apiVersion: cilium.io/v2
kind: CiliumLoadBalancerIPPool
metadata:
  name: bgp-ip-pool
  namespace: kube-system
  labels:
    app.kubernetes.io/name: bgp-ip-pool
    app.kubernetes.io/instance: cilium
    app.kubernetes.io/part-of: cilium
spec:
  blocks:
    - start: "10.232.2.100"
      stop: "10.232.2.200"
  disabled: true
---
apiVersion: cilium.io/v2
kind: CiliumLoadBalancerIPPool
metadata:
  name: default-ip-pool
  namespace: kube-system
  labels:
    app.kubernetes.io/name: default-ip-pool
    app.kubernetes.io/instance: cilium
    app.kubernetes.io/part-of: cilium
spec:
  blocks:
    - start: "10.232.1.21"
      stop: "10.232.1.23"
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cilium-operator
  labels:
    app.kubernetes.io/part-of: cilium
rules:
  - apiGroups:
      - ""
    resources:
      - pods
    verbs:
      - get
      - list
      - watch
      - delete
  - apiGroups:
      - ""
    resources:
      - configmaps
    resourceNames:
      - cilium-config
    verbs:
      - patch
  - apiGroups:
      - ""
    resources:
      - nodes
    verbs:
      - list
      - watch
  - apiGroups:
      - ""
    resources:
      - nodes
      - nodes/status
    verbs:
      - patch
  - apiGroups:
      - discovery.k8s.io
    resources:
      - endpointslices
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - ""
    resources:
      - services/status
    verbs:
      - update
      - patch
  - apiGroups:
      - ""
    resources:
      - namespaces
      - secrets
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - ""
    resources:
      - services
      - endpoints
    verbs:
      - get
      - list
      - watch
      - create
      - update
      - delete
      - patch
  - apiGroups:
      - cilium.io
    resources:
      - ciliumnetworkpolicies
      - ciliumclusterwidenetworkpolicies
    verbs:
      - create
      - update
      - deletecollection
      - patch
      - get
      - list
      - watch
  - apiGroups:
      - cilium.io
    resources:
      - ciliumnetworkpolicies/status
      - ciliumclusterwidenetworkpolicies/status
    verbs:
      - patch
      - update
  - apiGroups:
      - cilium.io
    resources:
      - ciliumendpoints
      - ciliumidentities
    verbs:
      - delete
      - list
      - watch
  - apiGroups:
      - cilium.io
    resources:
      - ciliumidentities
    verbs:
      - update
  - apiGroups:
      - cilium.io
    resources:
      - ciliumnodes
    verbs:
      - create
      - update
      - get
      - list
      - watch
      - delete
  - apiGroups:
      - cilium.io
    resources:
      - ciliumnodes/status
    verbs:
      - update
  - apiGroups:
      - cilium.io
    resources:
      - ciliumendpointslices
      - ciliumenvoyconfigs
      - ciliumbgppeerconfigs
      - ciliumbgpadvertisements
      - ciliumbgpnodeconfigs
    verbs:
      - create
      - update
      - get
      - list
      - watch
      - delete
      - patch
  - apiGroups:
      - cilium.io
    resources:
      - ciliumbgpclusterconfigs/status
      - ciliumbgppeerconfigs/status
    verbs:
      - update
  - apiGroups:
      - apiextensions.k8s.io
    resources:
      - customresourcedefinitions
    verbs:
      - create
      - get
      - list
      - watch
  - apiGroups:
      - apiextensions.k8s.io
    resources:
      - customresourcedefinitions
    verbs:
      - update
    resourceNames:
      - ciliumloadbalancerippools.cilium.io
      - ciliumbgppeeringpolicies.cilium.io
      - ciliumbgpclusterconfigs.cilium.io
      - ciliumbgppeerconfigs.cilium.io
      - ciliumbgpadvertisements.cilium.io
      - ciliumbgpnodeconfigs.cilium.io
      - ciliumbgpnodeconfigoverrides.cilium.io
      - ciliumclusterwideenvoyconfigs.cilium.io
      - ciliumclusterwidenetworkpolicies.cilium.io
      - ciliumegressgatewaypolicies.cilium.io
      - ciliumendpoints.cilium.io
      - ciliumendpointslices.cilium.io
      - ciliumenvoyconfigs.cilium.io
      - ciliumidentities.cilium.io
      - ciliumlocalredirectpolicies.cilium.io
      - ciliumnetworkpolicies.cilium.io
      - ciliumnodes.cilium.io
      - ciliumnodeconfigs.cilium.io
      - ciliumcidrgroups.cilium.io
      - ciliuml2announcementpolicies.cilium.io
      - ciliumpodippools.cilium.io
      - ciliumgatewayclassconfigs.cilium.io
  - apiGroups:
      - cilium.io
    resources:
      - ciliumloadbalancerippools
      - ciliumpodippools
      - ciliumbgppeeringpolicies
      - ciliumbgpclusterconfigs
      - ciliumbgpnodeconfigoverrides
      - ciliumbgppeerconfigs
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - cilium.io
    resources:
      - ciliumpodippools
    verbs:
      - create
  - apiGroups:
      - cilium.io
    resources:
      - ciliumloadbalancerippools/status
    verbs:
      - patch
  - apiGroups:
      - coordination.k8s.io
    resources:
      - leases
    verbs:
      - create
      - get
      - update
  - apiGroups:
      - gateway.networking.k8s.io
    resources:
      - gatewayclasses
      - gateways
      - tlsroutes
      - httproutes
      - grpcroutes
      - referencegrants
      - referencepolicies
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - gateway.networking.k8s.io
    resources:
      - gatewayclasses
    verbs:
      - patch
  - apiGroups:
      - gateway.networking.k8s.io
    resources:
      - gatewayclasses/status
      - gateways/status
      - httproutes/status
      - grpcroutes/status
