chore: Update manifests after change

clusters/cl01tl/manifests/cilium/ClusterRole-cilium-operator.yaml

@@ -73,6 +73,18 @@ rules:
       - update
       - delete
       - patch
+  - apiGroups:
+      - "discovery.k8s.io"
+    resources:
+      - endpointslices
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - delete
+      - patch
   - apiGroups:
       - cilium.io
     resources:
@@ -166,7 +178,6 @@ rules:
       - update
     resourceNames:
       - ciliumloadbalancerippools.cilium.io
-      - ciliumbgppeeringpolicies.cilium.io
       - ciliumbgpclusterconfigs.cilium.io
       - ciliumbgppeerconfigs.cilium.io
       - ciliumbgpadvertisements.cilium.io
@@ -192,7 +203,6 @@ rules:
     resources:
       - ciliumloadbalancerippools
       - ciliumpodippools
-      - ciliumbgppeeringpolicies
       - ciliumbgpclusterconfigs
       - ciliumbgpnodeconfigoverrides
       - ciliumbgppeerconfigs
@@ -274,3 +284,9 @@ rules:
       - get
       - list
       - watch
+  - apiGroups:
+      - cilium.io
+    resources:
+      - ciliumendpointslices
+    verbs:
+      - deletecollection

clusters/cl01tl/manifests/cilium/ClusterRole-cilium.yaml

@@ -45,7 +45,6 @@ rules:
       - cilium.io
     resources:
       - ciliumloadbalancerippools
-      - ciliumbgppeeringpolicies
       - ciliumbgpnodeconfigs
       - ciliumbgpadvertisements
       - ciliumbgppeerconfigs

clusters/cl01tl/manifests/cilium/ClusterRole-hubble-ui.yaml

@@ -5,14 +5,6 @@ metadata:
   labels:
     app.kubernetes.io/part-of: cilium
 rules:
-  - apiGroups:
-      - networking.k8s.io
-    resources:
-      - networkpolicies
-    verbs:
-      - get
-      - list
-      - watch
   - apiGroups:
       - ""
     resources:
@@ -34,11 +26,3 @@ rules:
       - get
       - list
       - watch
-  - apiGroups:
-      - cilium.io
-    resources:
-      - "*"
-    verbs:
-      - get
-      - list
-      - watch

