chore: Update manifests after change

clusters/cl01tl/manifests/cilium/-.yml

@@ -0,0 +1,2 @@
+---
+

clusters/cl01tl/manifests/cilium/CiliumLoadBalancerIPPool-bgp-ip-pool.yml

@@ -0,0 +1,16 @@
+---
+# Source: cilium/templates/cilium-load-balancer-ip-pool.yaml
+apiVersion: "cilium.io/v2alpha1"
+kind: CiliumLoadBalancerIPPool
+metadata:
+  name: bgp-ip-pool
+  namespace: kube-system
+  labels:
+    app.kubernetes.io/name: bgp-ip-pool
+    app.kubernetes.io/instance: cilium
+    app.kubernetes.io/part-of: cilium
+spec:
+  blocks:
+    - start: "10.232.2.100"
+      stop: "10.232.2.200"
+  disabled: true

clusters/cl01tl/manifests/cilium/CiliumLoadBalancerIPPool-default-ip-pool.yml

@@ -0,0 +1,17 @@
+---
+# Source: cilium/templates/cilium-load-balancer-ip-pool.yaml
+apiVersion: "cilium.io/v2alpha1"
+kind: CiliumLoadBalancerIPPool
+metadata:
+  name: default-ip-pool
+  namespace: kube-system
+  labels:
+    app.kubernetes.io/name: default-ip-pool
+    app.kubernetes.io/instance: cilium
+    app.kubernetes.io/part-of: cilium
+spec:
+  blocks:
+    - start: "10.232.1.21"
+      stop: "10.232.1.23"
+    - start: "10.232.2.21"
+      stop: "10.232.2.23"

clusters/cl01tl/manifests/cilium/ClusterRole-cilium-operator.yml

@@ -0,0 +1,298 @@
+---
+# Source: cilium/charts/cilium/templates/cilium-operator/clusterrole.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: cilium-operator
+  labels:
+    app.kubernetes.io/part-of: cilium
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
+      - get
+      - list
+      - watch
+      # to automatically delete [core|kube]dns pods so that are starting to being
+      # managed by Cilium
+      - delete
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+    resourceNames:
+      - cilium-config
+    verbs:
+      # allow patching of the configmap to set annotations
+      - patch
+  - apiGroups:
+      - ""
+    resources:
+      - nodes
+    verbs:
+      - list
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      # To remove node taints
+      - nodes
+      # To set NetworkUnavailable false on startup
+      - nodes/status
+    verbs:
+      - patch
+  - apiGroups:
+      - discovery.k8s.io
+    resources:
+      - endpointslices
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      # to perform LB IP allocation for BGP
+      - services/status
+    verbs:
+      - update
+      - patch
+  - apiGroups:
+      - ""
+    resources:
+      # to check apiserver connectivity
+      - namespaces
+      - secrets
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      # to perform the translation of a CNP that contains `ToGroup` to its endpoints
+      - services
+      - endpoints
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - delete
+      - patch
+  - apiGroups:
+      - cilium.io
+    resources:
+      - ciliumnetworkpolicies
+      - ciliumclusterwidenetworkpolicies
+    verbs:
+      # Create auto-generated CNPs and CCNPs from Policies that have 'toGroups'
+      - create
+      - update
+      - deletecollection
+      # To update the status of the CNPs and CCNPs
+      - patch
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - cilium.io
+    resources:
+      - ciliumnetworkpolicies/status
+      - ciliumclusterwidenetworkpolicies/status
+    verbs:
+      # Update the auto-generated CNPs and CCNPs status.
+      - patch
+      - update
+  - apiGroups:
+      - cilium.io
+    resources:
+      - ciliumendpoints
+      - ciliumidentities
+    verbs:
+      # To perform garbage collection of such resources
+      - delete
+      - list
+      - watch
+  - apiGroups:
+      - cilium.io
+    resources:
+      - ciliumidentities
+    verbs:
+      # To synchronize garbage collection of such resources
+      - update
+  - apiGroups:
+      - cilium.io
+    resources:
+      - ciliumnodes
+    verbs:
+      - create
+      - update
+      - get
+      - list
+      - watch
+      # To perform CiliumNode garbage collector
+      - delete
+  - apiGroups:
+      - cilium.io
+    resources:
+      - ciliumnodes/status
+    verbs:
+      - update
+  - apiGroups:
+      - cilium.io
+    resources:
+      - ciliumendpointslices
+      - ciliumenvoyconfigs
+      - ciliumbgppeerconfigs
+      - ciliumbgpadvertisements
+      - ciliumbgpnodeconfigs
+    verbs:
+      - create
+      - update
+      - get
+      - list
+      - watch
+      - delete
+      - patch
+  - apiGroups:
+      - cilium.io
+    resources:
+      - ciliumbgpclusterconfigs/status
+      - ciliumbgppeerconfigs/status
+    verbs:
+      - update
+  - apiGroups:
+      - apiextensions.k8s.io
+    resources:
+      - customresourcedefinitions
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - apiextensions.k8s.io
+    resources:
+      - customresourcedefinitions
+    verbs:
+      - update
+    resourceNames:
+      - ciliumloadbalancerippools.cilium.io
+      - ciliumbgppeeringpolicies.cilium.io
+      - ciliumbgpclusterconfigs.cilium.io
+      - ciliumbgppeerconfigs.cilium.io
+      - ciliumbgpadvertisements.cilium.io
+      - ciliumbgpnodeconfigs.cilium.io
+      - ciliumbgpnodeconfigoverrides.cilium.io
+      - ciliumclusterwideenvoyconfigs.cilium.io
+      - ciliumclusterwidenetworkpolicies.cilium.io
+      - ciliumegressgatewaypolicies.cilium.io
+      - ciliumendpoints.cilium.io
+      - ciliumendpointslices.cilium.io
+      - ciliumenvoyconfigs.cilium.io
+      - ciliumidentities.cilium.io
+      - ciliumlocalredirectpolicies.cilium.io
+      - ciliumnetworkpolicies.cilium.io
+      - ciliumnodes.cilium.io
+      - ciliumnodeconfigs.cilium.io
+      - ciliumcidrgroups.cilium.io
+      - ciliuml2announcementpolicies.cilium.io
+      - ciliumpodippools.cilium.io
+      - ciliumgatewayclassconfigs.cilium.io
+  - apiGroups:
+      - cilium.io
+    resources:
+      - ciliumloadbalancerippools
+      - ciliumpodippools
+      - ciliumbgppeeringpolicies
+      - ciliumbgpclusterconfigs
+      - ciliumbgpnodeconfigoverrides
+      - ciliumbgppeerconfigs
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - cilium.io
+    resources:
+      - ciliumpodippools
+    verbs:
+      - create
+  - apiGroups:
+      - cilium.io
+    resources:
+      - ciliumloadbalancerippools/status
+    verbs:
+      - patch
+  # For cilium-operator running in HA mode.
+  #
+  # Cilium operator running in HA mode requires the use of ResourceLock for Leader Election
+  # between multiple running instances.
+  # The preferred way of doing this is to use LeasesResourceLock as edits to Leases are less
+  # common and fewer objects in the cluster watch "all Leases".
+  - apiGroups:
+      - coordination.k8s.io
+    resources:
+      - leases
+    verbs:
+      - create
+      - get
+      - update
+  - apiGroups:
+      - gateway.networking.k8s.io
+    resources:
+      - gatewayclasses
+      - gateways
+      - tlsroutes
+      - httproutes
+      - grpcroutes
+      - referencegrants
+      - referencepolicies
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - gateway.networking.k8s.io
+    resources:
+      - gatewayclasses
+    verbs:
+      - patch
+  - apiGroups:
+      - gateway.networking.k8s.io
+    resources:
+      - gatewayclasses/status
+      - gateways/status
+      - httproutes/status
+      - grpcroutes/status
+      - tlsroutes/status
+    verbs:
+      - update
+      - patch
+  - apiGroups:
+      - cilium.io
+    resources:
+      - ciliumgatewayclassconfigs
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - cilium.io
+    resources:
+      - ciliumgatewayclassconfigs/status
+    verbs:
+      - update
+      - patch
+  - apiGroups:
+      - multicluster.x-k8s.io
+    resources:
+      - serviceimports
+    verbs:
+      - get
+      - list
+      - watch

clusters/cl01tl/manifests/cilium/ClusterRole-cilium.yml

@@ -0,0 +1,112 @@
+---
+# Source: cilium/charts/cilium/templates/cilium-agent/clusterrole.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: cilium
+  labels:
+    app.kubernetes.io/part-of: cilium
+rules:
+  - apiGroups:
+      - networking.k8s.io
+    resources:
+      - networkpolicies
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - discovery.k8s.io
+    resources:
+      - endpointslices
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - namespaces
+      - services
+      - pods
+      - endpoints
+      - nodes
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - apiextensions.k8s.io
+    resources:
+      - customresourcedefinitions
+    verbs:
+      - list
+      - watch
+      # This is used when validating policies in preflight. This will need to stay
+      # until we figure out how to avoid "get" inside the preflight, and then
+      # should be removed ideally.
+      - get
+  - apiGroups:
+      - cilium.io
+    resources:
+      - ciliumloadbalancerippools
+      - ciliumbgppeeringpolicies
+      - ciliumbgpnodeconfigs
+      - ciliumbgpadvertisements
+      - ciliumbgppeerconfigs
+      - ciliumclusterwideenvoyconfigs
+      - ciliumclusterwidenetworkpolicies
+      - ciliumegressgatewaypolicies
+      - ciliumendpoints
+      - ciliumendpointslices
+      - ciliumenvoyconfigs
+      - ciliumidentities
+      - ciliumlocalredirectpolicies
+      - ciliumnetworkpolicies
+      - ciliumnodes
+      - ciliumnodeconfigs
+      - ciliumcidrgroups
+      - ciliuml2announcementpolicies
+      - ciliumpodippools
+    verbs:
+      - list
+      - watch
+  - apiGroups:
+      - cilium.io
+    resources:
+      - ciliumidentities
+      - ciliumendpoints
+      - ciliumnodes
+    verbs:
+      - create
+  - apiGroups:
+      - cilium.io
+    # To synchronize garbage collection of such resources
+    resources:
+      - ciliumidentities
+    verbs:
+      - update
+  - apiGroups:
+      - cilium.io
+    resources:
+      - ciliumendpoints
+    verbs:
+      - delete
+      - get
+  - apiGroups:
+      - cilium.io
+    resources:
+      - ciliumnodes
+      - ciliumnodes/status
+    verbs:
+      - get
+      - update
+  - apiGroups:
+      - cilium.io
+    resources:
+      - ciliumendpoints/status
+      - ciliumendpoints
+      - ciliuml2announcementpolicies/status
+      - ciliumbgpnodeconfigs/status
+    verbs:
+      - patch

clusters/cl01tl/manifests/cilium/ClusterRole-hubble-ui.yml

@@ -0,0 +1,46 @@
+---
+# Source: cilium/charts/cilium/templates/hubble-ui/clusterrole.yaml
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: hubble-ui
+  labels:
+    app.kubernetes.io/part-of: cilium
+rules:
+  - apiGroups:
+      - networking.k8s.io
+    resources:
+      - networkpolicies
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - componentstatuses
+      - endpoints
+      - namespaces
+      - nodes
+      - pods
+      - services
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - apiextensions.k8s.io
+    resources:
+      - customresourcedefinitions
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - cilium.io
+    resources:
+      - "*"
+    verbs:
+      - get
+      - list
+      - watch

clusters/cl01tl/manifests/cilium/ClusterRoleBinding-cilium-operator.yml

@@ -0,0 +1,16 @@
+---
+# Source: cilium/charts/cilium/templates/cilium-operator/clusterrolebinding.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: cilium-operator
+  labels:
+    app.kubernetes.io/part-of: cilium
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cilium-operator
+subjects:
+  - kind: ServiceAccount
+    name: "cilium-operator"
+    namespace: kube-system

clusters/cl01tl/manifests/cilium/ClusterRoleBinding-cilium.yml

@@ -0,0 +1,16 @@
+---
+# Source: cilium/charts/cilium/templates/cilium-agent/clusterrolebinding.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: cilium
+  labels:
+    app.kubernetes.io/part-of: cilium
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cilium
+subjects:
+  - kind: ServiceAccount
+    name: "cilium"
+    namespace: kube-system

clusters/cl01tl/manifests/cilium/ClusterRoleBinding-hubble-ui.yml

@@ -0,0 +1,16 @@
+---
+# Source: cilium/charts/cilium/templates/hubble-ui/clusterrolebinding.yaml
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: hubble-ui
+  labels:
+    app.kubernetes.io/part-of: cilium
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: hubble-ui
+subjects:
+  - kind: ServiceAccount
+    name: "hubble-ui"
+    namespace: kube-system