      - tlsroutes/status
    verbs:
      - update
      - patch
  - apiGroups:
      - cilium.io
    resources:
      - ciliumgatewayclassconfigs
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - cilium.io
    resources:
      - ciliumgatewayclassconfigs/status
    verbs:
      - update
      - patch
  - apiGroups:
      - multicluster.x-k8s.io
    resources:
      - serviceimports
    verbs:
      - get
      - list
      - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cilium
  labels:
    app.kubernetes.io/part-of: cilium
rules:
  - apiGroups:
      - networking.k8s.io
    resources:
      - networkpolicies
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - discovery.k8s.io
    resources:
      - endpointslices
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - ""
    resources:
      - namespaces
      - services
      - pods
      - endpoints
      - nodes
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - apiextensions.k8s.io
    resources:
      - customresourcedefinitions
    verbs:
      - list
      - watch
      - get
  - apiGroups:
      - cilium.io
    resources:
      - ciliumloadbalancerippools
      - ciliumbgppeeringpolicies
      - ciliumbgpnodeconfigs
      - ciliumbgpadvertisements
      - ciliumbgppeerconfigs
      - ciliumclusterwideenvoyconfigs
      - ciliumclusterwidenetworkpolicies
      - ciliumegressgatewaypolicies
      - ciliumendpoints
      - ciliumendpointslices
      - ciliumenvoyconfigs
      - ciliumidentities
      - ciliumlocalredirectpolicies
      - ciliumnetworkpolicies
      - ciliumnodes
      - ciliumnodeconfigs
      - ciliumcidrgroups
      - ciliuml2announcementpolicies
      - ciliumpodippools
    verbs:
      - list
      - watch
  - apiGroups:
      - cilium.io
    resources:
      - ciliumidentities
      - ciliumendpoints
      - ciliumnodes
    verbs:
      - create
  - apiGroups:
      - cilium.io
    resources:
      - ciliumidentities
    verbs:
      - update
  - apiGroups:
      - cilium.io
    resources:
      - ciliumendpoints
    verbs:
      - delete
      - get
  - apiGroups:
      - cilium.io
    resources:
      - ciliumnodes
      - ciliumnodes/status
    verbs:
      - get
      - update
  - apiGroups:
      - cilium.io
    resources:
      - ciliumendpoints/status
      - ciliumendpoints
      - ciliuml2announcementpolicies/status
      - ciliumbgpnodeconfigs/status
    verbs:
      - patch
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: hubble-ui
  labels:
    app.kubernetes.io/part-of: cilium
rules:
  - apiGroups:
      - networking.k8s.io
    resources:
      - networkpolicies
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - ""
    resources:
      - componentstatuses
      - endpoints
      - namespaces
      - nodes
      - pods
      - services
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - apiextensions.k8s.io
    resources:
      - customresourcedefinitions
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - cilium.io
    resources:
      - "*"
    verbs:
      - get
      - list
      - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cilium-operator
  labels:
    app.kubernetes.io/part-of: cilium
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cilium-operator
subjects:
  - kind: ServiceAccount
    name: "cilium-operator"
    namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cilium
  labels:
    app.kubernetes.io/part-of: cilium
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cilium
subjects:
  - kind: ServiceAccount
    name: "cilium"
    namespace: kube-system
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: hubble-ui
  labels:
    app.kubernetes.io/part-of: cilium
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: hubble-ui
subjects:
  - kind: ServiceAccount
    name: "hubble-ui"
    namespace: kube-system
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: cilium-config
  namespace: kube-system
data:
  identity-allocation-mode: crd
  identity-heartbeat-timeout: "30m0s"
  identity-gc-interval: "15m0s"
  cilium-endpoint-gc-interval: "5m0s"
  nodes-gc-interval: "5m0s"
  debug: "false"
  metrics-sampling-interval: "5m"
  enable-policy: "default"
  prometheus-serve-addr: ":9962"
  controller-group-metrics: write-cni-file sync-host-ips sync-lb-maps-with-k8s-services
  operator-prometheus-serve-addr: ":9963"
  enable-metrics: "true"
  enable-envoy-config: "true"
  envoy-config-retry-interval: "15s"
  enable-gateway-api: "true"
  enable-gateway-api-secrets-sync: "true"
  enable-gateway-api-proxy-protocol: "false"
  enable-gateway-api-app-protocol: "true"
  enable-gateway-api-alpn: "true"
  gateway-api-xff-num-trusted-hops: "0"
  gateway-api-service-externaltrafficpolicy: "Cluster"
  gateway-api-secrets-namespace: "cilium-secrets"
  gateway-api-hostnetwork-enabled: "false"
  gateway-api-hostnetwork-nodelabelselector: ""
  enable-policy-secrets-sync: "true"
  policy-secrets-only-from-secrets-namespace: "true"
  policy-secrets-namespace: "cilium-secrets"
  enable-ipv4: "true"
  enable-ipv6: "false"
  custom-cni-conf: "false"
  enable-bpf-clock-probe: "false"
  monitor-aggregation: medium
  monitor-aggregation-interval: "5s"
  monitor-aggregation-flags: all
  bpf-map-dynamic-size-ratio: "0.0025"
  enable-host-legacy-routing: "true"
  bpf-policy-map-max: "16384"
  bpf-policy-stats-map-max: "65536"
  bpf-lb-map-max: "65536"
  bpf-lb-external-clusterip: "false"