clusters/cl01tl/manifests/cilium/ConfigMap-cilium-config.yaml

@@ -25,7 +25,7 @@ data:
   enable-gateway-api-alpn: "true"
   gateway-api-xff-num-trusted-hops: "0"
   gateway-api-service-externaltrafficpolicy: "Cluster"
-  gateway-api-secrets-namespace: "kube-system"
+  gateway-api-secrets-namespace: "cilium-secrets"
   gateway-api-hostnetwork-enabled: "false"
   gateway-api-hostnetwork-nodelabelselector: ""
   enable-policy-secrets-sync: "true"
@@ -58,6 +58,7 @@ data:
   tunnel-protocol: "vxlan"
   tunnel-source-port-range: "0-0"
   service-no-backend-response: "reject"
+  policy-deny-response: "none"
   enable-l7-proxy: "true"
   enable-ipv4-masquerade: "true"
   enable-ipv4-big-tcp: "false"
@@ -74,6 +75,7 @@ data:
   devices: "end0 enp6s0"
   kube-proxy-replacement: "true"
   kube-proxy-replacement-healthz-bind-address: ""
+  enable-no-service-endpoints-routable: "true"
   bpf-lb-sock: "true"
   bpf-lb-sock-hostns-only: "true"
   enable-health-check-nodeport: "true"
@@ -81,7 +83,7 @@ data:
   node-port-bind-protection: "true"
   enable-auto-protect-node-port-range: "true"
   bpf-lb-acceleration: "disabled"
-  enable-svc-source-range-check: "true"
+  enable-service-topology: "false"
   enable-l2-neigh-discovery: "false"
   k8s-require-ipv4-pod-cidr: "false"
   k8s-require-ipv6-pod-cidr: "false"
@@ -114,6 +116,7 @@ data:
   vtep-cidr: ""
   vtep-mask: ""
   vtep-mac: ""
+  packetization-layer-pmtud-mode: "blackhole"
   procfs: "/host/proc"
   bpf-root: "/sys/fs/bpf"
   cgroup-root: "/sys/fs/cgroup"
@@ -126,7 +129,7 @@ data:
   remove-cilium-node-taints: "true"
   set-cilium-node-taints: "true"
   set-cilium-is-up-condition: "true"
-  unmanaged-pod-watcher-interval: "15"
+  unmanaged-pod-watcher-interval: "15s"
   dnsproxy-enable-transparent-mode: "true"
   dnsproxy-socket-linger-timeout: "10"
   tofqdns-dns-reject-response-code: "refused"
@@ -137,7 +140,7 @@ data:
   tofqdns-proxy-response-max-delay: "100ms"
   tofqdns-preallocate-identities: "true"
   agent-not-ready-taint-key: "node.cilium.io/agent-not-ready"
-  mesh-auth-enabled: "true"
+  mesh-auth-enabled: "false"
   mesh-auth-queue-size: "1024"
   mesh-auth-rotated-identities-queue-size: "1024"
   mesh-auth-gc-interval: "5m0s"
@@ -145,10 +148,14 @@ data:
   proxy-xff-num-trusted-hops-egress: "0"
   proxy-connect-timeout: "2"
   proxy-initial-fetch-timeout: "30"
+  proxy-max-active-downstream-connections: "50000"
   proxy-max-requests-per-connection: "0"
   proxy-max-connection-duration-seconds: "0"
   proxy-idle-timeout-seconds: "60"
   proxy-max-concurrent-retries: "128"
+  proxy-use-original-source-address: "true"
+  proxy-cluster-max-connections: "1024"
+  proxy-cluster-max-requests: "1024"
   http-retry-count: "3"
   http-stream-idle-timeout: "300"
   external-envoy-proxy: "true"
@@ -156,12 +163,15 @@ data:
   envoy-access-log-buffer-size: "4096"
   envoy-keep-cap-netbindservice: "true"
   max-connected-clusters: "255"
+  clustermesh-cache-ttl: "0s"
   clustermesh-enable-endpoint-sync: "false"
   clustermesh-enable-mcs-api: "false"
-  policy-default-local-cluster: "false"
+  clustermesh-mcs-api-install-crds: "true"
+  policy-default-local-cluster: "true"
   nat-map-stats-entries: "32"
   nat-map-stats-interval: "30s"
-  enable-internal-traffic-policy: "true"
   enable-lb-ipam: "true"
   enable-non-default-deny-policies: "true"
   enable-source-ip-verification: "true"
+  enable-dynamic-config: "true"
+  enable-drift-checker: "true"

clusters/cl01tl/manifests/cilium/CronJob-hubble-generate-certs.yaml

@@ -9,6 +9,8 @@ metadata:
     app.kubernetes.io/part-of: cilium
 spec:
   schedule: "0 0 1 */4 *"
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 1
   concurrencyPolicy: Forbid
   jobTemplate:
     spec:
@@ -22,7 +24,7 @@ spec:
               type: RuntimeDefault
           containers:
             - name: certgen
-              image: "quay.io/cilium/certgen:v0.3.1@sha256:2825dbfa6f89cbed882fd1d81e46a56c087e35885825139923aa29eb8aec47a9"
+              image: "quay.io/cilium/certgen:v0.4.1@sha256:f0c656830e856d26b24b0e144df1f8b327d3b46748d76a630514111fc365b697"
               imagePullPolicy: IfNotPresent
               securityContext:
                 capabilities:
@@ -63,9 +65,6 @@ spec:
                       - client auth
                       validity: 8760h
           hostNetwork: false
-          serviceAccount: "hubble-generate-certs"
           serviceAccountName: "hubble-generate-certs"
           automountServiceAccountToken: true
           restartPolicy: OnFailure
-          affinity:
-      ttlSecondsAfterFinished: 1800

clusters/cl01tl/manifests/cilium/DaemonSet-cilium-envoy.yaml

@@ -30,7 +30,7 @@ spec:
           type: Unconfined
       containers:
         - name: cilium-envoy
-          image: "quay.io/cilium/cilium-envoy:v1.35.9-1767794330-db497dd19e346b39d81d7b5c0dedf6c812bcc5c9@sha256:81398e449f2d3d0a6a70527e4f641aaa685d3156bea0bb30712fae3fd8822b86"
+          image: "quay.io/cilium/cilium-envoy:v1.36.6-1776000132-2437d2edeaf4d9b56ef279bd0d71127440c067aa@sha256:ba0ab8adac082d50d525fd2c5ba096c8facea3a471561b7c61c7a5b9c2e0de0d"
           imagePullPolicy: IfNotPresent
           command:
             - /usr/bin/cilium-envoy-starter

