cilium, argo

cilium-config/application.yaml

@@ -0,0 +1,43 @@
+# ------------------------------------------------------------------------------
+# Platform: Cilium — Helm upgrade + LB IPAM + Gateway API
+# Wave 4 — no dependencies, Cilium is pre-installed via Talos bootstrap
+#
+# This Application does two things:
+#   1. Manages Cilium itself via Helm (enables Gateway API, keeps config in git)
+#   2. Applies LB pool and L2 announcement manifests from repo
+#
+# IP Allocation:
+#   10.1.71.80-.89  — ingress-nginx LB pool
+#   10.1.71.90-.99  — Cilium Gateway LB pool
+# ------------------------------------------------------------------------------
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cilium-config
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "4"
+spec:
+  project: default
+  sources:
+    # Source 1: Cilium Helm chart — manages Cilium itself
+    - repoURL: https://helm.cilium.io
+      chart: cilium
+      targetRevision: 1.17.4
+      helm:
+        valueFiles:
+          - $values/cluster/platform/cilium-config/values.yaml
+    # Source 2: Repo — values ref + lb-pool.yaml + GatewayClass manifests
+    - repoURL: https://gitea.mk-labs.cloud/rblundon/homelab.git
+      targetRevision: main
+      path: cluster/platform/cilium-config/manifests
+      ref: values
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: kube-system
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - ServerSideApply=true

cilium-config/manifests/lb-pool.yaml

@@ -0,0 +1,41 @@
+# Pool for ingress-nginx
+apiVersion: cilium.io/v2
+kind: CiliumLoadBalancerIPPool
+metadata:
+  name: ingress-nginx-pool
+  namespace: kube-system
+spec:
+  blocks:
+    - start: 10.1.71.80
+      stop: 10.1.71.89
+  serviceSelector:
+    matchLabels:
+      app.kubernetes.io/name: ingress-nginx
+
+---
+# Pool for Cilium Gateway API
+apiVersion: cilium.io/v2
+kind: CiliumLoadBalancerIPPool
+metadata:
+  name: cilium-gateway-pool
+  namespace: kube-system
+spec:
+  blocks:
+    - start: 10.1.71.90
+      stop: 10.1.71.99
+  serviceSelector:
+    matchExpressions:
+      - key: io.cilium.gateway/owning-gateway
+        operator: Exists
+
+---
+# L2 Announcement Policy
+apiVersion: cilium.io/v2alpha1
+kind: CiliumL2AnnouncementPolicy
+metadata:
+  name: fastpass-l2-policy
+  namespace: kube-system
+spec:
+  loadBalancerIPs: true
+  interfaces:
+    - ^eth[0-9]+

cilium-config/values.yaml

@@ -0,0 +1,41 @@
+# ------------------------------------------------------------------------------
+# Cilium Helm Values — fastpass cluster
+# Chart: https://helm.cilium.io
+# Version: 1.17.4
+# ------------------------------------------------------------------------------
+
+# Bootstrap values
+kubeProxyReplacement: true
+k8sServiceHost: 10.1.71.65
+k8sServicePort: 6443
+ipam:
+  mode: kubernetes
+
+# Routing mode — replaces deprecated tunnel value
+routingMode: tunnel
+tunnelProtocol: vxlan
+
+# L2 announcements
+l2announcements:
+  enabled: true
+
+k8sClientRateLimit:
+  qps: 20
+  burst: 40
+
+externalIPs:
+  enabled: true
+
+# Hubble observability
+hubble:
+  enabled: true
+  relay:
+    enabled: true
+  ui:
+    enabled: true
+
+# Prometheus metrics
+prometheus:
+  enabled: true
+  serviceMonitor:
+    enabled: false