  bpf-lb-source-range-all-types: "false"
  bpf-lb-algorithm-annotation: "false"
  bpf-lb-mode-annotation: "false"
  bpf-distributed-lru: "false"
  bpf-events-drop-enabled: "true"
  bpf-events-policy-verdict-enabled: "true"
  bpf-events-trace-enabled: "true"
  preallocate-bpf-maps: "false"
  cluster-name: "default"
  cluster-id: "0"
  routing-mode: "tunnel"
  tunnel-protocol: "vxlan"
  tunnel-source-port-range: "0-0"
  service-no-backend-response: "reject"
  enable-l7-proxy: "true"
  enable-ipv4-masquerade: "true"
  enable-ipv4-big-tcp: "false"
  enable-ipv6-big-tcp: "false"
  enable-ipv6-masquerade: "true"
  enable-tcx: "true"
  datapath-mode: "veth"
  enable-masquerade-to-route-source: "false"
  enable-xt-socket-fallback: "true"
  install-no-conntrack-iptables-rules: "false"
  iptables-random-fully: "false"
  auto-direct-node-routes: "false"
  direct-routing-skip-unreachable: "false"
  devices: "end0 enp6s0"
  kube-proxy-replacement: "true"
  kube-proxy-replacement-healthz-bind-address: ""
  bpf-lb-sock: "true"
  bpf-lb-sock-hostns-only: "true"
  enable-health-check-nodeport: "true"
  enable-health-check-loadbalancer-ip: "false"
  node-port-bind-protection: "true"
  enable-auto-protect-node-port-range: "true"
  bpf-lb-acceleration: "disabled"
  enable-svc-source-range-check: "true"
  enable-l2-neigh-discovery: "false"
  k8s-require-ipv4-pod-cidr: "false"
  k8s-require-ipv6-pod-cidr: "false"
  enable-k8s-networkpolicy: "true"
  enable-endpoint-lockdown-on-policy-overflow: "false"
  write-cni-conf-when-ready: /host/etc/cni/net.d/05-cilium.conflist
  cni-exclusive: "true"
  cni-log-file: "/var/run/cilium/cilium-cni.log"
  enable-endpoint-health-checking: "true"
  enable-health-checking: "true"
  health-check-icmp-failure-threshold: "3"
  enable-well-known-identities: "false"
  enable-node-selector-labels: "false"
  synchronize-k8s-nodes: "true"
  operator-api-serve-addr: "127.0.0.1:9234"
  enable-hubble: "true"
  hubble-socket-path: "/var/run/cilium/hubble.sock"
  hubble-network-policy-correlation-enabled: "true"
  hubble-listen-address: ":4244"
  hubble-disable-tls: "false"
  hubble-tls-cert-file: /var/lib/cilium/tls/hubble/server.crt
  hubble-tls-key-file: /var/lib/cilium/tls/hubble/server.key
  hubble-tls-client-ca-files: /var/lib/cilium/tls/hubble/client-ca.crt
  ipam: "kubernetes"
  ipam-cilium-node-update-rate: "15s"
  default-lb-service-ipam: "lbipam"
  egress-gateway-reconciliation-trigger-interval: "1s"
  enable-vtep: "false"
  vtep-endpoint: ""
  vtep-cidr: ""
  vtep-mask: ""
  vtep-mac: ""
  procfs: "/host/proc"
  bpf-root: "/sys/fs/bpf"
  cgroup-root: "/sys/fs/cgroup"
  enable-cilium-endpoint-slice: "true"
  ces-rate-limits: "[{\"burst\":20,\"limit\":10,\"nodes\":0},{\"burst\":100,\"limit\":50,\"nodes\":100}]"
  identity-management-mode: "agent"
  enable-sctp: "false"
  k8s-client-qps: "50"
  k8s-client-burst: "100"
  remove-cilium-node-taints: "true"
  set-cilium-node-taints: "true"
  set-cilium-is-up-condition: "true"
  unmanaged-pod-watcher-interval: "15"
  dnsproxy-enable-transparent-mode: "true"
  dnsproxy-socket-linger-timeout: "10"
  tofqdns-dns-reject-response-code: "refused"
  tofqdns-enable-dns-compression: "true"
  tofqdns-endpoint-max-ip-per-hostname: "1000"
  tofqdns-idle-connection-grace-period: "0s"
  tofqdns-max-deferred-connection-deletes: "10000"
  tofqdns-proxy-response-max-delay: "100ms"
  tofqdns-preallocate-identities: "true"
  agent-not-ready-taint-key: "node.cilium.io/agent-not-ready"
  mesh-auth-enabled: "true"
  mesh-auth-queue-size: "1024"
  mesh-auth-rotated-identities-queue-size: "1024"
  mesh-auth-gc-interval: "5m0s"
  proxy-xff-num-trusted-hops-ingress: "0"
  proxy-xff-num-trusted-hops-egress: "0"
  proxy-connect-timeout: "2"
  proxy-initial-fetch-timeout: "30"
  proxy-max-requests-per-connection: "0"
  proxy-max-connection-duration-seconds: "0"
  proxy-idle-timeout-seconds: "60"
  proxy-max-concurrent-retries: "128"
  http-retry-count: "3"
  http-stream-idle-timeout: "300"
  external-envoy-proxy: "true"
  envoy-base-id: "0"
  envoy-access-log-buffer-size: "4096"
  envoy-keep-cap-netbindservice: "true"
  max-connected-clusters: "255"
  clustermesh-enable-endpoint-sync: "false"
  clustermesh-enable-mcs-api: "false"
  policy-default-local-cluster: "false"
  nat-map-stats-entries: "32"
  nat-map-stats-interval: "30s"
  enable-internal-traffic-policy: "true"
  enable-lb-ipam: "true"
  enable-non-default-deny-policies: "true"
  enable-source-ip-verification: "true"
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: cilium-envoy-config
  namespace: kube-system
data:
  bootstrap-config.json: |