clusters/cl01tl/manifests/cilium/DaemonSet-cilium.yaml

@@ -18,7 +18,7 @@ spec:
   template:
     metadata:
       annotations:
-        cilium.io/cilium-configmap-checksum: "6c5e6123b63f6fc449922e9eb9bd248afa8fd228d8083cc40c920fff386079bb"
+        cilium.io/cilium-configmap-checksum: "501f8d2dbdd40925853054c7e3add60e203bb04219e79fec25ccf1a4cbc0e5d5"
         kubectl.kubernetes.io/default-container: cilium-agent
       labels:
         k8s-app: cilium
@@ -32,7 +32,7 @@ spec:
           type: Unconfined
       containers:
         - name: cilium-agent
-          image: "quay.io/cilium/cilium:v1.18.6@sha256:42ec562a5ff6c8a860c0639f5a7611685e253fd9eb2d2fcdade693724c9166a4"
+          image: "quay.io/cilium/cilium:v1.19.3@sha256:2e61680593cddca8b6c055f6d4c849d87a26a1c91c7e3b8b56c7fb76ab7b7b10"
           imagePullPolicy: IfNotPresent
           command:
             - cilium-agent
@@ -42,7 +42,7 @@ spec:
             httpGet:
               host: "127.0.0.1"
               path: /healthz
-              port: 9879
+              port: health
               scheme: HTTP
               httpHeaders:
                 - name: "brief"
@@ -55,7 +55,7 @@ spec:
             httpGet:
               host: "127.0.0.1"
               path: /healthz
-              port: 9879
+              port: health
               scheme: HTTP
               httpHeaders:
                 - name: "brief"
@@ -70,7 +70,7 @@ spec:
             httpGet:
               host: "127.0.0.1"
               path: /healthz
-              port: 9879
+              port: health
               scheme: HTTP
               httpHeaders:
                 - name: "brief"
@@ -136,6 +136,10 @@ spec:
                 command:
                   - /cni-uninstall.sh
           ports:
+            - name: health
+              containerPort: 9879
+              hostPort: 9879
+              protocol: TCP
             - name: peer-service
               containerPort: 4244
               hostPort: 4244
@@ -155,14 +159,14 @@ spec:
                 - NET_ADMIN
                 - NET_RAW
                 - IPC_LOCK
+                - SYS_MODULE
                 - SYS_ADMIN
                 - SYS_RESOURCE
                 - DAC_OVERRIDE
                 - FOWNER
                 - SETGID
                 - SETUID
-                - PERFMON
+                - SYSLOG
-                - BPF
               drop:
                 - ALL
           terminationMessagePolicy: FallbackToLogsOnError
@@ -201,7 +205,7 @@ spec:
               mountPath: /tmp
       initContainers:
         - name: config
-          image: "quay.io/cilium/cilium:v1.18.6@sha256:42ec562a5ff6c8a860c0639f5a7611685e253fd9eb2d2fcdade693724c9166a4"
+          image: "quay.io/cilium/cilium:v1.19.3@sha256:2e61680593cddca8b6c055f6d4c849d87a26a1c91c7e3b8b56c7fb76ab7b7b10"
           imagePullPolicy: IfNotPresent
           command:
             - cilium-dbg
@@ -225,14 +229,20 @@ spec:
             - name: tmp
               mountPath: /tmp
           terminationMessagePolicy: FallbackToLogsOnError
+          securityContext:
+            capabilities:
+              add:
+                - NET_ADMIN
+              drop:
+                - ALL
         - name: apply-sysctl-overwrites
-          image: "quay.io/cilium/cilium:v1.18.6@sha256:42ec562a5ff6c8a860c0639f5a7611685e253fd9eb2d2fcdade693724c9166a4"
+          image: "quay.io/cilium/cilium:v1.19.3@sha256:2e61680593cddca8b6c055f6d4c849d87a26a1c91c7e3b8b56c7fb76ab7b7b10"
           imagePullPolicy: IfNotPresent
           env:
             - name: BIN_PATH
               value: /opt/cni/bin
           command:
-            - sh
+            - bash
             - -ec
             - |
               cp /usr/bin/cilium-sysctlfix /hostbin/cilium-sysctlfix;
@@ -256,7 +266,7 @@ spec:
               drop:
                 - ALL
         - name: mount-bpf-fs
-          image: "quay.io/cilium/cilium:v1.18.6@sha256:42ec562a5ff6c8a860c0639f5a7611685e253fd9eb2d2fcdade693724c9166a4"
+          image: "quay.io/cilium/cilium:v1.19.3@sha256:2e61680593cddca8b6c055f6d4c849d87a26a1c91c7e3b8b56c7fb76ab7b7b10"
           imagePullPolicy: IfNotPresent
           args:
             - 'mount | grep "/sys/fs/bpf type bpf" || mount -t bpf bpf /sys/fs/bpf'
@@ -272,7 +282,7 @@ spec:
               mountPath: /sys/fs/bpf
               mountPropagation: Bidirectional
         - name: clean-cilium-state
-          image: "quay.io/cilium/cilium:v1.18.6@sha256:42ec562a5ff6c8a860c0639f5a7611685e253fd9eb2d2fcdade693724c9166a4"
+          image: "quay.io/cilium/cilium:v1.19.3@sha256:2e61680593cddca8b6c055f6d4c849d87a26a1c91c7e3b8b56c7fb76ab7b7b10"
           imagePullPolicy: IfNotPresent
           command:
             - /init-container.sh
@@ -307,6 +317,7 @@ spec:
             capabilities:
               add:
                 - NET_ADMIN
+                - SYS_MODULE
                 - SYS_ADMIN
                 - SYS_RESOURCE
               drop:
@@ -320,11 +331,14 @@ spec:
             - name: cilium-run
               mountPath: /var/run/cilium
         - name: install-cni-binaries
-          image: "quay.io/cilium/cilium:v1.18.6@sha256:42ec562a5ff6c8a860c0639f5a7611685e253fd9eb2d2fcdade693724c9166a4"
+          image: "quay.io/cilium/cilium:v1.19.3@sha256:2e61680593cddca8b6c055f6d4c849d87a26a1c91c7e3b8b56c7fb76ab7b7b10"
           imagePullPolicy: IfNotPresent
           command:
             - "/install-plugin.sh"
           resources:
+            limits:
+              cpu: 1
+              memory: 1Gi
             requests:
               cpu: 100m
               memory: 10Mi

