---
# Cilium — CNI, kube-proxy replacement, Gateway API, Egress Gateway, Hubble (ADR-0002).
# Phase 0 STUB. Values are PLACEHOLDERS; fill in during Phase 1/2 (WS-NET).
#
# IMPORTANT (cross-workstream contract): Cilium's INITIAL install is performed by the Ansible
# bootstrap (spec docs/02, Phase 1), replacing k3s flannel/kube-proxy. This HelmRelease manages
# Cilium CONFIG going forward. Its values MUST match the Ansible bootstrap values (kubeProxyReplacement,
# k8sServiceHost/Port) or Flux and the bootstrap will fight. Owner: WS-NET + WS-INFRA.
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: cilium
  namespace: kube-system
spec:
  interval: 30m
  chart:
    spec:
      chart: cilium
      version: ">=1.16.0 <1.17.0"   # TODO(WS-NET): pin exact version at bring-up; Renovate maintains
      sourceRef:
        kind: HelmRepository
        name: cilium
        namespace: kube-system
  install:
    remediation:
      retries: 3
  upgrade:
    remediation:
      retries: 3
  # Placeholder values — see values.yaml for the annotated skeleton. Inlined here so the intent
  # (Cilium REPLACES flannel + kube-proxy + Traefik) is visible at the release.
  values:
    # --- kube-proxy replacement (ADR-0001/0002: k3s kube-proxy disabled) ---
    kubeProxyReplacement: true
    # TODO(WS-INFRA): k8sServiceHost/k8sServicePort must equal the Ansible bootstrap's API endpoint.
    k8sServiceHost: "REPLACE-ME"     # e.g. the k3s API VIP/host
    k8sServicePort: 6443
    # --- Gateway API (ingress; replaces Traefik) — docs/09, ADR-0002 ---
    gatewayAPI:
      enabled: true
    # --- Egress Gateway (egress-class steering; part of VPN model with ADR-0013) ---
    egressGateway:
      enabled: true
    # --- Hubble (flow observability / isolation audit) ---
    hubble:
      enabled: true
      relay:
        enabled: true
      ui:
        enabled: true   # exposure gated behind oauth2-proxy forward-auth later (ADR-0014)
    # --- L2 announcement for the ingress VIP on the flat LAN (docs/09, OQ-1 resolved) ---
    l2announcements:
      enabled: true
    # TODO(WS-NET, Phase 2): default-deny baseline, CiliumL2AnnouncementPolicy + IP pool,
    #   Egress Gateway policies, Hubble metrics export to kube-prometheus-stack.