    {"admin":{"address":{"pipe":{"path":"/var/run/cilium/envoy/sockets/admin.sock"}}},"applicationLogConfig":{"logFormat":{"textFormat":"[%Y-%m-%d %T.%e][%t][%l][%n] [%g:%#] %v"}},"bootstrapExtensions":[{"name":"envoy.bootstrap.internal_listener","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.bootstrap.internal_listener.v3.InternalListener"}}],"dynamicResources":{"cdsConfig":{"apiConfigSource":{"apiType":"GRPC","grpcServices":[{"envoyGrpc":{"clusterName":"xds-grpc-cilium"}}],"setNodeOnFirstMessageOnly":true,"transportApiVersion":"V3"},"initialFetchTimeout":"30s","resourceApiVersion":"V3"},"ldsConfig":{"apiConfigSource":{"apiType":"GRPC","grpcServices":[{"envoyGrpc":{"clusterName":"xds-grpc-cilium"}}],"setNodeOnFirstMessageOnly":true,"transportApiVersion":"V3"},"initialFetchTimeout":"30s","resourceApiVersion":"V3"}},"node":{"cluster":"ingress-cluster","id":"host~127.0.0.1~no-id~localdomain"},"overloadManager":{"resourceMonitors":[{"name":"envoy.resource_monitors.global_downstream_max_connections","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig","max_active_downstream_connections":"50000"}}]},"staticResources":{"clusters":[{"circuitBreakers":{"thresholds":[{"maxRetries":128}]},"cleanupInterval":"2.500s","connectTimeout":"2s","lbPolicy":"CLUSTER_PROVIDED","name":"ingress-cluster","type":"ORIGINAL_DST","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","commonHttpProtocolOptions":{"idleTimeout":"60s","maxConnectionDuration":"0s","maxRequestsPerConnection":0},"useDownstreamProtocolConfig":{}}}},{"circuitBreakers":{"thresholds":[{"maxRetries":128}]},"cleanupInterval":"2.500s","connectTimeout":"2s","lbPolicy":"CLUSTER_PROVIDED","name":"egress-cluster-tls","transportSocket":{"name":"cilium.tls_wrapper","typedConfig":{"@type":"type.googleapis.com/cilium.UpstreamTlsWrapperContext"}},"type":"ORIGINAL_DST","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","commonHttpProtocolOptions":{"idleTimeout":"60s","maxConnectionDuration":"0s","maxRequestsPerConnection":0},"upstreamHttpProtocolOptions":{},"useDownstreamProtocolConfig":{}}}},{"circuitBreakers":{"thresholds":[{"maxRetries":128}]},"cleanupInterval":"2.500s","connectTimeout":"2s","lbPolicy":"CLUSTER_PROVIDED","name":"egress-cluster","type":"ORIGINAL_DST","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","commonHttpProtocolOptions":{"idleTimeout":"60s","maxConnectionDuration":"0s","maxRequestsPerConnection":0},"useDownstreamProtocolConfig":{}}}},{"circuitBreakers":{"thresholds":[{"maxRetries":128}]},"cleanupInterval":"2.500s","connectTimeout":"2s","lbPolicy":"CLUSTER_PROVIDED","name":"ingress-cluster-tls","transportSocket":{"name":"cilium.tls_wrapper","typedConfig":{"@type":"type.googleapis.com/cilium.UpstreamTlsWrapperContext"}},"type":"ORIGINAL_DST","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","commonHttpProtocolOptions":{"idleTimeout":"60s","maxConnectionDuration":"0s","maxRequestsPerConnection":0},"upstreamHttpProtocolOptions":{},"useDownstreamProtocolConfig":{}}}},{"connectTimeout":"2s","loadAssignment":{"clusterName":"xds-grpc-cilium","endpoints":[{"lbEndpoints":[{"endpoint":{"address":{"pipe":{"path":"/var/run/cilium/envoy/sockets/xds.sock"}}}}]}]},"name":"xds-grpc-cilium","type":"STATIC","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","explicitHttpConfig":{"http2ProtocolOptions":{}}}}},{"connectTimeout":"2s","loadAssignment":{"clusterName":"/envoy-admin","endpoints":[{"lbEndpoints":[{"endpoint":{"address":{"pipe":{"path":"/var/run/cilium/envoy/sockets/admin.sock"}}}}]}]},"name":"/envoy-admin","type":"STATIC"}],"listeners":[{"address":{"socketAddress":{"address":"0.0.0.0","portValue":9964}},"filterChains":[{"filters":[{"name":"envoy.filters.network.http_connection_manager","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager","httpFilters":[{"name":"envoy.filters.http.router","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"}}],"internalAddressConfig":{"cidrRanges":[{"addressPrefix":"10.0.0.0","prefixLen":8},{"addressPrefix":"172.16.0.0","prefixLen":12},{"addressPrefix":"192.168.0.0","prefixLen":16},{"addressPrefix":"127.0.0.1","prefixLen":32}]},"routeConfig":{"virtualHosts":[{"domains":["*"],"name":"prometheus_metrics_route","routes":[{"match":{"prefix":"/metrics"},"name":"prometheus_metrics_route","route":{"cluster":"/envoy-admin","prefixRewrite":"/stats/prometheus"}}]}]},"statPrefix":"envoy-prometheus-metrics-listener","streamIdleTimeout":"300s"}}]}],"name":"envoy-prometheus-metrics-listener"},{"address":{"socketAddress":{"address":"127.0.0.1","portValue":9878}},"filterChains":[{"filters":[{"name":"envoy.filters.network.http_connection_manager","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager","httpFilters":[{"name":"envoy.filters.http.router","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"}}],"internalAddressConfig":{"cidrRanges":[{"addressPrefix":"10.0.0.0","prefixLen":8},{"addressPrefix":"172.16.0.0","prefixLen":12},{"addressPrefix":"192.168.0.0","prefixLen":16},{"addressPrefix":"127.0.0.1","prefixLen":32}]},"routeConfig":{"virtual_hosts":[{"domains":["*"],"name":"health","routes":[{"match":{"prefix":"/healthz"},"name":"health","route":{"cluster":"/envoy-admin","prefixRewrite":"/ready"}}]}]},"statPrefix":"envoy-health-listener","streamIdleTimeout":"300s"}}]}],"name":"envoy-health-listener"}]}}
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: hubble-relay-config
  namespace: kube-system
data:
  config.yaml: "cluster-name: default\npeer-service: \"hubble-peer.kube-system.svc.cluster.local.:443\"\nlisten-address: :4245\ngops: true\ngops-port: \"9893\"\nretry-timeout: \nsort-buffer-len-max: \nsort-buffer-drain-timeout: \ntls-hubble-client-cert-file: /var/lib/hubble-relay/tls/client.crt\ntls-hubble-client-key-file: /var/lib/hubble-relay/tls/client.key\ntls-hubble-server-ca-files: /var/lib/hubble-relay/tls/hubble-server-ca.crt\n\ndisable-server-tls: true\n"
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: hubble-ui-nginx
  namespace: kube-system
data:
