platform/cilium
Cilium — CNI, kube-proxy replacement, Gateway API ingress, Egress Gateway, and Hubble.
- Governing ADR: ADR-0002 — CNI, network policy & ingress: Cilium + Gateway API
- Spec: docs/03 — Networking, docs/09 — DNS & Ingress
- Serves: R-NET-01..07, R-DNS-01, R-SEC-02
- Owner: WS-NET (bootstrap shared with WS-INFRA)
What this stub is
A Flux HelmRelease + HelmRepository stub with placeholder values. No cluster exists (Phase 0);
this does not reconcile. Cilium replaces k3s' bundled flannel + kube-proxy + Traefik
(ADR-0001/0002).
Bootstrap vs. GitOps (important)
Per docs/02, Cilium's initial
install is done by the Ansible k3s bootstrap (Phase 1, WS-INFRA), because a cluster needs a CNI
before Flux can run. This HelmRelease manages Cilium configuration thereafter. The Helm values
here MUST stay consistent with the Ansible bootstrap values (kubeProxyReplacement, k8sServiceHost,
k8sServicePort) — otherwise Flux and the bootstrap fight. Coordinate this contract with WS-INFRA.
TODO (later phases — not Phase 0)
- Phase 1 (WS-INFRA/WS-NET): align Helm values with the Ansible bootstrap; pin chart version.
- Phase 2 (WS-NET): default-deny network baseline; Egress Gateway policies; L2 announcement IP
pool +
CiliumL2AnnouncementPolicyfor the ingress VIP; Hubble metrics → kube-prometheus-stack. - Phase 3 (WS-NET): egress-class routing integration with the VPN gateway (ADR-0013).