CRDs (standard channel) must exist BEFORE Cilium with gatewayAPI.enabled.
# Cilium 1.20.1 targets Gateway API v1.6.1.
gateway_api_version: "v1.6.1"
gateway_api_crd_urls:
  # ONE URL, deliberately. As of v1.6.0 the STANDARD channel bundle already contains
  # TLSRoute (plus TCPRoute, UDPRoute, ListenerSet and BackendTLSPolicy), so the separate
  # experimental TLSRoute manifest this list used to carry is redundant — and worse than
  # redundant: v1.6 also ships a ValidatingAdmissionPolicy,
  # `safe-upgrades.gateway.networking.k8s.io`, which REJECTS an experimental-channel CRD
  # applied over a standard-channel one. Applying the old second URL therefore fails hard:
  #   ValidatingAdmissionPolicy 'safe-upgrades.gateway.networking.k8s.io' ... denied request:
  #   Installing experimental CRDs on top of standard channel CRDs is prohibited by default.
  # Verified 2026-09-04 on the prod bootstrap: standard-install.yaml v1.6.1 alone produces the
  # exact 10 gateway.networking.k8s.io CRDs the LIVE dev cluster is running, tlsroutes included
  # and annotated channel=standard, bundle-version=v1.6.1 — so this is parity with dev, not a
  # reduction. Dev needs no reapply; it already has them. If gateway_api_version is ever moved
  # BACK below v1.6.0, the experimental TLSRoute URL has to come back with it.
  - "https://github.com/kubernetes-sigs/gateway-api/releases/download/{{ gateway_api_version }}/standard-install.yaml"

# Local kubeconfig fetched from the primary. *.kubeconfig is gitignored. The FILENAME
# comes from cluster_kubeconfig_name (group_vars) so a prod run cannot overwrite the dev
# kubeconfig the dev container exports as $KUBECONFIG. R-ENV-02.
cilium_kubeconfig: "{{ playbook_dir }}/../.cache/{{ cluster_kubeconfig_name | default('dev.kubeconfig') }}"
cilium_values_path: "{{ playbook_dir }}/../.cache/cilium-values.yaml"

# dev: single operator replica to save RAM (PHASE1-SCOPE RAM ceiling). NOT a
# parity field — Flux may differ here; only kubeProxyReplacement/k8sServiceHost
# /k8sServicePort must match the HelmRelease.
cilium_operator_replicas: 1