  nginx.conf: "server {\n    listen       8081;\n    listen       [::]:8081;\n    server_name  localhost;\n    root /app;\n    index index.html;\n    client_max_body_size 1G;\n\n    location / {\n        proxy_set_header Host $host;\n        proxy_set_header X-Real-IP $remote_addr;\n\n        location /api {\n            proxy_http_version 1.1;\n            proxy_pass_request_headers on;\n            proxy_pass http://127.0.0.1:8090;\n        }\n        location / {\n            if ($http_user_agent ~* \"kube-probe\") { access_log off; }\n            # double `/index.html` is required here\n            try_files $uri $uri/ /index.html /index.html;\n        }\n\n        # Liveness probe\n        location /healthz {\n            access_log off;\n            add_header Content-Type text/plain;\n            return 200 'ok';\n        }\n    }\n}"
---
apiVersion: batch/v1
kind: CronJob
metadata:
  name: hubble-generate-certs
  namespace: kube-system
  labels:
    k8s-app: hubble-generate-certs
    app.kubernetes.io/name: hubble-generate-certs
    app.kubernetes.io/part-of: cilium
spec:
  schedule: "0 0 1 */4 *"
  concurrencyPolicy: Forbid
  jobTemplate:
    spec:
      template:
        metadata:
          labels:
            k8s-app: hubble-generate-certs
        spec:
          securityContext:
            seccompProfile:
              type: RuntimeDefault
          containers:
            - name: certgen
              image: "quay.io/cilium/certgen:v0.3.1@sha256:2825dbfa6f89cbed882fd1d81e46a56c087e35885825139923aa29eb8aec47a9"
              imagePullPolicy: IfNotPresent
              securityContext:
                capabilities:
                  drop:
                    - ALL
                allowPrivilegeEscalation: false
              command:
                - "/usr/bin/cilium-certgen"
              args:
                - "--ca-generate=true"
                - "--ca-reuse-secret"
                - "--ca-secret-namespace=kube-system"
                - "--ca-secret-name=cilium-ca"
                - "--ca-common-name=Cilium CA"
              env:
                - name: CILIUM_CERTGEN_CONFIG
                  value: |
                    certs:
                    - name: hubble-server-certs
                      namespace: kube-system
                      commonName: "*.default.hubble-grpc.cilium.io"
                      hosts:
                      - "*.default.hubble-grpc.cilium.io"
                      usage:
                      - signing
                      - key encipherment
                      - server auth
                      - client auth
                      validity: 8760h
                    - name: hubble-relay-client-certs
                      namespace: kube-system
                      commonName: "*.hubble-relay.cilium.io"
                      hosts:
                      - "*.hubble-relay.cilium.io"
                      usage:
                      - signing
                      - key encipherment
                      - client auth
                      validity: 8760h
          hostNetwork: false
          serviceAccount: "hubble-generate-certs"
          serviceAccountName: "hubble-generate-certs"
          automountServiceAccountToken: true
          restartPolicy: OnFailure
          affinity:
      ttlSecondsAfterFinished: 1800
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: cilium-envoy
  namespace: kube-system
  labels:
    k8s-app: cilium-envoy
    app.kubernetes.io/part-of: cilium
    app.kubernetes.io/name: cilium-envoy
    name: cilium-envoy
spec:
  selector:
    matchLabels:
      k8s-app: cilium-envoy
  updateStrategy:
    rollingUpdate:
      maxUnavailable: 2
    type: RollingUpdate
  template:
    metadata:
      annotations:
      labels:
        k8s-app: cilium-envoy
        name: cilium-envoy
        app.kubernetes.io/name: cilium-envoy
        app.kubernetes.io/part-of: cilium
    spec:
      securityContext:
        appArmorProfile:
          type: Unconfined
      containers:
        - name: cilium-envoy
          image: "quay.io/cilium/cilium-envoy:v1.35.9-1767794330-db497dd19e346b39d81d7b5c0dedf6c812bcc5c9@sha256:81398e449f2d3d0a6a70527e4f641aaa685d3156bea0bb30712fae3fd8822b86"
          imagePullPolicy: IfNotPresent
          command:
            - /usr/bin/cilium-envoy-starter
          args:
            - '--keep-cap-net-bind-service'
            - '--'
            - '-c /var/run/cilium/envoy/bootstrap-config.json'
            - '--base-id 0'
            - '--log-level info'
          startupProbe:
            httpGet:
              host: "127.0.0.1"
              path: /healthz
              port: 9878
              scheme: HTTP
            failureThreshold: 105
            periodSeconds: 2
            successThreshold: 1
            initialDelaySeconds: 5
          livenessProbe:
            httpGet:
              host: "127.0.0.1"
              path: /healthz
              port: 9878
              scheme: HTTP
            periodSeconds: 30
            successThreshold: 1
            failureThreshold: 10
            timeoutSeconds: 5
          readinessProbe:
            httpGet:
              host: "127.0.0.1"
              path: /healthz
              port: 9878
              scheme: HTTP
            periodSeconds: 30
            successThreshold: 1
            failureThreshold: 3
            timeoutSeconds: 5
          env:
            - name: K8S_NODE_NAME
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: spec.nodeName
            - name: CILIUM_K8S_NAMESPACE
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.namespace
            - name: KUBERNETES_SERVICE_HOST