clusters/cl01tl/manifests/cilium/Deployment-cilium-operator.yaml

@@ -22,7 +22,7 @@ spec:
   template:
     metadata:
       annotations:
-        cilium.io/cilium-configmap-checksum: "6c5e6123b63f6fc449922e9eb9bd248afa8fd228d8083cc40c920fff386079bb"
+        cilium.io/cilium-configmap-checksum: "501f8d2dbdd40925853054c7e3add60e203bb04219e79fec25ccf1a4cbc0e5d5"
       labels:
         io.cilium/app: operator
         name: cilium-operator
@@ -34,7 +34,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: cilium-operator
-          image: "quay.io/cilium/operator-generic:v1.18.6@sha256:34a827ce9ed021c8adf8f0feca131f53b3c54a3ef529053d871d0347ec4d69af"
+          image: "quay.io/cilium/operator-generic:v1.19.3@sha256:205b09b0ed6accbf9fe688d312a9f0fcfc6a316fc081c23fbffb472af5dd62cd"
           imagePullPolicy: IfNotPresent
           command:
             - cilium-operator-generic
@@ -63,6 +63,9 @@ spec:
             - name: KUBERNETES_SERVICE_PORT
               value: "7445"
           ports:
+            - name: health
+              containerPort: 9234
+              hostPort: 9234
             - name: prometheus
               containerPort: 9963
               hostPort: 9963
@@ -71,7 +74,7 @@ spec:
             httpGet:
               host: "127.0.0.1"
               path: /healthz
-              port: 9234
+              port: health
               scheme: HTTP
             initialDelaySeconds: 60
             periodSeconds: 10
@@ -80,7 +83,7 @@ spec:
             httpGet:
               host: "127.0.0.1"
               path: /healthz
-              port: 9234
+              port: health
               scheme: HTTP
             initialDelaySeconds: 0
             periodSeconds: 5

clusters/cl01tl/manifests/cilium/Deployment-hubble-relay.yaml

@@ -40,7 +40,7 @@ spec:
             runAsUser: 65532
             seccompProfile:
               type: RuntimeDefault
-          image: "quay.io/cilium/hubble-relay:v1.18.6@sha256:fb6135e34c31e5f175cb5e75f86cea52ef2ff12b49bcefb7088ed93f5009eb8e"
+          image: "quay.io/cilium/hubble-relay:v1.19.3@sha256:5ee21d57b6ef2aa6db67e603a735fdceb162454b352b7335b651456e308f681b"
           imagePullPolicy: IfNotPresent
           command:
             - hubble-relay