clusters/cl01tl/manifests/cilium/ConfigMap-cilium-config.yml

@@ -0,0 +1,256 @@
+---
+# Source: cilium/charts/cilium/templates/cilium-configmap.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cilium-config
+  namespace: kube-system
+data:
+  # Identity allocation mode selects how identities are shared between cilium
+  # nodes by setting how they are stored. The options are "crd", "kvstore" or
+  # "doublewrite-readkvstore" / "doublewrite-readcrd".
+  # - "crd" stores identities in kubernetes as CRDs (custom resource definition).
+  #   These can be queried with:
+  #     kubectl get ciliumid
+  # - "kvstore" stores identities in an etcd kvstore, that is
+  #   configured below. Cilium versions before 1.6 supported only the kvstore
+  #   backend. Upgrades from these older cilium versions should continue using
+  #   the kvstore by commenting out the identity-allocation-mode below, or
+  #   setting it to "kvstore".
+  # - "doublewrite" modes store identities in both the kvstore and CRDs. This is useful
+  #   for seamless migrations from the kvstore mode to the crd mode. Consult the
+  #   documentation for more information on how to perform the migration.
+  identity-allocation-mode: crd
+  identity-heartbeat-timeout: "30m0s"
+  identity-gc-interval: "15m0s"
+  cilium-endpoint-gc-interval: "5m0s"
+  nodes-gc-interval: "5m0s"
+  # If you want to run cilium in debug mode change this value to true
+  debug: "false"
+  metrics-sampling-interval: "5m"
+  # The agent can be put into the following three policy enforcement modes
+  # default, always and never.
+  # https://docs.cilium.io/en/latest/security/policy/intro/#policy-enforcement-modes
+  enable-policy: "default"
+  # If you want metrics enabled in all of your Cilium agents, set the port for
+  # which the Cilium agents will have their metrics exposed.
+  # This option deprecates the "prometheus-serve-addr" in the
+  # "cilium-metrics-config" ConfigMap
+  # NOTE that this will open the port on ALL nodes where Cilium pods are
+  # scheduled.
+  prometheus-serve-addr: ":9962"
+  # A space-separated list of controller groups for which to enable metrics.
+  # The special values of "all" and "none" are supported.
+  controller-group-metrics: write-cni-file sync-host-ips sync-lb-maps-with-k8s-services
+  # If you want metrics enabled in cilium-operator, set the port for
+  # which the Cilium Operator will have their metrics exposed.
+  # NOTE that this will open the port on the nodes where Cilium operator pod
+  # is scheduled.
+  operator-prometheus-serve-addr: ":9963"
+  enable-metrics: "true"
+  enable-envoy-config: "true"
+  envoy-config-retry-interval: "15s"
+  enable-gateway-api: "true"
+  enable-gateway-api-secrets-sync: "true"
+  enable-gateway-api-proxy-protocol: "false"
+  enable-gateway-api-app-protocol: "true"
+  enable-gateway-api-alpn: "true"
+  gateway-api-xff-num-trusted-hops: "0"
+  gateway-api-service-externaltrafficpolicy: "Cluster"
+  gateway-api-secrets-namespace: "cilium-secrets"
+  gateway-api-hostnetwork-enabled: "false"
+  gateway-api-hostnetwork-nodelabelselector: ""
+  enable-policy-secrets-sync: "true"
+  policy-secrets-only-from-secrets-namespace: "true"
+  policy-secrets-namespace: "cilium-secrets"
+  # Enable IPv4 addressing. If enabled, all endpoints are allocated an IPv4
+  # address.
+  enable-ipv4: "true"
+  # Enable IPv6 addressing. If enabled, all endpoints are allocated an IPv6
+  # address.
+  enable-ipv6: "false"
+  # Users who wish to specify their own custom CNI configuration file must set
+  # custom-cni-conf to "true", otherwise Cilium may overwrite the configuration.
+  custom-cni-conf: "false"
+  enable-bpf-clock-probe: "false"
+  # If you want cilium monitor to aggregate tracing for packets, set this level
+  # to "low", "medium", or "maximum". The higher the level, the less packets
+  # that will be seen in monitor output.
+  monitor-aggregation: medium
+  # The monitor aggregation interval governs the typical time between monitor
+  # notification events for each allowed connection.
+  #
+  # Only effective when monitor aggregation is set to "medium" or higher.
+  monitor-aggregation-interval: "5s"
+  # The monitor aggregation flags determine which TCP flags which, upon the
+  # first observation, cause monitor notifications to be generated.
+  #
+  # Only effective when monitor aggregation is set to "medium" or higher.
+  monitor-aggregation-flags: all
+  # Specifies the ratio (0.0-1.0] of total system memory to use for dynamic
+  # sizing of the TCP CT, non-TCP CT, NAT and policy BPF maps.
+  bpf-map-dynamic-size-ratio: "0.0025"
+  # bpf-policy-map-max specifies the maximum number of entries in endpoint
+  # policy map (per endpoint)
+  bpf-policy-map-max: "16384"
+  # bpf-policy-stats-map-max specifies the maximum number of entries in global
+  # policy stats map
+  bpf-policy-stats-map-max: "65536"
+  # bpf-lb-map-max specifies the maximum number of entries in bpf lb service,
+  # backend and affinity maps.
+  bpf-lb-map-max: "65536"
+  bpf-lb-external-clusterip: "false"
+  bpf-lb-source-range-all-types: "false"
+  bpf-lb-algorithm-annotation: "false"
+  bpf-lb-mode-annotation: "false"
+  bpf-distributed-lru: "false"
+  bpf-events-drop-enabled: "true"
+  bpf-events-policy-verdict-enabled: "true"
+  bpf-events-trace-enabled: "true"
+  # Pre-allocation of map entries allows per-packet latency to be reduced, at
+  # the expense of up-front memory allocation for the entries in the maps. The
+  # default value below will minimize memory usage in the default installation;
+  # users who are sensitive to latency may consider setting this to "true".
+  #
+  # This option was introduced in Cilium 1.4. Cilium 1.3 and earlier ignore
+  # this option and behave as though it is set to "true".
+  #
+  # If this value is modified, then during the next Cilium startup the restore
+  # of existing endpoints and tracking of ongoing connections may be disrupted.
+  # As a result, reply packets may be dropped and the load-balancing decisions
+  # for established connections may change.
+  #
+  # If this option is set to "false" during an upgrade from 1.3 or earlier to
+  # 1.4 or later, then it may cause one-time disruptions during the upgrade.
+  preallocate-bpf-maps: "false"
+  # Name of the cluster. Only relevant when building a mesh of clusters.
+  cluster-name: "default"
+  # Unique ID of the cluster. Must be unique across all conneted clusters and
+  # in the range of 1 and 255. Only relevant when building a mesh of clusters.
+  cluster-id: "0"
+  # Encapsulation mode for communication between nodes
+  # Possible values:
+  #   - disabled
+  #   - vxlan (default)
+  #   - geneve
+  routing-mode: "tunnel"
+  tunnel-protocol: "vxlan"
+  tunnel-source-port-range: "0-0"
+  service-no-backend-response: "reject"
+  # Enables L7 proxy for L7 policy enforcement and visibility
+  enable-l7-proxy: "true"
+  enable-ipv4-masquerade: "true"
+  enable-ipv4-big-tcp: "false"
+  enable-ipv6-big-tcp: "false"
+  enable-ipv6-masquerade: "true"
+  enable-tcx: "true"
+  datapath-mode: "veth"
+  enable-masquerade-to-route-source: "false"
+  enable-xt-socket-fallback: "true"
+  install-no-conntrack-iptables-rules: "false"
+  iptables-random-fully: "false"
+  auto-direct-node-routes: "false"
+  direct-routing-skip-unreachable: "false"
+  # List of devices used to attach bpf_host.o (implements BPF NodePort,
+  # host-firewall and BPF masquerading)
+  devices: "end0 enp6s0"
+  kube-proxy-replacement: "true"
+  kube-proxy-replacement-healthz-bind-address: ""
+  bpf-lb-sock: "true"
+  bpf-lb-sock-hostns-only: "true"
+  enable-health-check-nodeport: "true"
+  enable-health-check-loadbalancer-ip: "false"
+  node-port-bind-protection: "true"
+  enable-auto-protect-node-port-range: "true"
+  bpf-lb-acceleration: "disabled"
+  enable-svc-source-range-check: "true"
+  enable-l2-neigh-discovery: "false"
+  k8s-require-ipv4-pod-cidr: "false"
+  k8s-require-ipv6-pod-cidr: "false"
+  enable-k8s-networkpolicy: "true"
+  enable-endpoint-lockdown-on-policy-overflow: "false"
+  # Tell the agent to generate and write a CNI configuration file
+  write-cni-conf-when-ready: /host/etc/cni/net.d/05-cilium.conflist
+  cni-exclusive: "true"
+  cni-log-file: "/var/run/cilium/cilium-cni.log"
+  enable-endpoint-health-checking: "true"
+  enable-health-checking: "true"
+  health-check-icmp-failure-threshold: "3"
+  enable-well-known-identities: "false"
+  enable-node-selector-labels: "false"
+  synchronize-k8s-nodes: "true"
+  operator-api-serve-addr: "127.0.0.1:9234"
+  enable-hubble: "true"
+  # UNIX domain socket for Hubble server to listen to.
+  hubble-socket-path: "/var/run/cilium/hubble.sock"
+  hubble-network-policy-correlation-enabled: "true"
+  # An additional address for Hubble server to listen to (e.g. ":4244").
+  hubble-listen-address: ":4244"
+  hubble-disable-tls: "false"
+  hubble-tls-cert-file: /var/lib/cilium/tls/hubble/server.crt
+  hubble-tls-key-file: /var/lib/cilium/tls/hubble/server.key
+  hubble-tls-client-ca-files: /var/lib/cilium/tls/hubble/client-ca.crt
+  ipam: "kubernetes"
+  ipam-cilium-node-update-rate: "15s"
+  default-lb-service-ipam: "lbipam"
+  egress-gateway-reconciliation-trigger-interval: "1s"
+  enable-vtep: "false"
+  vtep-endpoint: ""
+  vtep-cidr: ""
+  vtep-mask: ""
+  vtep-mac: ""
+  enable-k8s-endpoint-slice: "true"
+  procfs: "/host/proc"
+  bpf-root: "/sys/fs/bpf"
+  cgroup-root: "/sys/fs/cgroup"
+  enable-cilium-endpoint-slice: "true"
+  ces-rate-limits: "[{\"burst\":20,\"limit\":10,\"nodes\":0},{\"burst\":100,\"limit\":50,\"nodes\":100}]"
+  identity-management-mode: "agent"
+  enable-sctp: "false"
+  k8s-client-qps: "50"
+  k8s-client-burst: "100"
+  remove-cilium-node-taints: "true"
+  set-cilium-node-taints: "true"
+  set-cilium-is-up-condition: "true"
+  unmanaged-pod-watcher-interval: "15"
+  # default DNS proxy to transparent mode in non-chaining modes
+  dnsproxy-enable-transparent-mode: "true"
+  dnsproxy-socket-linger-timeout: "10"
+  tofqdns-dns-reject-response-code: "refused"
+  tofqdns-enable-dns-compression: "true"
+  tofqdns-endpoint-max-ip-per-hostname: "1000"
+  tofqdns-idle-connection-grace-period: "0s"
+  tofqdns-max-deferred-connection-deletes: "10000"
+  tofqdns-proxy-response-max-delay: "100ms"
+  tofqdns-preallocate-identities: "true"
+  agent-not-ready-taint-key: "node.cilium.io/agent-not-ready"
+  mesh-auth-enabled: "true"
+  mesh-auth-queue-size: "1024"
+  mesh-auth-rotated-identities-queue-size: "1024"
+  mesh-auth-gc-interval: "5m0s"
+  proxy-xff-num-trusted-hops-ingress: "0"
+  proxy-xff-num-trusted-hops-egress: "0"
+  proxy-connect-timeout: "2"
+  proxy-initial-fetch-timeout: "30"
+  proxy-max-requests-per-connection: "0"
+  proxy-max-connection-duration-seconds: "0"
+  proxy-idle-timeout-seconds: "60"
+  proxy-max-concurrent-retries: "128"
+  http-retry-count: "3"
+  http-stream-idle-timeout: "300"
+  external-envoy-proxy: "true"
+  envoy-base-id: "0"
+  envoy-access-log-buffer-size: "4096"
+  envoy-keep-cap-netbindservice: "true"
+  max-connected-clusters: "255"
+  clustermesh-enable-endpoint-sync: "false"
+  clustermesh-enable-mcs-api: "false"
+  policy-default-local-cluster: "false"
+  nat-map-stats-entries: "32"
+  nat-map-stats-interval: "30s"
+  enable-internal-traffic-policy: "true"
+  enable-lb-ipam: "true"
+  enable-non-default-deny-policies: "true"
+  enable-source-ip-verification: "true"
+# Extra config allows adding arbitrary properties to the cilium config.
+# By putting it at the end of the ConfigMap, it's also possible to override existing properties.

