init

clusters/cl01tl/standalone/cilium/Chart.yaml

@@ -0,0 +1,11 @@
+apiVersion: v2
+name: cilium
+version: 1.0.0
+sources:
+  - https://github.com/cilium/cilium
+  - https://github.com/cilium/charts
+dependencies:
+  - name: cilium
+    version: 1.15.5
+    repository: https://helm.cilium.io/
+appVersion: 1.15.0

clusters/cl01tl/standalone/cilium/values.yaml

@@ -0,0 +1,71 @@
+cilium:
+  k8sServiceHost: "localhost"
+  k8sServicePort: "7445"
+  securityContext:
+    capabilities:
+      ciliumAgent:
+        - CHOWN
+        - KILL
+        - NET_ADMIN
+        - NET_RAW
+        - IPC_LOCK
+        - SYS_ADMIN
+        - SYS_RESOURCE
+        - DAC_OVERRIDE
+        - FOWNER
+        - SETGID
+        - SETUID
+      cleanCiliumState:
+        - NET_ADMIN
+        - SYS_ADMIN
+        - SYS_RESOURCE
+  enableK8sEndpointSlice: true
+  enableCiliumEndpointSlice: false
+  hubble:
+    enabled: true
+    metrics:
+      serviceMonitor:
+        enabled: true
+    relay:
+      enabled: true
+      metrics:
+        serviceMonitor:
+          enabled: true
+    ui:
+      enabled: true
+      ingress:
+        enabled: true
+        annotations:
+          traefik.ingress.kubernetes.io/router.entrypoints: websecure
+          traefik.ingress.kubernetes.io/router.tls: "true"
+          cert-manager.io/cluster-issuer: letsencrypt-issuer
+        className: traefik
+        hosts:
+          - hubble.alexlebens.net
+        tls:
+          - secretName: hubble-secret-tls
+            hosts:
+              - hubble.alexlebens.net
+  ipam:
+    mode: "kubernetes"
+  ipv4:
+    enabled: true
+  ipv6:
+    enabled: false
+  kubeProxyReplacement: "true"
+  prometheus:
+    enabled: true
+    port: 9962
+    serviceMonitor:
+      enabled: true
+  operator:
+    enabled: true
+    prometheus:
+      enabled: true
+      port: 9963
+      serviceMonitor:
+        enabled: true
+  cgroup:
+    autoMount:
+      enabled: false
+    hostRoot: /sys/fs/cgroup