122 lines
5.2 KiB
YAML
122 lines
5.2 KiB
YAML
# ─── Cilium Helm values — fastpass cluster ───────────────────────────────────
|
|
# Install command (run from city-hall after cluster bootstrap):
|
|
#
|
|
# helm repo add cilium https://helm.cilium.io/
|
|
# helm repo update
|
|
# helm upgrade --install cilium cilium/cilium \
|
|
# --version 1.17.3 \
|
|
# --namespace kube-system \
|
|
# --values cilium-values.yaml \
|
|
# --wait
|
|
#
|
|
# Verify:
|
|
# kubectl -n kube-system get pods -l app.kubernetes.io/name=cilium-agent
|
|
# cilium status --wait
|
|
#
|
|
# IMPORTANT: Cilium is Helm-only. Never manage this with ArgoCD.
|
|
# ArgoCD manages everything else; this is the one exception.
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
|
|
# ─── Talos-specific requirements ─────────────────────────────────────────────
|
|
# Talos does not have a traditional kernel with modules loadable at runtime.
|
|
# Cilium must be told to use eBPF-native mode and not rely on iptables modules.
|
|
kubeProxyReplacement: true
|
|
|
|
# kube-proxy is not running in Talos — Cilium replaces it entirely
|
|
k8sServiceHost: 10.1.71.65 # VIP
|
|
k8sServicePort: 6443
|
|
|
|
# ─── Routing — tunnel mode ───────────────────────────────────────────────────
|
|
# Use VXLAN tunneling. Note: as of Cilium 1.15 the config key changed:
|
|
# OLD (pre-1.15): tunnel: vxlan
|
|
# NEW (1.15+): routingMode: tunnel + tunnelProtocol: vxlan
|
|
# Both shown here — comment/uncomment based on the Cilium version in use.
|
|
#
|
|
# For Cilium >= 1.15 (current):
|
|
routingMode: tunnel
|
|
tunnelProtocol: vxlan
|
|
#
|
|
# For Cilium < 1.15 (legacy — do not use for new installs):
|
|
# tunnel: vxlan
|
|
|
|
# ─── L2 announcements (LB IP advertisement) ──────────────────────────────────
|
|
# Required for CiliumLoadBalancerIPPool to actually advertise IPs on the LAN.
|
|
# Without this, LoadBalancer IPs are assigned but unreachable from outside the cluster.
|
|
l2announcements:
|
|
enabled: true
|
|
interface: ens18
|
|
|
|
# Also enable L2 pod announcements so Cilium handles ARP for pod IPs directly
|
|
l2podAnnouncements:
|
|
enabled: true
|
|
interface: ens18
|
|
|
|
# ─── IP pools (defined as CRDs post-install, but referenced here for docs) ───
|
|
# Pool 1: ingress-nginx 10.1.71.80 - 10.1.71.89
|
|
# Pool 2: cilium-gateway 10.1.71.90 - 10.1.71.99
|
|
# Apply these after Cilium is healthy:
|
|
# kubectl apply -f talos/cilium/ip-pools.yaml
|
|
|
|
# ─── Talos security context overrides ───────────────────────────────────────
|
|
# Talos permanently blocks SYS_MODULE and SYS_BOOT at the OS level regardless
|
|
# of pod security settings. Cilium's default caps include SYS_MODULE which
|
|
# causes clean-cilium-state to fail with "unable to apply caps".
|
|
# These overrides replace the default cap sets with Talos-compatible ones.
|
|
securityContext:
|
|
capabilities:
|
|
ciliumAgent:
|
|
- CHOWN
|
|
- KILL
|
|
- NET_ADMIN
|
|
- NET_RAW
|
|
- IPC_LOCK
|
|
- SYS_ADMIN
|
|
- SYS_RESOURCE
|
|
- DAC_OVERRIDE
|
|
- FOWNER
|
|
- SETGID
|
|
- SETUID
|
|
- PERFMON
|
|
- BPF
|
|
cleanCiliumState:
|
|
- NET_ADMIN
|
|
- SYS_ADMIN
|
|
- SYS_RESOURCE
|
|
- BPF
|
|
|
|
# Talos mounts cgroups differently — disable auto-mount and point at host root
|
|
cgroup:
|
|
autoMount:
|
|
enabled: false
|
|
hostRoot: /sys/fs/cgroup
|
|
|
|
# ─── Operator ────────────────────────────────────────────────────────────────
|
|
operator:
|
|
replicas: 1 # single-replica is fine for homelab; avoids scheduling issues on 3-node CP
|
|
|
|
# ─── IPAM ────────────────────────────────────────────────────────────────────
|
|
ipam:
|
|
mode: kubernetes # let Kubernetes manage pod CIDRs via the node spec
|
|
|
|
# ─── Hubble (observability) ───────────────────────────────────────────────────
|
|
hubble:
|
|
enabled: true
|
|
relay:
|
|
enabled: true
|
|
ui:
|
|
enabled: true
|
|
ingress:
|
|
enabled: false # expose via ArgoCD-managed ingress later
|
|
|
|
# ─── Gateway API support (secondary ingress path, future use) ────────────────
|
|
gatewayAPI:
|
|
enabled: true
|
|
|
|
# ─── Security ────────────────────────────────────────────────────────────────
|
|
# Restrict host namespace access — pods can't escape to host network by default
|
|
hostNamespaceAccess:
|
|
enabled: true
|
|
|
|
# Enable network policies (default deny is applied per-namespace by ArgoCD apps)
|
|
policyEnforcementMode: default
|