clusters/cl01tl/manifests/cilium/ConfigMap-hubble-relay-config.yml

@@ -0,0 +1,9 @@
+---
+# Source: cilium/charts/cilium/templates/hubble-relay/configmap.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: hubble-relay-config
+  namespace: kube-system
+data:
+  config.yaml: "cluster-name: default\npeer-service: \"hubble-peer.kube-system.svc.cluster.local.:443\"\nlisten-address: :4245\ngops: true\ngops-port: \"9893\"\nretry-timeout: \nsort-buffer-len-max: \nsort-buffer-drain-timeout: \ntls-hubble-client-cert-file: /var/lib/hubble-relay/tls/client.crt\ntls-hubble-client-key-file: /var/lib/hubble-relay/tls/client.key\ntls-hubble-server-ca-files: /var/lib/hubble-relay/tls/hubble-server-ca.crt\n\ndisable-server-tls: true\n"

clusters/cl01tl/manifests/cilium/ConfigMap-hubble-ui-nginx.yml

@@ -0,0 +1,9 @@
+---
+# Source: cilium/charts/cilium/templates/hubble-ui/configmap.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: hubble-ui-nginx
+  namespace: kube-system
+data:
+  nginx.conf: "server {\n    listen       8081;\n    listen       [::]:8081;\n    server_name  localhost;\n    root /app;\n    index index.html;\n    client_max_body_size 1G;\n\n    location / {\n        proxy_set_header Host $host;\n        proxy_set_header X-Real-IP $remote_addr;\n\n        location /api {\n            proxy_http_version 1.1;\n            proxy_pass_request_headers on;\n            proxy_pass http://127.0.0.1:8090;\n        }\n        location / {\n            if ($http_user_agent ~* \"kube-probe\") { access_log off; }\n            # double `/index.html` is required here\n            try_files $uri $uri/ /index.html /index.html;\n        }\n\n        # Liveness probe\n        location /healthz {\n            access_log off;\n            add_header Content-Type text/plain;\n            return 200 'ok';\n        }\n    }\n}"

clusters/cl01tl/manifests/cilium/DaemonSet-cilium-envoy.yml

@@ -0,0 +1,174 @@
+---
+# Source: cilium/charts/cilium/templates/cilium-envoy/daemonset.yaml
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: cilium-envoy
+  namespace: kube-system
+  labels:
+    k8s-app: cilium-envoy
+    app.kubernetes.io/part-of: cilium
+    app.kubernetes.io/name: cilium-envoy
+    name: cilium-envoy
+spec:
+  selector:
+    matchLabels:
+      k8s-app: cilium-envoy
+  updateStrategy:
+    rollingUpdate:
+      maxUnavailable: 2
+    type: RollingUpdate
+  template:
+    metadata:
+      annotations:
+      labels:
+        k8s-app: cilium-envoy
+        name: cilium-envoy
+        app.kubernetes.io/name: cilium-envoy
+        app.kubernetes.io/part-of: cilium
+    spec:
+      securityContext:
+        appArmorProfile:
+          type: Unconfined
+      containers:
+        - name: cilium-envoy
+          image: "quay.io/cilium/cilium-envoy:v1.34.10-1762597008-ff7ae7d623be00078865cff1b0672cc5d9bfc6d5@sha256:1deb6709afcb5523579bf1abbc3255adf9e354565a88c4a9162c8d9cb1d77ab5"
+          imagePullPolicy: IfNotPresent
+          command:
+            - /usr/bin/cilium-envoy-starter
+          args:
+            - '--keep-cap-net-bind-service'
+            - '--'
+            - '-c /var/run/cilium/envoy/bootstrap-config.json'
+            - '--base-id 0'
+            - '--log-level info'
+          startupProbe:
+            httpGet:
+              host: "127.0.0.1"
+              path: /healthz
+              port: 9878
+              scheme: HTTP
+            failureThreshold: 105
+            periodSeconds: 2
+            successThreshold: 1
+            initialDelaySeconds: 5
+          livenessProbe:
+            httpGet:
+              host: "127.0.0.1"
+              path: /healthz
+              port: 9878
+              scheme: HTTP
+            periodSeconds: 30
+            successThreshold: 1
+            failureThreshold: 10
+            timeoutSeconds: 5
+          readinessProbe:
+            httpGet:
+              host: "127.0.0.1"
+              path: /healthz
+              port: 9878
+              scheme: HTTP
+            periodSeconds: 30
+            successThreshold: 1
+            failureThreshold: 3
+            timeoutSeconds: 5
+          env:
+            - name: K8S_NODE_NAME
+              valueFrom:
+                fieldRef:
+                  apiVersion: v1
+                  fieldPath: spec.nodeName
+            - name: CILIUM_K8S_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  apiVersion: v1
+                  fieldPath: metadata.namespace
+            - name: KUBERNETES_SERVICE_HOST
+              value: "localhost"
+            - name: KUBERNETES_SERVICE_PORT
+              value: "7445"
+          ports:
+            - name: envoy-metrics
+              containerPort: 9964
+              hostPort: 9964
+              protocol: TCP
+          securityContext:
+            seLinuxOptions:
+              level: s0
+              type: spc_t
+            capabilities:
+              add:
+                - NET_ADMIN
+                - NET_BIND_SERVICE
+                - PERFMON
+                - BPF
+              drop:
+                - ALL
+          terminationMessagePolicy: FallbackToLogsOnError
+          volumeMounts:
+            - name: envoy-sockets
+              mountPath: /var/run/cilium/envoy/sockets
+              readOnly: false
+            - name: envoy-artifacts
+              mountPath: /var/run/cilium/envoy/artifacts
+              readOnly: true
+            - name: envoy-config
+              mountPath: /var/run/cilium/envoy/
+              readOnly: true
+            - name: bpf-maps
+              mountPath: /sys/fs/bpf
+              mountPropagation: HostToContainer
+      restartPolicy: Always
+      priorityClassName: system-node-critical
+      serviceAccountName: "cilium-envoy"
+      automountServiceAccountToken: true
+      terminationGracePeriodSeconds: 1
+      hostNetwork: true
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: cilium.io/no-schedule
+                    operator: NotIn
+                    values:
+                      - "true"
+        podAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchLabels:
+                  k8s-app: cilium
+              topologyKey: kubernetes.io/hostname
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchLabels:
+                  k8s-app: cilium-envoy
+              topologyKey: kubernetes.io/hostname
+      nodeSelector:
+        kubernetes.io/os: linux
+      tolerations:
+        - operator: Exists
+      volumes:
+        - name: envoy-sockets
+          hostPath:
+            path: "/var/run/cilium/envoy/sockets"
+            type: DirectoryOrCreate
+        - name: envoy-artifacts
+          hostPath:
+            path: "/var/run/cilium/envoy/artifacts"
+            type: DirectoryOrCreate
+        - name: envoy-config
+          configMap:
+            name: "cilium-envoy-config"
+            # note: the leading zero means this number is in octal representation: do not remove it
+            defaultMode: 0400
+            items:
+              - key: bootstrap-config.json
+                path: bootstrap-config.json
+                # To keep state between restarts / upgrades
+                # To keep state between restarts / upgrades for bpf maps
+        - name: bpf-maps
+          hostPath:
+            path: /sys/fs/bpf
+            type: DirectoryOrCreate