              value: "localhost"
            - name: KUBERNETES_SERVICE_PORT
              value: "7445"
          ports:
            - name: envoy-metrics
              containerPort: 9964
              hostPort: 9964
              protocol: TCP
          securityContext:
            seLinuxOptions:
              level: s0
              type: spc_t
            capabilities:
              add:
                - NET_ADMIN
                - NET_BIND_SERVICE
                - PERFMON
                - BPF
              drop:
                - ALL
          terminationMessagePolicy: FallbackToLogsOnError
          volumeMounts:
            - name: envoy-sockets
              mountPath: /var/run/cilium/envoy/sockets
              readOnly: false
            - name: envoy-artifacts
              mountPath: /var/run/cilium/envoy/artifacts
              readOnly: true
            - name: envoy-config
              mountPath: /var/run/cilium/envoy/
              readOnly: true
            - name: bpf-maps
              mountPath: /sys/fs/bpf
              mountPropagation: HostToContainer
      restartPolicy: Always
      priorityClassName: system-node-critical
      serviceAccountName: "cilium-envoy"
      automountServiceAccountToken: true
      terminationGracePeriodSeconds: 1
      hostNetwork: true
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: cilium.io/no-schedule
                    operator: NotIn
                    values:
                      - "true"
        podAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchLabels:
                  k8s-app: cilium
              topologyKey: kubernetes.io/hostname
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchLabels:
                  k8s-app: cilium-envoy
              topologyKey: kubernetes.io/hostname
      nodeSelector:
        kubernetes.io/os: linux
      tolerations:
        - operator: Exists
      volumes:
        - name: envoy-sockets
          hostPath:
            path: "/var/run/cilium/envoy/sockets"
            type: DirectoryOrCreate
        - name: envoy-artifacts
          hostPath:
            path: "/var/run/cilium/envoy/artifacts"
            type: DirectoryOrCreate
        - name: envoy-config
          configMap:
            name: "cilium-envoy-config"
            defaultMode: 0400
            items:
              - key: bootstrap-config.json
                path: bootstrap-config.json
        - name: bpf-maps
          hostPath:
            path: /sys/fs/bpf
            type: DirectoryOrCreate
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: cilium
  namespace: kube-system
  labels:
    k8s-app: cilium
    app.kubernetes.io/part-of: cilium
    app.kubernetes.io/name: cilium-agent
spec:
  selector:
    matchLabels:
      k8s-app: cilium
  updateStrategy:
    rollingUpdate:
      maxUnavailable: 2
    type: RollingUpdate
  template:
    metadata:
      annotations:
        cilium.io/cilium-configmap-checksum: "e129393f7260ae593c00137d4b9c2c92e786de76c1125c2293f366cfe5b3512b"
        kubectl.kubernetes.io/default-container: cilium-agent
      labels:
        k8s-app: cilium
        app.kubernetes.io/name: cilium-agent
        app.kubernetes.io/part-of: cilium
    spec:
      securityContext:
        appArmorProfile:
          type: Unconfined
        seccompProfile:
          type: Unconfined
      containers:
        - name: cilium-agent
          image: "quay.io/cilium/cilium:v1.18.6@sha256:42ec562a5ff6c8a860c0639f5a7611685e253fd9eb2d2fcdade693724c9166a4"
          imagePullPolicy: IfNotPresent
          command:
            - cilium-agent
          args:
            - --config-dir=/tmp/cilium/config-map
          startupProbe:
            httpGet:
              host: "127.0.0.1"
              path: /healthz
              port: 9879
              scheme: HTTP
              httpHeaders:
                - name: "brief"
                  value: "true"
            failureThreshold: 300
            periodSeconds: 2
            successThreshold: 1
            initialDelaySeconds: 5
          livenessProbe:
            httpGet:
              host: "127.0.0.1"
              path: /healthz
              port: 9879
              scheme: HTTP
              httpHeaders:
                - name: "brief"
                  value: "true"
                - name: "require-k8s-connectivity"
                  value: "false"
            periodSeconds: 30
            successThreshold: 1
            failureThreshold: 10
            timeoutSeconds: 5
          readinessProbe:
            httpGet:
              host: "127.0.0.1"
              path: /healthz
              port: 9879
              scheme: HTTP
              httpHeaders:
                - name: "brief"
                  value: "true"
            periodSeconds: 30
            successThreshold: 1
            failureThreshold: 3
            timeoutSeconds: 5
          env:
            - name: K8S_NODE_NAME
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: spec.nodeName
            - name: CILIUM_K8S_NAMESPACE
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.namespace
            - name: CILIUM_CLUSTERMESH_CONFIG
              value: /var/lib/cilium/clustermesh/
            - name: GOMEMLIMIT
              valueFrom:
                resourceFieldRef:
                  resource: limits.memory
                  divisor: '1'
            - name: KUBERNETES_SERVICE_HOST
