feat: downgrade

clusters/cl01tl/helm/cilium/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: cilium
   repository: https://helm.cilium.io/
-  version: 1.19.3
-digest: sha256:0fb32249f6ab7d68568a1e44796a8ee1ee5da2294b29a9c720153db8f055888b
-generated: "2026-05-10T16:57:28.745-05:00"
+  version: 1.18.9
+digest: sha256:f7d127bed9b2c9154f25ffdc36ef7477ac8c8b12aeb92c5f4c20be5abd49ec11
+generated: "2026-05-10T19:25:36.71023-05:00"

clusters/cl01tl/helm/cilium/Chart.yaml

@@ -14,8 +14,8 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: cilium
-    version: 1.19.3
+    version: 1.18.9
     repository: https://helm.cilium.io/
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/cilium.png
 # renovate: datasource=github-releases depName=cilium/cilium
-appVersion: 1.19.3
+appVersion: 1.18.9

clusters/cl01tl/helm/cilium/templates/cilium-load-balancer-ip-pool.yaml

@@ -10,18 +10,3 @@ spec:
   blocks:
     - start: "10.232.1.21"
       stop: "10.232.1.23"
-
----
-apiVersion: cilium.io/v2
-kind: CiliumLoadBalancerIPPool
-metadata:
-  name: bgp-ip-pool
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: bgp-ip-pool
-    {{- include "custom.labels" . | nindent 4 }}
-spec:
-  blocks:
-    - start: "10.232.2.100"
-      stop: "10.232.2.200"
-  disabled: true

clusters/cl01tl/helm/cilium/values.yaml

@@ -1,20 +1,38 @@
 cilium:
-  upgradeCompatibility: "1.19"
   k8sServiceHost: "localhost"
   k8sServicePort: "7445"
   k8sClientRateLimit:
     qps: 50
     burst: 100
   rollOutCiliumPods: true
+  securityContext:
+    capabilities:
+      ciliumAgent:
+        - CHOWN
+        - KILL
+        - NET_ADMIN
+        - NET_RAW
+        - IPC_LOCK
+        - SYS_ADMIN
+        - SYS_RESOURCE
+        - DAC_OVERRIDE
+        - FOWNER
+        - SETGID
+        - SETUID
+        - PERFMON
+        - BPF
+      cleanCiliumState:
+        - NET_ADMIN
+        - SYS_ADMIN
+        - SYS_RESOURCE
   bpf:
     hostLegacyRouting: true
+    masquerade: false
   devices: end0 enp6s0
   ciliumEndpointSlice:
     enabled: true
   gatewayAPI:
-    enabled: true
-    enableAppProtocol: true
-    enableAlpn: true
+    enabled: false
   socketLB:
     enabled: true
     hostNamespaceOnly: true