clusters/cl01tl/manifests/cilium/DaemonSet-cilium.yml

@@ -0,0 +1,494 @@
+---
+# Source: cilium/charts/cilium/templates/cilium-agent/daemonset.yaml
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: cilium
+  namespace: kube-system
+  labels:
+    k8s-app: cilium
+    app.kubernetes.io/part-of: cilium
+    app.kubernetes.io/name: cilium-agent
+spec:
+  selector:
+    matchLabels:
+      k8s-app: cilium
+  updateStrategy:
+    rollingUpdate:
+      maxUnavailable: 2
+    type: RollingUpdate
+  template:
+    metadata:
+      annotations:
+        # ensure pods roll when configmap updates
+        cilium.io/cilium-configmap-checksum: "31ad7748e0aefe75b6436d96c8c85754e0b44e68e6012fa188bc5bcd66085828"
+        kubectl.kubernetes.io/default-container: cilium-agent
+      labels:
+        k8s-app: cilium
+        app.kubernetes.io/name: cilium-agent
+        app.kubernetes.io/part-of: cilium
+    spec:
+      securityContext:
+        appArmorProfile:
+          type: Unconfined
+        seccompProfile:
+          type: Unconfined
+      containers:
+        - name: cilium-agent
+          image: "quay.io/cilium/cilium:v1.18.4@sha256:49d87af187eeeb9e9e3ec2bc6bd372261a0b5cb2d845659463ba7cc10fe9e45f"
+          imagePullPolicy: IfNotPresent
+          command:
+            - cilium-agent
+          args:
+            - --config-dir=/tmp/cilium/config-map
+          startupProbe:
+            httpGet:
+              host: "127.0.0.1"
+              path: /healthz
+              port: 9879
+              scheme: HTTP
+              httpHeaders:
+                - name: "brief"
+                  value: "true"
+            failureThreshold: 300
+            periodSeconds: 2
+            successThreshold: 1
+            initialDelaySeconds: 5
+          livenessProbe:
+            httpGet:
+              host: "127.0.0.1"
+              path: /healthz
+              port: 9879
+              scheme: HTTP
+              httpHeaders:
+                - name: "brief"
+                  value: "true"
+                - name: "require-k8s-connectivity"
+                  value: "false"
+            periodSeconds: 30
+            successThreshold: 1
+            failureThreshold: 10
+            timeoutSeconds: 5
+          readinessProbe:
+            httpGet:
+              host: "127.0.0.1"
+              path: /healthz
+              port: 9879
+              scheme: HTTP
+              httpHeaders:
+                - name: "brief"
+                  value: "true"
+            periodSeconds: 30
+            successThreshold: 1
+            failureThreshold: 3
+            timeoutSeconds: 5
+          env:
+            - name: K8S_NODE_NAME
+              valueFrom:
+                fieldRef:
+                  apiVersion: v1
+                  fieldPath: spec.nodeName
+            - name: CILIUM_K8S_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  apiVersion: v1
+                  fieldPath: metadata.namespace
+            - name: CILIUM_CLUSTERMESH_CONFIG
+              value: /var/lib/cilium/clustermesh/
+            - name: GOMEMLIMIT
+              valueFrom:
+                resourceFieldRef:
+                  resource: limits.memory
+                  divisor: '1'
+            - name: KUBERNETES_SERVICE_HOST
+              value: "localhost"
+            - name: KUBERNETES_SERVICE_PORT
+              value: "7445"
+            - name: KUBE_CLIENT_BACKOFF_BASE
+              value: "1"
+            - name: KUBE_CLIENT_BACKOFF_DURATION
+              value: "120"
+          lifecycle:
+            postStart:
+              exec:
+                command:
+                  - "bash"
+                  - "-c"
+                  - |
+                    set -o errexit
+                    set -o pipefail
+                    set -o nounset
+
+                    # When running in AWS ENI mode, it's likely that 'aws-node' has
+                    # had a chance to install SNAT iptables rules. These can result
+                    # in dropped traffic, so we should attempt to remove them.
+                    # We do it using a 'postStart' hook since this may need to run
+                    # for nodes which might have already been init'ed but may still
+                    # have dangling rules. This is safe because there are no
+                    # dependencies on anything that is part of the startup script
+                    # itself, and can be safely run multiple times per node (e.g. in
+                    # case of a restart).
+                    if [[ "$(iptables-save | grep -E -c 'AWS-SNAT-CHAIN|AWS-CONNMARK-CHAIN')" != "0" ]];
+                    then
+                        echo 'Deleting iptables rules created by the AWS CNI VPC plugin'
+                        iptables-save | grep -E -v 'AWS-SNAT-CHAIN|AWS-CONNMARK-CHAIN' | iptables-restore
+                    fi
+                    echo 'Done!'
+            preStop:
+              exec:
+                command:
+                  - /cni-uninstall.sh
+          ports:
+            - name: peer-service
+              containerPort: 4244
+              hostPort: 4244
+              protocol: TCP
+            - name: prometheus
+              containerPort: 9962
+              hostPort: 9962
+              protocol: TCP
+          securityContext:
+            seLinuxOptions:
+              level: s0
+              type: spc_t
+            capabilities:
+              add:
+                - CHOWN
+                - KILL
+                - NET_ADMIN
+                - NET_RAW
+                - IPC_LOCK
+                - SYS_ADMIN
+                - SYS_RESOURCE
+                - DAC_OVERRIDE
+                - FOWNER
+                - SETGID
+                - SETUID
+                - PERFMON
+                - BPF
+              drop:
+                - ALL
+          terminationMessagePolicy: FallbackToLogsOnError
+          volumeMounts:
+            - name: envoy-sockets
+              mountPath: /var/run/cilium/envoy/sockets
+              readOnly: false
+            # Unprivileged containers need to mount /proc/sys/net from the host
+            # to have write access
+            - mountPath: /host/proc/sys/net
+              name: host-proc-sys-net
+            # Unprivileged containers need to mount /proc/sys/kernel from the host
+            # to have write access
+            - mountPath: /host/proc/sys/kernel
+              name: host-proc-sys-kernel
+            - name: bpf-maps
+              mountPath: /sys/fs/bpf
+              # Unprivileged containers can't set mount propagation to bidirectional
+              # in this case we will mount the bpf fs from an init container that
+              # is privileged and set the mount propagation from host to container
+              # in Cilium.
+              mountPropagation: HostToContainer
+            # Check for duplicate mounts before mounting
+            - name: cilium-cgroup
+              mountPath: /sys/fs/cgroup
+            - name: cilium-run
+              mountPath: /var/run/cilium
+            - name: cilium-netns
+              mountPath: /var/run/cilium/netns
+              mountPropagation: HostToContainer
+            - name: etc-cni-netd
+              mountPath: /host/etc/cni/net.d
+            - name: clustermesh-secrets
+              mountPath: /var/lib/cilium/clustermesh
+              readOnly: true
+              # Needed to be able to load kernel modules
+            - name: lib-modules
+              mountPath: /lib/modules
+              readOnly: true
+            - name: xtables-lock
+              mountPath: /run/xtables.lock
+            - name: hubble-tls
+              mountPath: /var/lib/cilium/tls/hubble
+              readOnly: true
+            - name: tmp
+              mountPath: /tmp
+      initContainers:
+        - name: config
+          image: "quay.io/cilium/cilium:v1.18.4@sha256:49d87af187eeeb9e9e3ec2bc6bd372261a0b5cb2d845659463ba7cc10fe9e45f"
+          imagePullPolicy: IfNotPresent
+          command:
+            - cilium-dbg
+            - build-config
+          env:
+            - name: K8S_NODE_NAME
+              valueFrom:
+                fieldRef:
+                  apiVersion: v1
+                  fieldPath: spec.nodeName
+            - name: CILIUM_K8S_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  apiVersion: v1
+                  fieldPath: metadata.namespace
+            - name: KUBERNETES_SERVICE_HOST
+              value: "localhost"
+            - name: KUBERNETES_SERVICE_PORT
+              value: "7445"
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
+          terminationMessagePolicy: FallbackToLogsOnError
+        - name: apply-sysctl-overwrites
+          image: "quay.io/cilium/cilium:v1.18.4@sha256:49d87af187eeeb9e9e3ec2bc6bd372261a0b5cb2d845659463ba7cc10fe9e45f"
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: BIN_PATH
+              value: /opt/cni/bin
+          command:
+            - sh
+            - -ec
+            # The statically linked Go program binary is invoked to avoid any
+            # dependency on utilities like sh that can be missing on certain
+            # distros installed on the underlying host. Copy the binary to the
+            # same directory where we install cilium cni plugin so that exec permissions
+            # are available.
+            - |
+              cp /usr/bin/cilium-sysctlfix /hostbin/cilium-sysctlfix;
+              nsenter --mount=/hostproc/1/ns/mnt "${BIN_PATH}/cilium-sysctlfix";
+              rm /hostbin/cilium-sysctlfix
+          volumeMounts:
+            - name: hostproc
+              mountPath: /hostproc
+            - name: cni-path
+              mountPath: /hostbin
+          terminationMessagePolicy: FallbackToLogsOnError
+          securityContext:
+            seLinuxOptions:
+              level: s0
+              type: spc_t
+            capabilities:
+              add:
+                - SYS_ADMIN
+                - SYS_CHROOT
+                - SYS_PTRACE
+              drop:
+                - ALL
+        # Mount the bpf fs if it is not mounted. We will perform this task
+        # from a privileged container because the mount propagation bidirectional
+        # only works from privileged containers.
+        - name: mount-bpf-fs
+          image: "quay.io/cilium/cilium:v1.18.4@sha256:49d87af187eeeb9e9e3ec2bc6bd372261a0b5cb2d845659463ba7cc10fe9e45f"
+          imagePullPolicy: IfNotPresent
+          args:
+            - 'mount | grep "/sys/fs/bpf type bpf" || mount -t bpf bpf /sys/fs/bpf'
+          command:
+            - /bin/bash
+            - -c
+            - --
+          terminationMessagePolicy: FallbackToLogsOnError
+          securityContext:
+            privileged: true
+          volumeMounts:
+            - name: bpf-maps
+              mountPath: /sys/fs/bpf
+              mountPropagation: Bidirectional
+        - name: clean-cilium-state
+          image: "quay.io/cilium/cilium:v1.18.4@sha256:49d87af187eeeb9e9e3ec2bc6bd372261a0b5cb2d845659463ba7cc10fe9e45f"
+          imagePullPolicy: IfNotPresent
+          command:
+            - /init-container.sh
+          env:
+            - name: CILIUM_ALL_STATE
+              valueFrom:
+                configMapKeyRef:
+                  name: cilium-config
+                  key: clean-cilium-state
+                  optional: true
+            - name: CILIUM_BPF_STATE
+              valueFrom:
+                configMapKeyRef:
+                  name: cilium-config
+                  key: clean-cilium-bpf-state
+                  optional: true
+            - name: WRITE_CNI_CONF_WHEN_READY
+              valueFrom:
+                configMapKeyRef:
+                  name: cilium-config
+                  key: write-cni-conf-when-ready
+                  optional: true
+            - name: KUBERNETES_SERVICE_HOST
+              value: "localhost"
+            - name: KUBERNETES_SERVICE_PORT
+              value: "7445"
+          terminationMessagePolicy: FallbackToLogsOnError
+          securityContext:
+            seLinuxOptions:
+              level: s0
+              type: spc_t
+            capabilities:
+              add:
+                - NET_ADMIN
+                - SYS_ADMIN
+                - SYS_RESOURCE
+              drop:
+                - ALL
+          volumeMounts:
+            - name: bpf-maps
+              mountPath: /sys/fs/bpf
+              # Required to mount cgroup filesystem from the host to cilium agent pod
+            - name: cilium-cgroup
+              mountPath: /sys/fs/cgroup
+              mountPropagation: HostToContainer
+            - name: cilium-run
+              mountPath: /var/run/cilium # wait-for-kube-proxy
+        # Install the CNI binaries in an InitContainer so we don't have a writable host mount in the agent
+        - name: install-cni-binaries
+          image: "quay.io/cilium/cilium:v1.18.4@sha256:49d87af187eeeb9e9e3ec2bc6bd372261a0b5cb2d845659463ba7cc10fe9e45f"
+          imagePullPolicy: IfNotPresent
+          command:
+            - "/install-plugin.sh"
+          resources:
+            requests:
+              cpu: 100m
+              memory: 10Mi
+          securityContext:
+            seLinuxOptions:
+              level: s0
+              type: spc_t
+            capabilities:
+              drop:
+                - ALL
+          terminationMessagePolicy: FallbackToLogsOnError
+          volumeMounts:
+            - name: cni-path
+              mountPath: /host/opt/cni/bin # .Values.cni.install
+      restartPolicy: Always
+      priorityClassName: system-node-critical
+      serviceAccountName: "cilium"
+      automountServiceAccountToken: true
+      terminationGracePeriodSeconds: 1
+      hostNetwork: true
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchLabels:
+                  k8s-app: cilium
+              topologyKey: kubernetes.io/hostname
+      nodeSelector:
+        kubernetes.io/os: linux
+      tolerations:
+        - operator: Exists
+      volumes:
+        # For sharing configuration between the "config" initContainer and the agent
+        - name: tmp
+          emptyDir: {}
+          # To keep state between restarts / upgrades
+        - name: cilium-run
+          hostPath:
+            path: /var/run/cilium
+            type: DirectoryOrCreate
+            # To exec into pod network namespaces
+        - name: cilium-netns
+          hostPath:
+            path: /var/run/netns
+            type: DirectoryOrCreate
+            # To keep state between restarts / upgrades for bpf maps
+        - name: bpf-maps
+          hostPath:
+            path: /sys/fs/bpf
+            type: DirectoryOrCreate
+        # To mount cgroup2 filesystem on the host or apply sysctlfix
+        - name: hostproc
+          hostPath:
+            path: /proc
+            type: Directory
+        # To keep state between restarts / upgrades for cgroup2 filesystem
+        - name: cilium-cgroup
+          hostPath:
+            path: /sys/fs/cgroup
+            type: DirectoryOrCreate
+        # To install cilium cni plugin in the host
+        - name: cni-path
+          hostPath:
+            path: /opt/cni/bin
+            type: DirectoryOrCreate
+            # To install cilium cni configuration in the host
+        - name: etc-cni-netd
+          hostPath:
+            path: /etc/cni/net.d
+            type: DirectoryOrCreate
+            # To be able to load kernel modules
+        - name: lib-modules
+          hostPath:
+            path: /lib/modules
+            # To access iptables concurrently with other processes (e.g. kube-proxy)
+        - name: xtables-lock
+          hostPath:
+            path: /run/xtables.lock
+            type: FileOrCreate
+        # Sharing socket with Cilium Envoy on the same node by using a host path
+        - name: envoy-sockets
+          hostPath:
+            path: "/var/run/cilium/envoy/sockets"
+            type: DirectoryOrCreate
+            # To read the clustermesh configuration
+        - name: clustermesh-secrets
+          projected:
+            # note: the leading zero means this number is in octal representation: do not remove it
+            defaultMode: 0400
+            sources:
+              - secret:
+                  name: cilium-clustermesh
+                  optional: true
+                  # note: items are not explicitly listed here, since the entries of this secret
+                  # depend on the peers configured, and that would cause a restart of all agents
+                  # at every addition/removal. Leaving the field empty makes each secret entry
+                  # to be automatically projected into the volume as a file whose name is the key.
+              - secret:
+                  name: clustermesh-apiserver-remote-cert
+                  optional: true
+                  items:
+                    - key: tls.key
+                      path: common-etcd-client.key
+                    - key: tls.crt
+                      path: common-etcd-client.crt
+                    - key: ca.crt
+                      path: common-etcd-client-ca.crt
+              # note: we configure the volume for the kvstoremesh-specific certificate
+              # regardless of whether KVStoreMesh is enabled or not, so that it can be
+              # automatically mounted in case KVStoreMesh gets subsequently enabled,
+              # without requiring an agent restart.
+              - secret:
+                  name: clustermesh-apiserver-local-cert
+                  optional: true
+                  items:
+                    - key: tls.key
+                      path: local-etcd-client.key
+                    - key: tls.crt
+                      path: local-etcd-client.crt
+                    - key: ca.crt
+                      path: local-etcd-client-ca.crt
+        - name: host-proc-sys-net
+          hostPath:
+            path: /proc/sys/net
+            type: Directory
+        - name: host-proc-sys-kernel
+          hostPath:
+            path: /proc/sys/kernel
+            type: Directory
+        - name: hubble-tls
+          projected:
+            # note: the leading zero means this number is in octal representation: do not remove it
+            defaultMode: 0400
+            sources:
+              - secret:
+                  name: hubble-server-certs
+                  optional: true
+                  items:
+                    - key: tls.crt
+                      path: server.crt
+                    - key: tls.key
+                      path: server.key
+                    - key: ca.crt
+                      path: client-ca.crt

clusters/cl01tl/manifests/cilium/Deployment-cilium-operator.yml

@@ -0,0 +1,139 @@
+---
+# Source: cilium/charts/cilium/templates/cilium-operator/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cilium-operator
+  namespace: kube-system
+  labels:
+    io.cilium/app: operator
+    name: cilium-operator
+    app.kubernetes.io/part-of: cilium
+    app.kubernetes.io/name: cilium-operator
+spec:
+  # See docs on ServerCapabilities.LeasesResourceLock in file pkg/k8s/version/version.go
+  # for more details.
+  replicas: 2
+  selector:
+    matchLabels:
+      io.cilium/app: operator
+      name: cilium-operator
+  # ensure operator update on single node k8s clusters, by using rolling update with maxUnavailable=100% in case
+  # of one replica and no user configured Recreate strategy.
+  # otherwise an update might get stuck due to the default maxUnavailable=50% in combination with the
+  # podAntiAffinity which prevents deployments of multiple operator replicas on the same node.
+  strategy:
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 50%
+    type: RollingUpdate
+  template:
+    metadata:
+      annotations:
+        # ensure pods roll when configmap updates
+        cilium.io/cilium-configmap-checksum: "31ad7748e0aefe75b6436d96c8c85754e0b44e68e6012fa188bc5bcd66085828"
+      labels:
+        io.cilium/app: operator
+        name: cilium-operator
+        app.kubernetes.io/part-of: cilium
+        app.kubernetes.io/name: cilium-operator
+    spec:
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: cilium-operator
+          image: "quay.io/cilium/operator-generic:v1.18.4@sha256:1b22b9ff28affdf574378a70dade4ef835b00b080c2ee2418530809dd62c3012"
+          imagePullPolicy: IfNotPresent
+          command:
+            - cilium-operator-generic
+          args:
+            - --config-dir=/tmp/cilium/config-map
+            - --debug=$(CILIUM_DEBUG)
+          env:
+            - name: K8S_NODE_NAME
+              valueFrom:
+                fieldRef:
+                  apiVersion: v1
+                  fieldPath: spec.nodeName
+            - name: CILIUM_K8S_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  apiVersion: v1
+                  fieldPath: metadata.namespace
+            - name: CILIUM_DEBUG
+              valueFrom:
+                configMapKeyRef:
+                  key: debug
+                  name: cilium-config
+                  optional: true
+            - name: KUBERNETES_SERVICE_HOST
+              value: "localhost"
+            - name: KUBERNETES_SERVICE_PORT
+              value: "7445"
+          ports:
+            - name: prometheus
+              containerPort: 9963
+              hostPort: 9963
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              host: "127.0.0.1"
+              path: /healthz
+              port: 9234
+              scheme: HTTP
+            initialDelaySeconds: 60
+            periodSeconds: 10
+            timeoutSeconds: 3
+          readinessProbe:
+            httpGet:
+              host: "127.0.0.1"
+              path: /healthz
+              port: 9234
+              scheme: HTTP
+            initialDelaySeconds: 0
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 5
+          volumeMounts:
+            - name: cilium-config-path
+              mountPath: /tmp/cilium/config-map
+              readOnly: true
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+          terminationMessagePolicy: FallbackToLogsOnError
+      hostNetwork: true
+      restartPolicy: Always
+      priorityClassName: system-cluster-critical
+      serviceAccountName: "cilium-operator"
+      automountServiceAccountToken: true
+      # In HA mode, cilium-operator pods must not be scheduled on the same
+      # node as they will clash with each other.
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchLabels:
+                  io.cilium/app: operator
+              topologyKey: kubernetes.io/hostname
+      nodeSelector:
+        kubernetes.io/os: linux
+      tolerations:
+        - key: node-role.kubernetes.io/control-plane
+          operator: Exists
+        - key: node-role.kubernetes.io/master
+          operator: Exists
+        - key: node.kubernetes.io/not-ready
+          operator: Exists
+        - key: node.cloudprovider.kubernetes.io/uninitialized
+          operator: Exists
+        - key: node.cilium.io/agent-not-ready
+          operator: Exists
+      volumes:
+        # To read the configuration from the config map
+        - name: cilium-config-path
+          configMap:
+            name: cilium-config

