jakman85andClaude Opus 4.8
125ca428bc
- ansible.cfg: stdout_callback 'yaml' (community.general.yaml) was REMOVED in
ansible-core 2.20 -> use builtin default + result_format=yaml.
- cilium-values: egressGateway.enabled requires ipv4+eBPF masquerade or the
agent fatals at startup ('egress gateway requires --enable-ipv4-masquerade
and --enable-bpf-masquerade'). Add enableIPv4Masquerade + bpf.masquerade=true
(also the correct pairing with kubeProxyReplacement; [parity] w/ platform/cilium).
Verified live: 3/3 nodes Ready, embedded-etcd HA, Cilium status OK, CoreDNS up.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
47 lines
1.4 KiB
Django/Jinja
47 lines
1.4 KiB
Django/Jinja
# Cilium Helm values — rendered by the Ansible bootstrap (T-1.3).
|
|
# PARITY CONTRACT (docs/02): the fields marked [parity] MUST equal the
|
|
# platform/cilium HelmRelease values, or Flux and the bootstrap fight over the CNI.
|
|
---
|
|
# [parity] k3s kube-proxy is disabled → Cilium replaces it (ADR-0001/0002).
|
|
kubeProxyReplacement: true
|
|
# [parity] = the k3s API endpoint (primary node IP). The Flux HelmRelease's
|
|
# k8sServiceHost "REPLACE-ME" must be set to this same value.
|
|
k8sServiceHost: "{{ k3s_api_host }}"
|
|
k8sServicePort: {{ k3s_api_port }}
|
|
|
|
# Ingress via Gateway API — no Traefik (docs/09, ADR-0002).
|
|
gatewayAPI:
|
|
enabled: true
|
|
|
|
# Egress-class steering (ADR-0002; VPN model ADR-0013, Phase 2/3).
|
|
egressGateway:
|
|
enabled: true
|
|
|
|
# Egress Gateway REQUIRES masquerade (ipv4 + eBPF). eBPF masquerade is the correct
|
|
# pairing with kubeProxyReplacement. [parity] must match platform/cilium HelmRelease.
|
|
enableIPv4Masquerade: true
|
|
bpf:
|
|
masquerade: true
|
|
|
|
# Flow observability / isolation audit (ADR-0002).
|
|
hubble:
|
|
enabled: true
|
|
relay:
|
|
enabled: true
|
|
ui:
|
|
enabled: true
|
|
|
|
# Ingress VIP announcement on the NAT LAN. IP pool / CiliumL2AnnouncementPolicy
|
|
# (from the reserved 10.73.0.240-.250 range) is authored by WS-NET in Phase 2.
|
|
l2announcements:
|
|
enabled: true
|
|
|
|
# k3s ships its own cgroup mount; point Cilium at it instead of auto-mounting.
|
|
cgroup:
|
|
autoMount:
|
|
enabled: false
|
|
hostRoot: /run/cilium/cgroupv2
|
|
|
|
operator:
|
|
replicas: {{ cilium_operator_replicas }}
|