clusters/cl01tl/manifests/cilium/Deployment-hubble-ui.yaml

@@ -41,11 +41,11 @@ spec:
           livenessProbe:
             httpGet:
               path: /healthz
-              port: 8081
+              port: http
           readinessProbe:
             httpGet:
               path: /
-              port: 8081
+              port: http
           volumeMounts:
             - name: hubble-ui-nginx-conf
               mountPath: /etc/nginx/conf.d/default.conf
@@ -77,5 +77,5 @@ spec:
             defaultMode: 420
             name: hubble-ui-nginx
           name: hubble-ui-nginx-conf
-        - emptyDir: {}
+        - name: tmp-dir
-          name: tmp-dir
+          emptyDir: {}

clusters/cl01tl/manifests/cilium/Job-hubble-generate-certs-b36ef54b9b.yaml

@@ -1,14 +1,12 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: hubble-generate-certs
+  name: hubble-generate-certs-b36ef54b9b
   namespace: kube-system
   labels:
     k8s-app: hubble-generate-certs
     app.kubernetes.io/name: hubble-generate-certs
     app.kubernetes.io/part-of: cilium
-  annotations:
-    "helm.sh/hook": post-install,post-upgrade
 spec:
   template:
     metadata:
@@ -20,7 +18,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: certgen
-          image: "quay.io/cilium/certgen:v0.3.1@sha256:2825dbfa6f89cbed882fd1d81e46a56c087e35885825139923aa29eb8aec47a9"
+          image: "quay.io/cilium/certgen:v0.4.1@sha256:f0c656830e856d26b24b0e144df1f8b327d3b46748d76a630514111fc365b697"
           imagePullPolicy: IfNotPresent
           securityContext:
             capabilities:
@@ -61,9 +59,6 @@ spec:
                   - client auth
                   validity: 8760h
       hostNetwork: false
-      serviceAccount: "hubble-generate-certs"
       serviceAccountName: "hubble-generate-certs"
       automountServiceAccountToken: true
       restartPolicy: OnFailure
-      affinity:
-  ttlSecondsAfterFinished: 1800

clusters/cl01tl/manifests/cilium/Role-cilium-gateway-secrets.yaml

@@ -2,7 +2,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
   name: cilium-gateway-secrets
-  namespace: "kube-system"
+  namespace: "cilium-secrets"
   labels:
     app.kubernetes.io/part-of: cilium
 rules:

clusters/cl01tl/manifests/cilium/Role-cilium-operator-gateway-secrets.yaml

@@ -2,7 +2,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
   name: cilium-operator-gateway-secrets
-  namespace: "kube-system"
+  namespace: "cilium-secrets"
   labels:
     app.kubernetes.io/part-of: cilium
 rules:

clusters/cl01tl/manifests/cilium/Role-cilium-operator-ztunnel.yaml

@@ -0,0 +1,18 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: cilium-operator-ztunnel
+  namespace: kube-system
+  labels:
+    app.kubernetes.io/part-of: cilium
+rules:
+  - apiGroups:
+      - apps
+    resources:
+      - daemonsets
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - watch

clusters/cl01tl/manifests/cilium/RoleBinding-cilium-gateway-secrets.yaml

@@ -2,7 +2,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   name: cilium-gateway-secrets
-  namespace: "kube-system"
+  namespace: "cilium-secrets"
   labels:
     app.kubernetes.io/part-of: cilium
 roleRef:

clusters/cl01tl/manifests/cilium/RoleBinding-cilium-operator-gateway-secrets.yaml

@@ -2,7 +2,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   name: cilium-operator-gateway-secrets
-  namespace: "kube-system"
+  namespace: "cilium-secrets"
   labels:
     app.kubernetes.io/part-of: cilium
 roleRef:

clusters/cl01tl/manifests/cilium/RoleBinding-cilium-operator-ztunnel.yaml

@@ -0,0 +1,15 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: cilium-operator-ztunnel
+  namespace: kube-system
+  labels:
+    app.kubernetes.io/part-of: cilium
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: cilium-operator-ztunnel
+subjects:
+  - kind: ServiceAccount
+    name: "cilium-operator"
+    namespace: kube-system

clusters/cl01tl/manifests/cilium/Service-cilium-envoy.yaml

@@ -17,4 +17,4 @@ spec:
     - name: envoy-metrics
       port: 9964
       protocol: TCP
-      targetPort: envoy-metrics
+      targetPort: 9964