clusters/cl01tl/manifests/cilium/Deployment-hubble-relay.yml

@@ -0,0 +1,128 @@
+---
+# Source: cilium/charts/cilium/templates/hubble-relay/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: hubble-relay
+  namespace: kube-system
+  labels:
+    k8s-app: hubble-relay
+    app.kubernetes.io/name: hubble-relay
+    app.kubernetes.io/part-of: cilium
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      k8s-app: hubble-relay
+  strategy:
+    rollingUpdate:
+      maxUnavailable: 1
+    type: RollingUpdate
+  template:
+    metadata:
+      annotations:
+      labels:
+        k8s-app: hubble-relay
+        app.kubernetes.io/name: hubble-relay
+        app.kubernetes.io/part-of: cilium
+    spec:
+      securityContext:
+        fsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: hubble-relay
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            runAsGroup: 65532
+            runAsNonRoot: true
+            runAsUser: 65532
+            seccompProfile:
+              type: RuntimeDefault
+          image: "quay.io/cilium/hubble-relay:v1.18.4@sha256:6d350cb1c84b847adb152173debef1f774126c69de21a5921a1e6a23b8779723"
+          imagePullPolicy: IfNotPresent
+          command:
+            - hubble-relay
+          args:
+            - serve
+          ports:
+            - name: grpc
+              containerPort: 4245
+          readinessProbe:
+            grpc:
+              port: 4222
+            timeoutSeconds: 3
+          # livenessProbe will kill the pod, we should be very conservative
+          # here on failures since killing the pod should be a last resort, and
+          # we should provide enough time for relay to retry before killing it.
+          livenessProbe:
+            grpc:
+              port: 4222
+            timeoutSeconds: 10
+            # Give relay time to establish connections and make a few retries
+            # before starting livenessProbes.
+            initialDelaySeconds: 10
+            # 10 second * 12 failures = 2 minutes of failure.
+            # If relay cannot become healthy after 2 minutes, then killing it
+            # might resolve whatever issue is occurring.
+            #
+            # 10 seconds is a reasonable retry period so we can see if it's
+            # failing regularly or only sporadically.
+            periodSeconds: 10
+            failureThreshold: 12
+          startupProbe:
+            grpc:
+              port: 4222
+            # Give relay time to get it's certs and establish connections and
+            # make a few retries before starting startupProbes.
+            initialDelaySeconds: 10
+            # 20 * 3 seconds = 1 minute of failure before we consider startup as failed.
+            failureThreshold: 20
+            # Retry more frequently at startup so that it can be considered started more quickly.
+            periodSeconds: 3
+          volumeMounts:
+            - name: config
+              mountPath: /etc/hubble-relay
+              readOnly: true
+            - name: tls
+              mountPath: /var/lib/hubble-relay/tls
+              readOnly: true
+          terminationMessagePolicy: FallbackToLogsOnError
+      restartPolicy: Always
+      priorityClassName:
+      serviceAccountName: "hubble-relay"
+      automountServiceAccountToken: false
+      terminationGracePeriodSeconds: 1
+      affinity:
+        podAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchLabels:
+                  k8s-app: cilium
+              topologyKey: kubernetes.io/hostname
+      nodeSelector:
+        kubernetes.io/os: linux
+      volumes:
+        - name: config
+          configMap:
+            name: hubble-relay-config
+            items:
+              - key: config.yaml
+                path: config.yaml
+        - name: tls
+          projected:
+            # note: the leading zero means this number is in octal representation: do not remove it
+            defaultMode: 0400
+            sources:
+              - secret:
+                  name: hubble-relay-client-certs
+                  items:
+                    - key: tls.crt
+                      path: client.crt
+                    - key: tls.key
+                      path: client.key
+                    - key: ca.crt
+                      path: hubble-server-ca.crt

clusters/cl01tl/manifests/cilium/Deployment-hubble-ui.yml

@@ -0,0 +1,83 @@
+---
+# Source: cilium/charts/cilium/templates/hubble-ui/deployment.yaml
+kind: Deployment
+apiVersion: apps/v1
+metadata:
+  name: hubble-ui
+  namespace: kube-system
+  labels:
+    k8s-app: hubble-ui
+    app.kubernetes.io/name: hubble-ui
+    app.kubernetes.io/part-of: cilium
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      k8s-app: hubble-ui
+  strategy:
+    rollingUpdate:
+      maxUnavailable: 1
+    type: RollingUpdate
+  template:
+    metadata:
+      annotations:
+      labels:
+        k8s-app: hubble-ui
+        app.kubernetes.io/name: hubble-ui
+        app.kubernetes.io/part-of: cilium
+    spec:
+      securityContext:
+        fsGroup: 1001
+        runAsGroup: 1001
+        runAsUser: 1001
+      priorityClassName:
+      serviceAccountName: "hubble-ui"
+      automountServiceAccountToken: true
+      containers:
+        - name: frontend
+          image: "quay.io/cilium/hubble-ui:v0.13.3@sha256:661d5de7050182d495c6497ff0b007a7a1e379648e60830dd68c4d78ae21761d"
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 8081
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: 8081
+          readinessProbe:
+            httpGet:
+              path: /
+              port: 8081
+          volumeMounts:
+            - name: hubble-ui-nginx-conf
+              mountPath: /etc/nginx/conf.d/default.conf
+              subPath: nginx.conf
+            - name: tmp-dir
+              mountPath: /tmp
+          terminationMessagePolicy: FallbackToLogsOnError
+          securityContext:
+            allowPrivilegeEscalation: false
+        - name: backend
+          image: "quay.io/cilium/hubble-ui-backend:v0.13.3@sha256:db1454e45dc39ca41fbf7cad31eec95d99e5b9949c39daaad0fa81ef29d56953"
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: EVENTS_SERVER_PORT
+              value: "8090"
+            - name: FLOWS_API_ADDR
+              value: "hubble-relay:80"
+          ports:
+            - name: grpc
+              containerPort: 8090
+          volumeMounts:
+          terminationMessagePolicy: FallbackToLogsOnError
+          securityContext:
+            allowPrivilegeEscalation: false
+      nodeSelector:
+        kubernetes.io/os: linux
+      volumes:
+        - configMap:
+            defaultMode: 420
+            name: hubble-ui-nginx
+          name: hubble-ui-nginx-conf
+        - emptyDir: {}
+          name: tmp-dir

clusters/cl01tl/manifests/cilium/HTTPRoute-http-route-hubble.yml

@@ -0,0 +1,30 @@
+---
+# Source: cilium/templates/http-route.yaml
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: http-route-hubble
+  namespace: kube-system
+  labels:
+    app.kubernetes.io/name: http-route-hubble
+    app.kubernetes.io/instance: cilium
+    app.kubernetes.io/part-of: cilium
+spec:
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+  hostnames:
+    - hubble.alexlebens.net
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - group: ''
+          kind: Service
+          name: hubble-ui
+          port: 80
+          weight: 100

clusters/cl01tl/manifests/cilium/Namespace-cilium-secrets.yml

@@ -0,0 +1,9 @@
+---
+# Source: cilium/charts/cilium/templates/cilium-secrets-namespace.yaml
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: "cilium-secrets"
+  labels:
+    app.kubernetes.io/part-of: cilium
+  annotations:

clusters/cl01tl/manifests/cilium/Role-cilium-config-agent.yml

@@ -0,0 +1,18 @@
+---
+# Source: cilium/charts/cilium/templates/cilium-agent/role.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: cilium-config-agent
+  namespace: kube-system
+  labels:
+    app.kubernetes.io/part-of: cilium
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+    verbs:
+      - get
+      - list
+      - watch

clusters/cl01tl/manifests/cilium/Role-cilium-gateway-secrets.yml

@@ -0,0 +1,18 @@
+---
+# Source: cilium/charts/cilium/templates/cilium-agent/role.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: cilium-gateway-secrets
+  namespace: "cilium-secrets"
+  labels:
+    app.kubernetes.io/part-of: cilium
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - secrets
+    verbs:
+      - get
+      - list
+      - watch

clusters/cl01tl/manifests/cilium/Role-cilium-operator-gateway-secrets.yml

@@ -0,0 +1,19 @@
+---
+# Source: cilium/charts/cilium/templates/cilium-operator/role.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: cilium-operator-gateway-secrets
+  namespace: "cilium-secrets"
+  labels:
+    app.kubernetes.io/part-of: cilium
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - secrets
+    verbs:
+      - create
+      - delete
+      - update
+      - patch

clusters/cl01tl/manifests/cilium/Role-cilium-operator-tlsinterception-secrets.yml

@@ -0,0 +1,19 @@
+---
+# Source: cilium/charts/cilium/templates/cilium-operator/role.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: cilium-operator-tlsinterception-secrets
+  namespace: "cilium-secrets"
+  labels:
+    app.kubernetes.io/part-of: cilium
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - secrets
+    verbs:
+      - create
+      - delete
+      - update
+      - patch

clusters/cl01tl/manifests/cilium/Role-cilium-tlsinterception-secrets.yml

@@ -0,0 +1,18 @@
+---
+# Source: cilium/charts/cilium/templates/cilium-agent/role.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: cilium-tlsinterception-secrets
+  namespace: "cilium-secrets"
+  labels:
+    app.kubernetes.io/part-of: cilium
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - secrets
+    verbs:
+      - get
+      - list
+      - watch

clusters/cl01tl/manifests/cilium/RoleBinding-cilium-config-agent.yml

@@ -0,0 +1,17 @@
+---
+# Source: cilium/charts/cilium/templates/cilium-agent/rolebinding.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: cilium-config-agent
+  namespace: kube-system
+  labels:
+    app.kubernetes.io/part-of: cilium
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: cilium-config-agent
+subjects:
+  - kind: ServiceAccount
+    name: "cilium"
+    namespace: kube-system

clusters/cl01tl/manifests/cilium/RoleBinding-cilium-gateway-secrets.yml

@@ -0,0 +1,17 @@
+---
+# Source: cilium/charts/cilium/templates/cilium-agent/rolebinding.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: cilium-gateway-secrets
+  namespace: "cilium-secrets"
+  labels:
+    app.kubernetes.io/part-of: cilium
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: cilium-gateway-secrets
+subjects:
+  - kind: ServiceAccount
+    name: "cilium"
+    namespace: kube-system

clusters/cl01tl/manifests/cilium/RoleBinding-cilium-operator-gateway-secrets.yml

@@ -0,0 +1,17 @@
+---
+# Source: cilium/charts/cilium/templates/cilium-operator/rolebinding.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: cilium-operator-gateway-secrets
+  namespace: "cilium-secrets"
+  labels:
+    app.kubernetes.io/part-of: cilium
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: cilium-operator-gateway-secrets
+subjects:
+  - kind: ServiceAccount
+    name: "cilium-operator"
+    namespace: kube-system

clusters/cl01tl/manifests/cilium/RoleBinding-cilium-operator-tlsinterception-secrets.yml

