jakman85andClaude Opus 4.8
af4f6c07ae
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
31 lines
1.7 KiB
Markdown
31 lines
1.7 KiB
Markdown
# platform/cilium
|
|
|
|
**Cilium** — CNI, kube-proxy replacement, Gateway API ingress, Egress Gateway, and Hubble.
|
|
|
|
- **Governing ADR:** [ADR-0002 — CNI, network policy & ingress: Cilium + Gateway API](../../../home-network-k3s/decisions/adr-0002-cni-cilium.md)
|
|
- **Spec:** [docs/03 — Networking](../../../home-network-k3s/docs/03-networking-isolation-and-egress.md),
|
|
[docs/09 — DNS & Ingress](../../../home-network-k3s/docs/09-dns-and-ingress.md)
|
|
- **Serves:** R-NET-01..07, R-DNS-01, R-SEC-02
|
|
- **Owner:** WS-NET (bootstrap shared with WS-INFRA)
|
|
|
|
## What this stub is
|
|
|
|
A Flux `HelmRelease` + `HelmRepository` stub with placeholder values. **No cluster exists** (Phase 0);
|
|
this does not reconcile. Cilium replaces k3s' bundled **flannel + kube-proxy + Traefik**
|
|
(ADR-0001/0002).
|
|
|
|
## Bootstrap vs. GitOps (important)
|
|
|
|
Per [docs/02](../../../home-network-k3s/docs/02-environments-and-provisioning.md), Cilium's **initial**
|
|
install is done by the **Ansible k3s bootstrap** (Phase 1, WS-INFRA), because a cluster needs a CNI
|
|
before Flux can run. This HelmRelease **manages Cilium configuration thereafter**. The Helm values
|
|
here MUST stay consistent with the Ansible bootstrap values (`kubeProxyReplacement`, `k8sServiceHost`,
|
|
`k8sServicePort`) — otherwise Flux and the bootstrap fight. **Coordinate this contract with WS-INFRA.**
|
|
|
|
## TODO (later phases — not Phase 0)
|
|
|
|
- **Phase 1 (WS-INFRA/WS-NET):** align Helm values with the Ansible bootstrap; pin chart version.
|
|
- **Phase 2 (WS-NET):** default-deny network baseline; Egress Gateway policies; L2 announcement IP
|
|
pool + `CiliumL2AnnouncementPolicy` for the ingress VIP; Hubble metrics → kube-prometheus-stack.
|
|
- **Phase 3 (WS-NET):** egress-class routing integration with the VPN gateway (ADR-0013).
|