48 lines
1.8 KiB
YAML
48 lines
1.8 KiB
YAML
# Cilium Helm values — REFERENCE COPY of the parity set (docs/02 Cilium-ownership contract).
|
|
#
|
|
# The AUTHORITATIVE values that Flux reconciles are inlined in helmrelease.yaml. This file is a
|
|
# readable, un-nested mirror of that value set so WS-NET can diff it against the live cluster and
|
|
# the Ansible bootstrap render at a glance. Keep the two in sync.
|
|
#
|
|
# SOURCE OF TRUTH (all [parity] fields MUST equal these):
|
|
# infra/ansible/roles/cilium/templates/cilium-values.yaml.j2
|
|
# infra/ansible/roles/cilium/defaults/main.yml (cilium_version: 1.16.5, k3s_api_host/port)
|
|
#
|
|
# chart version (helmrelease.yaml chart.spec.version): 1.16.5 # [parity] = cilium_version
|
|
|
|
# [parity] k3s kube-proxy disabled → Cilium replaces it (ADR-0001/0002)
|
|
kubeProxyReplacement: true
|
|
# [parity] = the k3s API endpoint (primary control-plane node IP) + port
|
|
k8sServiceHost: "192.168.1.50"
|
|
k8sServicePort: 6443
|
|
# [parity] ingress via Gateway API, no Traefik (docs/09)
|
|
gatewayAPI:
|
|
enabled: true
|
|
# [parity] egress-class steering (ADR-0002; VPN model ADR-0013)
|
|
egressGateway:
|
|
enabled: true
|
|
# [parity] Egress Gateway REQUIRES masquerade; ipv4 + eBPF is the Phase-1 crash fix — keep BOTH
|
|
enableIPv4Masquerade: true
|
|
bpf:
|
|
masquerade: true
|
|
# [parity] flow observability / isolation audit
|
|
hubble:
|
|
enabled: true
|
|
relay:
|
|
enabled: true
|
|
ui:
|
|
enabled: true
|
|
# [parity] ingress VIP announcement on the flat LAN (docs/09, OQ-1)
|
|
l2announcements:
|
|
enabled: true
|
|
# [parity] k3s provides the cgroupv2 mount; do not auto-mount
|
|
cgroup:
|
|
autoMount:
|
|
enabled: false
|
|
hostRoot: /run/cilium/cgroupv2
|
|
# NON-parity (Flux/prod may differ; dev sets 1 to save RAM) — omitted from the HelmRelease:
|
|
# operator.replicas
|
|
#
|
|
# TODO (Phase 2, WS-NET): ipam / ipv4NativeRoutingCIDR pinned to cluster CIDRs; east-west
|
|
# encryption (wireguard/ipsec) decision (WS-SEC/WS-NET).
|