@@ -0,0 +1,17 @@
+---
+# Source: cilium/charts/cilium/templates/cilium-operator/rolebinding.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: cilium-operator-tlsinterception-secrets
+  namespace: "cilium-secrets"
+  labels:
+    app.kubernetes.io/part-of: cilium
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: cilium-operator-tlsinterception-secrets
+subjects:
+  - kind: ServiceAccount
+    name: "cilium-operator"
+    namespace: kube-system

clusters/cl01tl/manifests/cilium/RoleBinding-cilium-tlsinterception-secrets.yml

@@ -0,0 +1,17 @@
+---
+# Source: cilium/charts/cilium/templates/cilium-agent/rolebinding.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: cilium-tlsinterception-secrets
+  namespace: "cilium-secrets"
+  labels:
+    app.kubernetes.io/part-of: cilium
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: cilium-tlsinterception-secrets
+subjects:
+  - kind: ServiceAccount
+    name: "cilium"
+    namespace: kube-system

clusters/cl01tl/manifests/cilium/Secret-cilium-ca.yml

@@ -0,0 +1,10 @@
+---
+# Source: cilium/charts/cilium/templates/cilium-ca-secret.yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: cilium-ca
+  namespace: kube-system
+data:
+  ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURGRENDQWZ5Z0F3SUJBZ0lSQUt4RXV3NmVBRVN1YnY2OU44UUdaand3RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEkxTVRJd05EQTBORFkxTmxvWERUSTRNVEl3TXpBMApORFkxTmxvd0ZERVNNQkFHQTFVRUF4TUpRMmxzYVhWdElFTkJNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DCkFROEFNSUlCQ2dLQ0FRRUF4dnRHR3JjTTNDV1VNZTdMcWxKUkIrdlZwUjYwN21TUUw3ZUV2OTZOVXlqWERvVFQKUVlEcVkrYkJWQlF6MVJlRlQyN0k1MDE4cDRqQlNWd09ONkVyM3pUcEs5MEZrdWt5KzRTRnJjRWxONDJRODFkcAphZk9NOXVZc2J3NmZEbFFmbUs5R1dudnpxRjlEOFpoaHZ1ZDhBZDNtM28rL1pMV3hra1ViREh4bHM5d0I1aFJCClp3RlZsYlNHa1dWUEJseEtteXYxYXdQaTY0OWdxVkM2czJuNWRuT2FLUHVBR21rUklWbnBVbk9aVTlJRW9FUUkKaTlKcXJWSUVveVNFZGQvMXYvbVlCM2RvNG9jZkl6bDJRUUNQbytoMTJwZGdZRVB4cDRVdWVSbG0rZU9qT3hlVAorVFhXcktmMXp4TzRhSXQ1M3lvQ1FvNkNxdk5mdDlyNklia3czd0lEQVFBQm8yRXdYekFPQmdOVkhROEJBZjhFCkJBTUNBcVF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUYKTUFNQkFmOHdIUVlEVlIwT0JCWUVGTjhyanYrSjNWVDJhVFh3MHhYNDQ5RkFvN2FLTUEwR0NTcUdTSWIzRFFFQgpDd1VBQTRJQkFRQnJGUGxsaW9XVEdtMmRxZFczdk1HT2N2cm1CZ3pvOFgxUlAvcGxPZTdCdTdZeE84WlJKS0RRCk12dndjZDBGRW9VK2Uyang4QnR4KzAwU3FGY3JnMmtaYVZjVExWZXdiTXVBU2l3bHJlTEFCYjVDcWp1bjFhWUIKTHEwV1BLQ1lrM0g4K24xYXlTQlQzMUgzcDBFR0QyZWlIQmk5NWtMSWlKV3d1TWZEeFg0ek5JZ1VkVm40UHYxQgpUNXo5ZVAreCs1RGwrMm5XSSthTHQyVGxOd3BzRnRrdEpyTWNYYXYxZFRZTHBReVE5SHQyQTZtVjMxcXNTditLClpBSW1hZVJSeWVMQWhyN3J3Y0k5U2RoOTdwSy9HRVVYZWNaTkJXbjhNTmhiQ2hIVDFmZDdVVzV3RllEZzRUcFAKZVAvREg1VGZEVFBZam5VdTZ4UElGQ1liUUh2N2ROQTcKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
+  ca.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBeHZ0R0dyY00zQ1dVTWU3THFsSlJCK3ZWcFI2MDdtU1FMN2VFdjk2TlV5alhEb1RUClFZRHFZK2JCVkJRejFSZUZUMjdJNTAxOHA0akJTVndPTjZFcjN6VHBLOTBGa3VreSs0U0ZyY0VsTjQyUTgxZHAKYWZPTTl1WXNidzZmRGxRZm1LOUdXbnZ6cUY5RDhaaGh2dWQ4QWQzbTNvKy9aTFd4a2tVYkRIeGxzOXdCNWhSQgpad0ZWbGJTR2tXVlBCbHhLbXl2MWF3UGk2NDlncVZDNnMybjVkbk9hS1B1QUdta1JJVm5wVW5PWlU5SUVvRVFJCmk5SnFyVklFb3lTRWRkLzF2L21ZQjNkbzRvY2ZJemwyUVFDUG8raDEycGRnWUVQeHA0VXVlUmxtK2VPak94ZVQKK1RYV3JLZjF6eE80YUl0NTN5b0NRbzZDcXZOZnQ5cjZJYmt3M3dJREFRQUJBb0lCQVFDUWVGb1RCWHE1MERNRAorZ3czY3FMUXJJTW02dCtWQXNESlZHWjI1SUFaczlwSStWbGxBdE9yaXh3dERxbi9lcDlZNStmSVFMTlQ5Ry9aCjhwT0VBbW9YR3BSOU8zRlRsQ3RuQUhZS2pPU1hyQnBsQTc5T3BQMWhPZ2RpN3V1Ky9JY2dWWW93SWpUcnQ1ZGUKTHpRdzVtTmIrNkFuVVprMTV0R3hrS2t0N0pmdStIREF3bW5TajllUllQeFFjTVh3ek9aN2JzRnB3U3MzY216dAprRDcvaXJ0U0NOTitJVmFzZ3JLSFpGTUVVZlg1amoyaGs0SnhvMURkeUJEd080KzBMd1h5UWVJdGo0aVJrd2hPCm51cUdwR2F4WXYrcElRMEplUDJnajVCaXVjd2x4RGRCYnRRRVFxZ1pnZWZIVmZDQWpZWktCUStmVXhDbHpBS04KYXJJQWlKcVpBb0dCQVArMFNqa2hNVWNyNmhkQ29ya04xbWZlaU84MTJ0K2JYbnJkTWtieittN1lHRm0xS3l0aQp3RjYzKzBwUnVMa1k3RTZnRzNZeTFjSmgyaVF2bE5RSjZ3bnBUY0txUVRNaWFXZzBGOEtXVDdMdjY3ZCt2MS90ClRtc2NIaVRvRnZ2Z1J4WmtSbEs0RFR4dlNSVG9EVDRia29GYkJOL0pXU0xESDcvQ1RTYVJXWGExQW9HQkFNYzIKTUc3NUdaNEoyYTcrb2x0dFdNUlNUeVQxR0xlRDljSUR1SmYwOG9hRkxVclhjQUIwbmFybEtSWlJraklScHdyNApGbTRScU1OaUNGd3hCSkpTVW5nZ3VUUzZtR0VqNFlNZ09UNkYvOGsyVTVySGw0N3YvZWc5QWlmcDg2cTR4S3l6CnFkN1BPZi90ZHp1S0N3T1dNMWhzZjJ6S3JqejFGY0tjSllsdVF0SERBb0dBTS9kcENqbERzWW9zTmZQMTdCUHkKMmdNdzR5U1h5Yy9pb0tlcG14L2thbmlDWW1EZVdCL21wcGxQZWFnb0dYNEdNR2g3akVjQ2lGR29xcWY4NENidgozSURNcTk0OEIrOWJhckVEanlsTEl6dDlOVHFPSENtM1FTOWl0Tzl5RkZoZE9pREE1ZmkvditPQi83eTFURVVBClBrZklNczdSemEzSUd3bWE4bGFoenUwQ2dZQS81blAyeE5TZ3l3d1dnL3RVVkdqcTRIUWVxTGY2OWNzNUpyUnAKbWRySnA2SjFwVkY1OCs0M1NUYTZ3QU9qSitKck5GVU5qWUNTMjdsT3lUSnNOUmZiRExRYjQ5YkpJaGRPVm1IRwpXbmxIODdNeHJPQkNxMXpJeC9rUEVJNW1yc24zazlIamRKbG9MS1hZWlZsUEZ6ajFIaWhwbjBId3I3VUJMZEVrCm1rZTR2UUtCZ1FEQzFiZWdRajdIc2k4OG13eVF4UENMd1NRenp2U3BWTHk0VHBoUlJadFVTazgrVW9IbXZZZVIKU1VZS1kzUEtQMGZveEZuQ2hNV2pIeU9UOHQ1ZHA0VW9LWEtUNjV2SW1HYUkzMS91K2J3VVlGeU1LM2ZmcDhpNgpaemVlTmFaT2RPNnlCSUdkNXdNRnI3MmR0M0twMDJlcmpmR2hQUGw5S0NJam43V0hvakJhVFE9PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=

