jakman85andClaude Opus 4.8
cbc2301b30
Text-only cleanup after the upgrade campaign. Updates stale version strings, prose, and comments to the verified current facts; no Kubernetes behavior or version pins changed except the kubectl toolchain bump (below). Verified facts applied: k3s v1.36.4+k3s1, Debian 13 trixie, Cilium 1.20.1 / Gateway API v1.6.1, Longhorn 1.12.1, node RAM 24 GiB, dedicated virtio2 SSD etcd disk per node, Velero chart 12.x / v1.18, Grafana 13.2.0. - Version strings across infra/ and platform/ READMEs + comments - kubectl toolchain 1.31.4 -> 1.36.4 (devcontainer/ci/conformance versions.env; 1.31 vs a 1.36 cluster exceeded the +-1 skew) - Retired-single-apps-Kustomization refs -> apps-wave-0/1/2 + apps-vms with per-wave SOPS decryption (flux/clusters docs + bootstrap.sh) - COMPLETED/historical banners on the three executed plan docs - Resolved TODO(WS-SEC) markers -> Renovate-maintained ranges - Appended dated DECISIONS-LOG entry (2026-08-30) superseding the 2026-08-26 LIVE STATE line Left as revalidation items (not blind-edited): external-snapshotter v8.2.0 vs 1.36, Cilium ext_authz/forward-auth relevance under 1.20.1, conformance ImageVolume feature-gate assertions under 1.36. Co-Authored-By: Claude Opus 4.8 <[email protected]>
30 lines
1.5 KiB
YAML
30 lines
1.5 KiB
YAML
---
|
|
# cilium role defaults (ADR-0002, docs/02 Cilium-ownership contract).
|
|
# This role performs the INITIAL Cilium install; the Flux platform/cilium
|
|
# HelmRelease adopts config afterward. The parity-critical values
|
|
# (kubeProxyReplacement, k8sServiceHost/Port) are templated from k3s_api_host.
|
|
|
|
# Exact pin — MUST equal the platform/cilium HelmRelease chart.spec.version (1.20.1, an
|
|
# exact pin, not a range). Renovate bumps both together.
|
|
cilium_version: "1.20.1"
|
|
cilium_chart_repo_name: "cilium"
|
|
cilium_chart_repo_url: "https://helm.cilium.io/"
|
|
cilium_namespace: "kube-system"
|
|
|
|
# Gateway API CRDs (standard channel) must exist BEFORE Cilium with gatewayAPI.enabled.
|
|
# Cilium 1.20.1 targets Gateway API v1.6.1.
|
|
gateway_api_version: "v1.6.1"
|
|
gateway_api_crd_urls:
|
|
- "https://github.com/kubernetes-sigs/gateway-api/releases/download/{{ gateway_api_version }}/standard-install.yaml"
|
|
# TLSRoute (experimental) is required by Cilium's Gateway API support.
|
|
- "https://raw.githubusercontent.com/kubernetes-sigs/gateway-api/{{ gateway_api_version }}/config/crd/experimental/gateway.networking.k8s.io_tlsroutes.yaml"
|
|
|
|
# Local kubeconfig fetched from the primary. *.kubeconfig is gitignored.
|
|
cilium_kubeconfig: "{{ playbook_dir }}/../.cache/dev.kubeconfig"
|
|
cilium_values_path: "{{ playbook_dir }}/../.cache/cilium-values.yaml"
|
|
|
|
# dev: single operator replica to save RAM (PHASE1-SCOPE RAM ceiling). NOT a
|
|
# parity field — Flux may differ here; only kubeProxyReplacement/k8sServiceHost
|
|
# /k8sServicePort must match the HelmRelease.
|
|
cilium_operator_replicas: 1
|