# ------------------------------------------------------------------------------
# Cilium Helm Values — fastpass cluster
# Chart: https://helm.cilium.io
# Version: 1.17.4
#
# These values are applied as a Helm upgrade over the bootstrap install.
# --reuse-values is implicit via ArgoCD's Helm source — existing values
# from the Talos bootstrap are preserved; we only override what's listed here.
#
# Talos bootstrap values (already set, do not need repeating):
#   kubeProxyReplacement: true
#   k8sServiceHost: 10.1.71.65
#   k8sServicePort: 6443
#   ipam.mode: kubernetes
#   tunnel: vxlan
# ------------------------------------------------------------------------------

# Enable Gateway API support — this is the key addition
# Cilium operator will register as a GatewayClass controller automatically
gatewayAPI:
  enabled: true

# L2 announcements — ARP-based LB IP advertisement on the server VLAN
l2announcements:
  enabled: true

# Rate limiting for L2 announcements — important with many services
# Tune up if you see "rate limit exceeded" in cilium-operator logs
k8sClientRateLimit:
  qps: 20
  burst: 40

# ExternalIPs advertisement
externalIPs:
  enabled: true

# Hubble observability — worth enabling for visibility into cluster traffic
hubble:
  enabled: true
  relay:
    enabled: true
  ui:
    enabled: true
  metrics:
    enabled:
      - dns
      - drop
      - tcp
      - flow
      - port-distribution
      - httpV2

# Prometheus metrics
prometheus:
  enabled: true
  serviceMonitor:
    enabled: false  # enable once Prometheus operator is in-cluster

# Talos compatibility — /etc/sysctl.d/ does not exist on Talos nodes
# Without this the apply-sysctl-overwrites init container fails on Talos
sysctlfix:
  enabled: false