clusters/cl01tl/manifests/cilium/Secret-hubble-relay-client-certs.yml

@@ -0,0 +1,12 @@
+---
+# Source: cilium/charts/cilium/templates/hubble/tls-helm/relay-client-secret.yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: hubble-relay-client-certs
+  namespace: kube-system
+type: kubernetes.io/tls
+data:
+  ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURGRENDQWZ5Z0F3SUJBZ0lSQUt4RXV3NmVBRVN1YnY2OU44UUdaand3RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEkxTVRJd05EQTBORFkxTmxvWERUSTRNVEl3TXpBMApORFkxTmxvd0ZERVNNQkFHQTFVRUF4TUpRMmxzYVhWdElFTkJNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DCkFROEFNSUlCQ2dLQ0FRRUF4dnRHR3JjTTNDV1VNZTdMcWxKUkIrdlZwUjYwN21TUUw3ZUV2OTZOVXlqWERvVFQKUVlEcVkrYkJWQlF6MVJlRlQyN0k1MDE4cDRqQlNWd09ONkVyM3pUcEs5MEZrdWt5KzRTRnJjRWxONDJRODFkcAphZk9NOXVZc2J3NmZEbFFmbUs5R1dudnpxRjlEOFpoaHZ1ZDhBZDNtM28rL1pMV3hra1ViREh4bHM5d0I1aFJCClp3RlZsYlNHa1dWUEJseEtteXYxYXdQaTY0OWdxVkM2czJuNWRuT2FLUHVBR21rUklWbnBVbk9aVTlJRW9FUUkKaTlKcXJWSUVveVNFZGQvMXYvbVlCM2RvNG9jZkl6bDJRUUNQbytoMTJwZGdZRVB4cDRVdWVSbG0rZU9qT3hlVAorVFhXcktmMXp4TzRhSXQ1M3lvQ1FvNkNxdk5mdDlyNklia3czd0lEQVFBQm8yRXdYekFPQmdOVkhROEJBZjhFCkJBTUNBcVF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUYKTUFNQkFmOHdIUVlEVlIwT0JCWUVGTjhyanYrSjNWVDJhVFh3MHhYNDQ5RkFvN2FLTUEwR0NTcUdTSWIzRFFFQgpDd1VBQTRJQkFRQnJGUGxsaW9XVEdtMmRxZFczdk1HT2N2cm1CZ3pvOFgxUlAvcGxPZTdCdTdZeE84WlJKS0RRCk12dndjZDBGRW9VK2Uyang4QnR4KzAwU3FGY3JnMmtaYVZjVExWZXdiTXVBU2l3bHJlTEFCYjVDcWp1bjFhWUIKTHEwV1BLQ1lrM0g4K24xYXlTQlQzMUgzcDBFR0QyZWlIQmk5NWtMSWlKV3d1TWZEeFg0ek5JZ1VkVm40UHYxQgpUNXo5ZVAreCs1RGwrMm5XSSthTHQyVGxOd3BzRnRrdEpyTWNYYXYxZFRZTHBReVE5SHQyQTZtVjMxcXNTditLClpBSW1hZVJSeWVMQWhyN3J3Y0k5U2RoOTdwSy9HRVVYZWNaTkJXbjhNTmhiQ2hIVDFmZDdVVzV3RllEZzRUcFAKZVAvREg1VGZEVFBZam5VdTZ4UElGQ1liUUh2N2ROQTcKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURTRENDQWpDZ0F3SUJBZ0lRR0gzcU5rOHY5TnhkaXU1VjFvV1N4REFOQmdrcWhraUc5dzBCQVFzRkFEQVUKTVJJd0VBWURWUVFERXdsRGFXeHBkVzBnUTBFd0hoY05NalV4TWpBME1EUTBOalUyV2hjTk1qWXhNakEwTURRMApOalUyV2pBak1TRXdId1lEVlFRRERCZ3FMbWgxWW1Kc1pTMXlaV3hoZVM1amFXeHBkVzB1YVc4d2dnRWlNQTBHCkNTcUdTSWIzRFFFQkFRVUFBNElCRHdBd2dnRUtBb0lCQVFEUFpBVlF2Q28vK3BITWJqTFVTVkJTNDV2YjIyRFYKMnhkSWN2T1ZKR2RVM0hFTk1YTnllRWpaL3U0WStEOVBrNjBNVDJWNWpQMEs0TW1yOXZHTXFGWkUzdnJQaVRseQo4bzVWUFNtdHBva3Ruc09kVng2b3hjdGFNelNXU2NxN0xlMUlUVS9SK0Y5ZWxVN2JWY3g4N2IvditiSHNqditICmNUQmhtZE9oY3F5azNwS3Y4U1IyT3JFY2pZQmF0eGpGTjJYeTVnM0Juc3doUjN5aEhYWkl6T0plQkxacHN1ZzkKUFk3SDVqWjNITHJvYVlucmc5TUhYYThjaHNqL2RMbWNCV0tJNmRmSjUzeFIwUS9helJCdkpqaHVoQ1VDUi9DNApiUHN3aFQ1SmN5aC94MnNnemlJVHhVbFpBTmoxYnQwd0RONkdFd1Jsd1ByUUhHYUZXWEtPMGNXaEFnTUJBQUdqCmdZWXdnWU13RGdZRFZSMFBBUUgvQkFRREFnV2dNQjBHQTFVZEpRUVdNQlFHQ0NzR0FRVUZCd01CQmdnckJnRUYKQlFjREFqQU1CZ05WSFJNQkFmOEVBakFBTUI4R0ExVWRJd1FZTUJhQUZOOHJqditKM1ZUMmFUWHcweFg0NDlGQQpvN2FLTUNNR0ExVWRFUVFjTUJxQ0dDb3VhSFZpWW14bExYSmxiR0Y1TG1OcGJHbDFiUzVwYnpBTkJna3Foa2lHCjl3MEJBUXNGQUFPQ0FRRUF1VkxFaXdmWGFTSzE4TTNqZ1JFRDFicG9OZGRERW8wQ1h5WlU5YjBCWmxDRGtGbjIKRTQ5OS9ncE0rSEpuRmZxZ3V3QlU2dVgzRjM1RGdpeVUzSm9DRm9HNDlYQVNiTFZZODVGN2dvYWNCQVZiVWV4cwpuTm5pQkJBY3h3OUFSeHdJdVd5bUZEaGUxNGRJQld0WStXeksxeDNhMldEWHR1cFpMRFVGVjhGN1ZLZElZRWIwCmpoSm9Gbmp6WTNFUHZ3Z0hzRDBjTjJic3RjWit0ZWVuVVNsY05lREx5b0J0dTRQRldlZGQzNi9RRnhsd1lyZXcKS3J3TGJhQXJaK2s3T1YzSEFKekJRV0NWVkk3SXV5Z2JucmNaRUd1VmRZSkVVRmlSYkNXWGgzUWhNYWNqZkI5cwp1RkpPR005cjdDcEI1Yjg5V1g4VnlSYTNrM1kraUY4bDdvYUVkUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+  tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcFFJQkFBS0NBUUVBejJRRlVMd3FQL3FSekc0eTFFbFFVdU9iMjl0ZzFkc1hTSEx6bFNSblZOeHhEVEZ6CmNuaEkyZjd1R1BnL1Q1T3RERTlsZVl6OUN1REpxL2J4aktoV1JONzZ6NGs1Y3ZLT1ZUMHByYWFKTFo3RG5WY2UKcU1YTFdqTTBsa25LdXkzdFNFMVAwZmhmWHBWTzIxWE1mTzIvNy9teDdJNy9oM0V3WVpuVG9YS3NwTjZTci9FawpkanF4SEkyQVdyY1l4VGRsOHVZTndaN01JVWQ4b1IxMlNNemlYZ1MyYWJMb1BUMk94K1kyZHh5NjZHbUo2NFBUCkIxMnZISWJJLzNTNW5BVmlpT25YeWVkOFVkRVAyczBRYnlZNGJvUWxBa2Z3dUd6N01JVStTWE1vZjhkcklNNGkKRThWSldRRFk5VzdkTUF6ZWhoTUVaY0Q2MEJ4bWhWbHlqdEhGb1FJREFRQUJBb0lCQVFDUnhNdTNvNHBPemVBTQp3S2daYmk1M0ZHUklkRG5zRnNLV3ViVmI3dXB5U3o5cTlvY2V2a3oyYktrT0ErNzhEK0JoOXF4c2N4eW91TGNICmw5clA4c0l3UmtvajlWL2IyNEVQaUozeTRFc3JOWnhveXdOUnZUVGhnWHhFNWprSXQ0OUFjcGJZRHF0NTM1ZzkKc21DNHJxTnFHU2RtRGx5czVuSUxLQVFJUm9IeW52cWt6MHFZNi9lU1ZyKzN1dEVJMUZVMzlCTVp5UVhUUFJOZgpVNVdGTUlkblQ0Z3AvKzFQMmJ6SmVoWlBlY3QzUFdzaGxLaEJSL1VaTGVwS1lwVGkwbUZzYVBuMmNzNGRhS0dPClBHRnBMMEVJRmVhVU5QZWp0aHlkVk54SHNUNHJnR1pXS01jUmVnek1DVjdEODNrVm5TSUlFTXZuUGF6VjVtV1EKNDNyc2NZQUJBb0dCQU9xWlZjWi9Ea1drSW9vWFhDV2N1K0Z2MUhHcmd4a3hIQjBsYWROMmZtNFAxMlA0WmIyagprZjU2aGVTU2s1azZZYzZrRThJK0ZacDdvVXF5L202REwwM0VKeXB6MXBWTld1cEZQYVBiWFdsdnNwdW5BenY1Cms4bEdPbkhEcituVW5aZG1IWWlWVUtKWXdFQmxza0dIS3M2U0t2a1M3Wm92MmdKeWdld3RxZnhCQW9HQkFPSlAKU0ZHODVRTzEzdWJqY1BRRzdnNmdBVWFsZCtrek11VDR4ZTB5MXZjUUVvOWplVkdqSlRsL3FxaHlpam9KdnZ0bApVT09VL3QwNXBOUlRycFZuWnFRZExZWHlxL1AvbjFLS0dkL0pUM2NhRkE1VEJncHFlZDhGMlY5djV2VTlMWFpxCmZUZ29wRktyMVV4MkJzaWFSQUpvZHVxT2NBZ0t4R3F6dklRKzhQRmhBb0dCQU1sWExBeWR3dXYyQUVhdjRiL08KRWxsYWx1T3ZwV1liaGR0bDNydEQrU0lRcW5UOEhLVnpHcnRqQUVLNW9iOWlJY3N0ZWwrODFPR3V0VERkQ2d4aQp2bGhwdm90cXU0R0wwRGs3ajdsdmJXNHVGUVlOZ25NWXNjT09hRjUyNmlVdStzbVRORW1pakgrbzErYnM0TjNvCldjN01GK0dJWXk5dlhoVzNuTlhNSXhXQkFvR0JBTFNoblZLSVY2Nm5lbHVGakFGcWlwWW54Znp5VTR4UnJqeXUKQjZTMG9IbWdYWUFQWUtUMWQ5KzE4NnZ4aUR5Y3pNL3haU2ZSSTcvRm83ZEpkNTZPWXBGNUxIMnVYT3NxeTZyZwp5WmdpSVFncVMzbkhjSm5kdEpwN0c2NGVMaFR1R0p4Y2tNZkRRSzB2czljTW1ZdUIvZWlDSXZCQ2NrOG84TzlOCnVKbEJkNlRoQW9HQU9URUpCbVRXU1ZzejZ3YU1HdU1GVWt6UzdqcC91SEYwMVU1UTU5TldpM3Q1aWtpU09vWW8KcVl4eEFuZ2FPQUFnclpheGdBK1BzNDM1NDVOb0ErVE80cXRQYWhkOWt2c0R1Z1J5ejBtckRSZ0tJK1g1czBRSApDdjJIYWd5SzVrWUlvRElKMVVkOTB5enVTZ1didEUyYXVXN1FFTGZ2THNpekZzQzRLcXczQXU0PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=

clusters/cl01tl/manifests/cilium/Secret-hubble-server-certs.yml

@@ -0,0 +1,12 @@
+---
+# Source: cilium/charts/cilium/templates/hubble/tls-helm/server-secret.yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: hubble-server-certs
+  namespace: kube-system
+type: kubernetes.io/tls
+data:
+  ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURGRENDQWZ5Z0F3SUJBZ0lSQUt4RXV3NmVBRVN1YnY2OU44UUdaand3RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEkxTVRJd05EQTBORFkxTmxvWERUSTRNVEl3TXpBMApORFkxTmxvd0ZERVNNQkFHQTFVRUF4TUpRMmxzYVhWdElFTkJNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DCkFROEFNSUlCQ2dLQ0FRRUF4dnRHR3JjTTNDV1VNZTdMcWxKUkIrdlZwUjYwN21TUUw3ZUV2OTZOVXlqWERvVFQKUVlEcVkrYkJWQlF6MVJlRlQyN0k1MDE4cDRqQlNWd09ONkVyM3pUcEs5MEZrdWt5KzRTRnJjRWxONDJRODFkcAphZk9NOXVZc2J3NmZEbFFmbUs5R1dudnpxRjlEOFpoaHZ1ZDhBZDNtM28rL1pMV3hra1ViREh4bHM5d0I1aFJCClp3RlZsYlNHa1dWUEJseEtteXYxYXdQaTY0OWdxVkM2czJuNWRuT2FLUHVBR21rUklWbnBVbk9aVTlJRW9FUUkKaTlKcXJWSUVveVNFZGQvMXYvbVlCM2RvNG9jZkl6bDJRUUNQbytoMTJwZGdZRVB4cDRVdWVSbG0rZU9qT3hlVAorVFhXcktmMXp4TzRhSXQ1M3lvQ1FvNkNxdk5mdDlyNklia3czd0lEQVFBQm8yRXdYekFPQmdOVkhROEJBZjhFCkJBTUNBcVF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUYKTUFNQkFmOHdIUVlEVlIwT0JCWUVGTjhyanYrSjNWVDJhVFh3MHhYNDQ5RkFvN2FLTUEwR0NTcUdTSWIzRFFFQgpDd1VBQTRJQkFRQnJGUGxsaW9XVEdtMmRxZFczdk1HT2N2cm1CZ3pvOFgxUlAvcGxPZTdCdTdZeE84WlJKS0RRCk12dndjZDBGRW9VK2Uyang4QnR4KzAwU3FGY3JnMmtaYVZjVExWZXdiTXVBU2l3bHJlTEFCYjVDcWp1bjFhWUIKTHEwV1BLQ1lrM0g4K24xYXlTQlQzMUgzcDBFR0QyZWlIQmk5NWtMSWlKV3d1TWZEeFg0ek5JZ1VkVm40UHYxQgpUNXo5ZVAreCs1RGwrMm5XSSthTHQyVGxOd3BzRnRrdEpyTWNYYXYxZFRZTHBReVE5SHQyQTZtVjMxcXNTditLClpBSW1hZVJSeWVMQWhyN3J3Y0k5U2RoOTdwSy9HRVVYZWNaTkJXbjhNTmhiQ2hIVDFmZDdVVzV3RllEZzRUcFAKZVAvREg1VGZEVFBZam5VdTZ4UElGQ1liUUh2N2ROQTcKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURWakNDQWo2Z0F3SUJBZ0lRYVdoR2V5QWpZcHppSEN5R0JYVzlKVEFOQmdrcWhraUc5dzBCQVFzRkFEQVUKTVJJd0VBWURWUVFERXdsRGFXeHBkVzBnUTBFd0hoY05NalV4TWpBME1EUTBOalUyV2hjTk1qWXhNakEwTURRMApOalUyV2pBcU1TZ3dKZ1lEVlFRRERCOHFMbVJsWm1GMWJIUXVhSFZpWW14bExXZHljR011WTJsc2FYVnRMbWx2Ck1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBM1YwSmVkQm9tOGNYblJPQk5vc3kKTGZSVmhhd3VRWSt6RUVTZkhIS05NS1hwaTlmZ29lRE0zejVZdTV5SVFtYmxlc3VQYnhUWWlxZjFUbTJXajBxbwpZWEIxOFBvVnhKOWJvVjNnQitsai9FYjlLUFdZVHRxR2lpM3U5cUFnSDZrUkJuM3VyTGJHMWwrRDczM3NSSVVtCnEvZU9ldDhOKzlIa0V2cEZmeVNHaVc3dWJwNGdObW9yd0hWL2U2WmpWQ0VySUlpdEY0a2pobElSejBoVkRMTS8KTkh6SDhtWU92WlRmZEZwNTJIaUVvbmVTbzBSbldwcWRnR3B0NmlGdWRDTnhERTJaWmwyeFJvRTE3U2xsS2VNbQowclhhQUpscWtsd3dGRGxYd1V5T3F4MXY4WEJ6S3ZCeExQWm04WXhnK3BqUjJlUjZYMzZyUExUSm9uLzE1Tkx2CmlRSURBUUFCbzRHTk1JR0tNQTRHQTFVZER3RUIvd1FFQXdJRm9EQWRCZ05WSFNVRUZqQVVCZ2dyQmdFRkJRY0QKQVFZSUt3WUJCUVVIQXdJd0RBWURWUjBUQVFIL0JBSXdBREFmQmdOVkhTTUVHREFXZ0JUZks0Ny9pZDFVOW1rMQo4Tk1WK09QUlFLTzJpakFxQmdOVkhSRUVJekFoZ2g4cUxtUmxabUYxYkhRdWFIVmlZbXhsTFdkeWNHTXVZMmxzCmFYVnRMbWx2TUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFCL1h0dWRZTloyMXM0Z0FJcUpxbTA0bWRKTElzanQKcW9sV0RSWm9qOTdweFlkTU90bzlEQjEwTW5XMTN4OFVZbzlLYXNHVUxvdTFjaTUzSUlhcDRUKzdkcHkzd0doUgp3QWFBWGNPdXBwalIvOXZjWmlhdGlja3pqTlJFQ05oczRsdlEzRFRmeGNxZGZvbUxRMjhJMHBwSi9VUCt0eUVaCjFwQjZXNVZMbjh4dHpuUE1LblYrOFZRQm5oRVoxS0hhK3MyanJuMFp2ZzI2SEF1MkJRbHUxQWhGdnJDY0dOTGQKWlk4L1ZkYlY1NHIxQWlhdnB0S1RXUHppQTlQZXZGdkoxQkFURmIyTkh3VHBncytpeWZjUXhZOHRDRHNSVWFaNwpRV3BPY0l4UHVLMGVleFpHRHh6dnBZZThuanAwaDBIWjZmNE5rR3VhUVVFcDRzYjBPSW0xVmc4aAotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+  tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBM1YwSmVkQm9tOGNYblJPQk5vc3lMZlJWaGF3dVFZK3pFRVNmSEhLTk1LWHBpOWZnCm9lRE0zejVZdTV5SVFtYmxlc3VQYnhUWWlxZjFUbTJXajBxb1lYQjE4UG9WeEo5Ym9WM2dCK2xqL0ViOUtQV1kKVHRxR2lpM3U5cUFnSDZrUkJuM3VyTGJHMWwrRDczM3NSSVVtcS9lT2V0OE4rOUhrRXZwRmZ5U0dpVzd1YnA0ZwpObW9yd0hWL2U2WmpWQ0VySUlpdEY0a2pobElSejBoVkRMTS9OSHpIOG1ZT3ZaVGZkRnA1MkhpRW9uZVNvMFJuCldwcWRnR3B0NmlGdWRDTnhERTJaWmwyeFJvRTE3U2xsS2VNbTByWGFBSmxxa2x3d0ZEbFh3VXlPcXgxdjhYQnoKS3ZCeExQWm04WXhnK3BqUjJlUjZYMzZyUExUSm9uLzE1Tkx2aVFJREFRQUJBb0lCQUY3eGdaZnlzSHRvQ0JQQwpBdUN2RVNXdXIyTzI5dHY5MDFKOTdEU2FXVDV0V3Q4MUIwN0hDWGdTMktJWFFFWWl0ZmhXQ0w0ZkZjVmF4cGNOCjM4Nnp1Y2FaSXF6cHhwNWZyMEJsOENuVWk2THZtN09PcXZYZk9tZFh6aStQZkZlMy91cG01eERERUVOd0VqbU4KSytJenJlT0NPV1V2K0dKeW9yMFZCT3ZFY2NQTnVTSllMTXVuaXF3Zmw2ditOdmg2U0ZGYTZsUXByd2Z6bWE5Uwo2Vjl5ZjlmaE4wTWN4YTg2MFJ0L3F2YTNZTklRZ1Jub2dlekxBYmR3KzgxRFM4MWlCOXFNMGtNMlVMbW9wK01kCk4zVS9UYnhabEZHY0NXWHkrdXNaOUhHdU5NVURzVUxxOVZoVkpnazhhUmlyL3NtdUFCeE14SVdhc1Q3T0xoTTQKb1NLWGRkRUNnWUVBNDR4bW5Tc1RTYkV3cW54b3VmdEJaK3dVYlpWdTV4eEMyU2J6ZndMbmlHYXJ6WFRDbVQyRgpaUFVSSTlLUy85djJic1NjbzVXV3JxUzQxRkhVS2VEVDFVTTZydDBZbXpGSEJlUnZXdTZFQmw4Y2JKem1GcnRiCkZ1eG00b3ZxN0FQM3Z5SDFkZUdwSWNPR2h2T0hLcy91TXZXS2JkUXhHYWpKenZPbHQ3cG9SdzBDZ1lFQStRcW8KOWllQmFXRm4rR0lRK3gzQmI4MTNKLzMvM2tpVExEVmFwajFGbjRXaGFNS2VIN2V6dnVRVWhKcVpZRGt1a2lYRQovZTArVG80QVVDUTN6UmJYYzlFZVlsTlpTWHcvTEd1bzFMUVhwdXFhVjArM01yVU91N1o5b0dQWnZWem9tSDlMCi9paHNkTGl0TElNTkppaW4ycHRFRldTbU5BcE5HQ2ozbnIwVHEyMENnWUVBZ295cTBzRkQ3Nk9aS0RiNFhydW8KYXRjbllUZTZ5UjJOdk1oOEt3S2ZrOEpVRHl4TitWMHlpeG1QRzk1VU9EY2F5N0pCckJqR3Vxd0czc21Uei9NTgpsZTFjWGJhN3gwNGVVV01lQUMyWDBZLy8zdENsc2FVTVBicWp6Slk1MGU3MDFOUEc0RHIzcmtkZmgwMXczejhzCmlsQVZlNjJoL2ZhNDBlTTMwSkZDQW9FQ2dZQjRRbFNLNFZMVnIyckVmNTZSbExIWEtsR3k1eTNLaWlNL2d0Z3UKVklJdFlSc3JlbWRmQzVkcHc3dkF1T0w5bXo5STVhSTF1SDJRODNObFA4Z09ha3hLS2g1US9zeXI5cXFPNmNJUwpUSkRyVW5pTFZ2d3hLVXRmQytXb01POXhTTThzN0xPbW5LQ2EwSjhYVW9Wait0ZnJjWFMwRy9GQ1NnTW1lb253CmhuOWNGUUtCZ0ZnNkc1Yi95L1NuLzdwK09ZMVRvOWo1NFNVYmNlNDczcnRIMElHazZDNnFIR2ZGcFRBOGFnWVIKSlVRODRKMXJjN1ZuT2xjNDR3KzNUVmFid3drMDg0L25xcSt0QzZQUTVsOFNHYnBKeEZwZkVDTnlzREhJaDExaQpROXpwNVpxeTN6cmp3TUJ2R2x1UTJGWUd5K3RTQ0NUaUhYM3hKdDBFS21LSnI3RnVFZFRJCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==