              value: "localhost"
            - name: KUBERNETES_SERVICE_PORT
              value: "7445"
            - name: KUBE_CLIENT_BACKOFF_BASE
              value: "1"
            - name: KUBE_CLIENT_BACKOFF_DURATION
              value: "120"
          lifecycle:
            postStart:
              exec:
                command:
                  - "bash"
                  - "-c"
                  - |
                    set -o errexit
                    set -o pipefail
                    set -o nounset

                    # When running in AWS ENI mode, it's likely that 'aws-node' has
                    # had a chance to install SNAT iptables rules. These can result
                    # in dropped traffic, so we should attempt to remove them.
                    # We do it using a 'postStart' hook since this may need to run
                    # for nodes which might have already been init'ed but may still
                    # have dangling rules. This is safe because there are no
                    # dependencies on anything that is part of the startup script
                    # itself, and can be safely run multiple times per node (e.g. in
                    # case of a restart).
                    if [[ "$(iptables-save | grep -E -c 'AWS-SNAT-CHAIN|AWS-CONNMARK-CHAIN')" != "0" ]];
                    then
                        echo 'Deleting iptables rules created by the AWS CNI VPC plugin'
                        iptables-save | grep -E -v 'AWS-SNAT-CHAIN|AWS-CONNMARK-CHAIN' | iptables-restore
                    fi
                    echo 'Done!'
            preStop:
              exec:
                command:
                  - /cni-uninstall.sh
          ports:
            - name: peer-service
              containerPort: 4244
              hostPort: 4244
              protocol: TCP
            - name: prometheus
              containerPort: 9962
              hostPort: 9962
              protocol: TCP
          securityContext:
            seLinuxOptions:
              level: s0
              type: spc_t
            capabilities:
              add:
                - CHOWN
                - KILL
                - NET_ADMIN
                - NET_RAW
                - IPC_LOCK
                - SYS_ADMIN
                - SYS_RESOURCE
                - DAC_OVERRIDE
                - FOWNER
                - SETGID
                - SETUID
                - PERFMON
                - BPF
              drop:
                - ALL
          terminationMessagePolicy: FallbackToLogsOnError
          volumeMounts:
            - name: envoy-sockets
              mountPath: /var/run/cilium/envoy/sockets
              readOnly: false
            - mountPath: /host/proc/sys/net
              name: host-proc-sys-net
            - mountPath: /host/proc/sys/kernel
              name: host-proc-sys-kernel
            - name: bpf-maps
              mountPath: /sys/fs/bpf
              mountPropagation: HostToContainer
            - name: cilium-cgroup
              mountPath: /sys/fs/cgroup
            - name: cilium-run
              mountPath: /var/run/cilium
            - name: cilium-netns
              mountPath: /var/run/cilium/netns
              mountPropagation: HostToContainer
            - name: etc-cni-netd
              mountPath: /host/etc/cni/net.d
            - name: clustermesh-secrets
              mountPath: /var/lib/cilium/clustermesh
              readOnly: true
            - name: lib-modules
              mountPath: /lib/modules
              readOnly: true
            - name: xtables-lock
              mountPath: /run/xtables.lock
            - name: hubble-tls
              mountPath: /var/lib/cilium/tls/hubble
              readOnly: true
            - name: tmp
              mountPath: /tmp
      initContainers:
        - name: config
          image: "quay.io/cilium/cilium:v1.18.6@sha256:42ec562a5ff6c8a860c0639f5a7611685e253fd9eb2d2fcdade693724c9166a4"
          imagePullPolicy: IfNotPresent
          command:
            - cilium-dbg
            - build-config
          env:
            - name: K8S_NODE_NAME
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: spec.nodeName
            - name: CILIUM_K8S_NAMESPACE
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.namespace
            - name: KUBERNETES_SERVICE_HOST
              value: "localhost"
            - name: KUBERNETES_SERVICE_PORT
              value: "7445"
          volumeMounts:
            - name: tmp
              mountPath: /tmp
          terminationMessagePolicy: FallbackToLogsOnError
        - name: apply-sysctl-overwrites
          image: "quay.io/cilium/cilium:v1.18.6@sha256:42ec562a5ff6c8a860c0639f5a7611685e253fd9eb2d2fcdade693724c9166a4"
          imagePullPolicy: IfNotPresent
          env:
            - name: BIN_PATH
              value: /opt/cni/bin
          command:
            - sh
            - -ec
            - |
              cp /usr/bin/cilium-sysctlfix /hostbin/cilium-sysctlfix;
              nsenter --mount=/hostproc/1/ns/mnt "${BIN_PATH}/cilium-sysctlfix";
              rm /hostbin/cilium-sysctlfix
          volumeMounts:
            - name: hostproc
              mountPath: /hostproc
            - name: cni-path
              mountPath: /hostbin
          terminationMessagePolicy: FallbackToLogsOnError
          securityContext:
            seLinuxOptions:
              level: s0
