From 2ff74cdc7c87fbe626c1ddd35e46d06926a2359e Mon Sep 17 00:00:00 2001
From: Ryan Blundon <ryan.blundon@protonmail.com>
Date: Sun, 17 May 2026 23:39:11 -0500
Subject: [PATCH] cilium TS

---
 cluster/platform/cilium-config/values.yaml | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/cluster/platform/cilium-config/values.yaml b/cluster/platform/cilium-config/values.yaml
index b150ac4..302a338 100644
--- a/cluster/platform/cilium-config/values.yaml
+++ b/cluster/platform/cilium-config/values.yaml
@@ -60,3 +60,24 @@ prometheus:
 # Without this the apply-sysctl-overwrites init container fails on Talos
 sysctlfix:
   enabled: false
+
+# Talos security compatibility
+# Talos restricts Linux capabilities — these settings align Cilium with Talos constraints
+securityContext:
+  capabilities:
+    ciliumAgent:
+      - CHOWN
+      - KILL
+      - NET_ADMIN
+      - NET_RAW
+      - IPC_LOCK
+      - SYS_ADMIN
+      - SYS_RESOURCE
+      - DAC_OVERRIDE
+      - FOWNER
+      - SETGID
+      - SETUID
+    cleanCiliumState:
+      - NET_ADMIN
+      - SYS_ADMIN
+      - SYS_RESOURCE