clusters/cl01tl/manifests/cilium/Service-cilium-agent.yml

@@ -0,0 +1,21 @@
+---
+# Source: cilium/charts/cilium/templates/cilium-agent/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: cilium-agent
+  namespace: kube-system
+  labels:
+    k8s-app: cilium
+    app.kubernetes.io/name: cilium-agent
+    app.kubernetes.io/part-of: cilium
+spec:
+  clusterIP: None
+  type: ClusterIP
+  selector:
+    k8s-app: cilium
+  ports:
+    - name: metrics
+      port: 9962
+      protocol: TCP
+      targetPort: prometheus

clusters/cl01tl/manifests/cilium/Service-cilium-envoy.yml

@@ -0,0 +1,22 @@
+---
+# Source: cilium/charts/cilium/templates/cilium-envoy/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: cilium-envoy
+  namespace: kube-system
+  labels:
+    k8s-app: cilium-envoy
+    app.kubernetes.io/name: cilium-envoy
+    app.kubernetes.io/part-of: cilium
+    io.cilium/app: proxy
+spec:
+  clusterIP: None
+  type: ClusterIP
+  selector:
+    k8s-app: cilium-envoy
+  ports:
+    - name: envoy-metrics
+      port: 9964
+      protocol: TCP
+      targetPort: envoy-metrics

clusters/cl01tl/manifests/cilium/Service-cilium-operator.yml

@@ -0,0 +1,23 @@
+---
+# Source: cilium/charts/cilium/templates/cilium-operator/service.yaml
+kind: Service
+apiVersion: v1
+metadata:
+  name: cilium-operator
+  namespace: kube-system
+  labels:
+    io.cilium/app: operator
+    name: cilium-operator
+    app.kubernetes.io/part-of: cilium
+    app.kubernetes.io/name: cilium-operator
+spec:
+  clusterIP: None
+  type: ClusterIP
+  ports:
+    - name: metrics
+      port: 9963
+      protocol: TCP
+      targetPort: prometheus
+  selector:
+    io.cilium/app: operator
+    name: cilium-operator

clusters/cl01tl/manifests/cilium/Service-hubble-peer.yml

@@ -0,0 +1,20 @@
+---
+# Source: cilium/charts/cilium/templates/hubble/peer-service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: hubble-peer
+  namespace: kube-system
+  labels:
+    k8s-app: cilium
+    app.kubernetes.io/part-of: cilium
+    app.kubernetes.io/name: hubble-peer
+spec:
+  selector:
+    k8s-app: cilium
+  ports:
+    - name: peer-service
+      port: 443
+      protocol: TCP
+      targetPort: 4244
+  internalTrafficPolicy: Local

clusters/cl01tl/manifests/cilium/Service-hubble-relay.yml

@@ -0,0 +1,20 @@
+---
+# Source: cilium/charts/cilium/templates/hubble-relay/service.yaml
+kind: Service
+apiVersion: v1
+metadata:
+  name: hubble-relay
+  namespace: kube-system
+  annotations:
+  labels:
+    k8s-app: hubble-relay
+    app.kubernetes.io/name: hubble-relay
+    app.kubernetes.io/part-of: cilium
+spec:
+  type: "ClusterIP"
+  selector:
+    k8s-app: hubble-relay
+  ports:
+    - protocol: TCP
+      port: 80
+      targetPort: grpc

clusters/cl01tl/manifests/cilium/Service-hubble-ui.yml

@@ -0,0 +1,19 @@
+---
+# Source: cilium/charts/cilium/templates/hubble-ui/service.yaml
+kind: Service
+apiVersion: v1
+metadata:
+  name: hubble-ui
+  namespace: kube-system
+  labels:
+    k8s-app: hubble-ui
+    app.kubernetes.io/name: hubble-ui
+    app.kubernetes.io/part-of: cilium
+spec:
+  type: "ClusterIP"
+  selector:
+    k8s-app: hubble-ui
+  ports:
+    - name: http
+      port: 80
+      targetPort: 8081

clusters/cl01tl/manifests/cilium/ServiceAccount-cilium-envoy.yml

@@ -0,0 +1,7 @@
+---
+# Source: cilium/charts/cilium/templates/cilium-envoy/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: "cilium-envoy"
+  namespace: kube-system

clusters/cl01tl/manifests/cilium/ServiceAccount-cilium-operator.yml

@@ -0,0 +1,7 @@
+---
+# Source: cilium/charts/cilium/templates/cilium-operator/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: "cilium-operator"
+  namespace: kube-system

clusters/cl01tl/manifests/cilium/ServiceAccount-cilium.yml

@@ -0,0 +1,7 @@
+---
+# Source: cilium/charts/cilium/templates/cilium-agent/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: "cilium"
+  namespace: kube-system

clusters/cl01tl/manifests/cilium/ServiceAccount-hubble-relay.yml

@@ -0,0 +1,8 @@
+---
+# Source: cilium/charts/cilium/templates/hubble-relay/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: "hubble-relay"
+  namespace: kube-system
+automountServiceAccountToken: false

clusters/cl01tl/manifests/cilium/ServiceAccount-hubble-ui.yml

@@ -0,0 +1,7 @@
+---
+# Source: cilium/charts/cilium/templates/hubble-ui/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: "hubble-ui"
+  namespace: kube-system

clusters/cl01tl/manifests/cilium/ServiceMonitor-cilium-agent.yml

@@ -0,0 +1,32 @@
+---
+# Source: cilium/charts/cilium/templates/cilium-agent/servicemonitor.yaml
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: cilium-agent
+  namespace: kube-system
+  labels:
+    app.kubernetes.io/part-of: cilium
+    app.kubernetes.io/name: cilium-agent
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: cilium-agent
+  namespaceSelector:
+    matchNames:
+      - kube-system
+  endpoints:
+    - port: metrics
+      interval: "10s"
+      honorLabels: true
+      path: /metrics
+      relabelings:
+        - action: replace
+          replacement: ${1}
+          sourceLabels:
+            - __meta_kubernetes_pod_node_name
+          targetLabel: node
+  # If envoy DaemonSet is enabled, we'll create a separate service for it
+  # If it is not enabled, that means envoy runs inside cilium-agent and we'll monitor using same service
+  targetLabels:
+    - k8s-app

clusters/cl01tl/manifests/cilium/ServiceMonitor-cilium-envoy.yml

@@ -0,0 +1,30 @@
+---
+# Source: cilium/charts/cilium/templates/cilium-envoy/servicemonitor.yaml
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: cilium-envoy
+  namespace: kube-system
+  labels:
+    app.kubernetes.io/part-of: cilium
+    app.kubernetes.io/name: cilium-envoy
+spec:
+  selector:
+    matchLabels:
+      k8s-app: cilium-envoy
+  namespaceSelector:
+    matchNames:
+      - kube-system
+  endpoints:
+    - port: envoy-metrics
+      interval: "10s"
+      honorLabels: true
+      path: /metrics
+      relabelings:
+        - action: replace
+          replacement: ${1}
+          sourceLabels:
+            - __meta_kubernetes_pod_node_name
+          targetLabel: node
+  targetLabels:
+    - k8s-app

clusters/cl01tl/manifests/cilium/ServiceMonitor-cilium-operator.yml

@@ -0,0 +1,25 @@
+---
+# Source: cilium/charts/cilium/templates/cilium-operator/servicemonitor.yaml
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: cilium-operator
+  namespace: kube-system
+  labels:
+    app.kubernetes.io/part-of: cilium
+    app.kubernetes.io/name: cilium-operator
+spec:
+  selector:
+    matchLabels:
+      io.cilium/app: operator
+      name: cilium-operator
+  namespaceSelector:
+    matchNames:
+      - kube-system
+  endpoints:
+    - port: metrics
+      interval: "10s"
+      honorLabels: true
+      path: /metrics
+  targetLabels:
+    - io.cilium/app