# ─── Cilium Helm values — fastpass cluster ───────────────────────────────────
# Install command (run from city-hall after cluster bootstrap):
#
#   helm repo add cilium https://helm.cilium.io/
#   helm repo update
#   helm upgrade --install cilium cilium/cilium \
#     --version 1.17.3 \
#     --namespace kube-system \
#     --values cilium-values.yaml \
#     --wait
#
# Verify:
#   kubectl -n kube-system get pods -l app.kubernetes.io/name=cilium-agent
#   cilium status --wait
#
# IMPORTANT: Cilium is Helm-only. Never manage this with ArgoCD.
# ArgoCD manages everything else; this is the one exception.
# ─────────────────────────────────────────────────────────────────────────────

# ─── Talos-specific requirements ─────────────────────────────────────────────
# Talos does not have a traditional kernel with modules loadable at runtime.
# Cilium must be told to use eBPF-native mode and not rely on iptables modules.
kubeProxyReplacement: true

# kube-proxy is not running in Talos — Cilium replaces it entirely
k8sServiceHost: 10.1.71.65   # VIP
k8sServicePort: 6443

# ─── Routing — tunnel mode ───────────────────────────────────────────────────
# Use VXLAN tunneling. Note: as of Cilium 1.15 the config key changed:
#   OLD (pre-1.15):  tunnel: vxlan
#   NEW (1.15+):     routingMode: tunnel + tunnelProtocol: vxlan
# Both shown here — comment/uncomment based on the Cilium version in use.
#
# For Cilium >= 1.15 (current):
routingMode: tunnel
tunnelProtocol: vxlan
#
# For Cilium < 1.15 (legacy — do not use for new installs):
# tunnel: vxlan

# ─── L2 announcements (LB IP advertisement) ──────────────────────────────────
# Required for CiliumLoadBalancerIPPool to actually advertise IPs on the LAN.
# Without this, LoadBalancer IPs are assigned but unreachable from outside the cluster.
l2announcements:
  enabled: true
  interface: ens18

# Also enable L2 pod announcements so Cilium handles ARP for pod IPs directly
l2podAnnouncements:
  enabled: true
  interface: ens18

# ─── IP pools (defined as CRDs post-install, but referenced here for docs) ───
# Pool 1: ingress-nginx   10.1.71.80 - 10.1.71.89
# Pool 2: cilium-gateway  10.1.71.90 - 10.1.71.99
# Apply these after Cilium is healthy:
#   kubectl apply -f talos/cilium/ip-pools.yaml

# ─── Talos security context overrides ───────────────────────────────────────
# Talos permanently blocks SYS_MODULE and SYS_BOOT at the OS level regardless
# of pod security settings. Cilium's default caps include SYS_MODULE which
# causes clean-cilium-state to fail with "unable to apply caps".
# These overrides replace the default cap sets with Talos-compatible ones.
securityContext:
  capabilities:
    ciliumAgent:
      - CHOWN
      - KILL
      - NET_ADMIN
      - NET_RAW
      - IPC_LOCK
      - SYS_ADMIN
      - SYS_RESOURCE
      - DAC_OVERRIDE
      - FOWNER
      - SETGID
      - SETUID
      - PERFMON
      - BPF
    cleanCiliumState:
      - NET_ADMIN
      - SYS_ADMIN
      - SYS_RESOURCE
      - BPF

# Talos mounts cgroups differently — disable auto-mount and point at host root
cgroup:
  autoMount:
    enabled: false
  hostRoot: /sys/fs/cgroup

# ─── Operator ────────────────────────────────────────────────────────────────
operator:
  replicas: 1   # single-replica is fine for homelab; avoids scheduling issues on 3-node CP

# ─── IPAM ────────────────────────────────────────────────────────────────────
ipam:
  mode: kubernetes   # let Kubernetes manage pod CIDRs via the node spec

# ─── Hubble (observability) ───────────────────────────────────────────────────
hubble:
  enabled: true
  relay:
    enabled: true
  ui:
    enabled: true
    ingress:
      enabled: false   # expose via ArgoCD-managed ingress later

# ─── Gateway API support (secondary ingress path, future use) ────────────────
gatewayAPI:
  enabled: true

# ─── Security ────────────────────────────────────────────────────────────────
# Restrict host namespace access — pods can't escape to host network by default
hostNamespaceAccess:
  enabled: true

# Enable network policies (default deny is applied per-namespace by ArgoCD apps)
policyEnforcementMode: default