              type: spc_t
            capabilities:
              add:
                - SYS_ADMIN
                - SYS_CHROOT
                - SYS_PTRACE
              drop:
                - ALL
        - name: mount-bpf-fs
          image: "quay.io/cilium/cilium:v1.18.6@sha256:42ec562a5ff6c8a860c0639f5a7611685e253fd9eb2d2fcdade693724c9166a4"
          imagePullPolicy: IfNotPresent
          args:
            - 'mount | grep "/sys/fs/bpf type bpf" || mount -t bpf bpf /sys/fs/bpf'
          command:
            - /bin/bash
            - -c
            - --
          terminationMessagePolicy: FallbackToLogsOnError
          securityContext:
            privileged: true
          volumeMounts:
            - name: bpf-maps
              mountPath: /sys/fs/bpf
              mountPropagation: Bidirectional
        - name: clean-cilium-state
          image: "quay.io/cilium/cilium:v1.18.6@sha256:42ec562a5ff6c8a860c0639f5a7611685e253fd9eb2d2fcdade693724c9166a4"
          imagePullPolicy: IfNotPresent
          command:
            - /init-container.sh
          env:
            - name: CILIUM_ALL_STATE
              valueFrom:
                configMapKeyRef:
                  name: cilium-config
                  key: clean-cilium-state
                  optional: true
            - name: CILIUM_BPF_STATE
              valueFrom:
                configMapKeyRef:
                  name: cilium-config
                  key: clean-cilium-bpf-state
                  optional: true
            - name: WRITE_CNI_CONF_WHEN_READY
              valueFrom:
                configMapKeyRef:
                  name: cilium-config
                  key: write-cni-conf-when-ready
                  optional: true
            - name: KUBERNETES_SERVICE_HOST
              value: "localhost"
            - name: KUBERNETES_SERVICE_PORT
              value: "7445"
          terminationMessagePolicy: FallbackToLogsOnError
          securityContext:
            seLinuxOptions:
              level: s0
              type: spc_t
            capabilities:
              add:
                - NET_ADMIN
                - SYS_ADMIN
                - SYS_RESOURCE
              drop:
                - ALL
          volumeMounts:
            - name: bpf-maps
              mountPath: /sys/fs/bpf
            - name: cilium-cgroup
              mountPath: /sys/fs/cgroup
              mountPropagation: HostToContainer
            - name: cilium-run
              mountPath: /var/run/cilium
        - name: install-cni-binaries
          image: "quay.io/cilium/cilium:v1.18.6@sha256:42ec562a5ff6c8a860c0639f5a7611685e253fd9eb2d2fcdade693724c9166a4"
          imagePullPolicy: IfNotPresent
          command:
            - "/install-plugin.sh"
          resources:
            requests:
              cpu: 100m
              memory: 10Mi
          securityContext:
            seLinuxOptions:
              level: s0
              type: spc_t
            capabilities:
              drop:
                - ALL
          terminationMessagePolicy: FallbackToLogsOnError
          volumeMounts:
            - name: cni-path
              mountPath: /host/opt/cni/bin
      restartPolicy: Always
      priorityClassName: system-node-critical
      serviceAccountName: "cilium"
      automountServiceAccountToken: true
      terminationGracePeriodSeconds: 1
      hostNetwork: true
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchLabels:
                  k8s-app: cilium
              topologyKey: kubernetes.io/hostname
      nodeSelector:
        kubernetes.io/os: linux
      tolerations:
        - operator: Exists
      volumes:
        - name: tmp
          emptyDir: {}
        - name: cilium-run
          hostPath:
            path: /var/run/cilium
            type: DirectoryOrCreate
        - name: cilium-netns
          hostPath:
            path: /var/run/netns
            type: DirectoryOrCreate
        - name: bpf-maps
          hostPath:
            path: /sys/fs/bpf
            type: DirectoryOrCreate
        - name: hostproc
          hostPath:
            path: /proc
            type: Directory
        - name: cilium-cgroup
          hostPath:
            path: /sys/fs/cgroup
            type: DirectoryOrCreate
        - name: cni-path
          hostPath:
            path: /opt/cni/bin
            type: DirectoryOrCreate
        - name: etc-cni-netd
          hostPath:
            path: /etc/cni/net.d
            type: DirectoryOrCreate
        - name: lib-modules
          hostPath:
            path: /lib/modules
        - name: xtables-lock
          hostPath:
            path: /run/xtables.lock
            type: FileOrCreate
        - name: envoy-sockets
          hostPath:
            path: "/var/run/cilium/envoy/sockets"
            type: DirectoryOrCreate
        - name: clustermesh-secrets
          projected:
            defaultMode: 0400
            sources:
              - secret:
                  name: cilium-clustermesh
                  optional: true
              - secret:
                  name: clustermesh-apiserver-remote-cert
                  optional: true
                  items:
                    - key: tls.key
                      path: common-etcd-client.key
                    - key: tls.crt
                      path: common-etcd-client.crt
                    - key: ca.crt
                      path: common-etcd-client-ca.crt
              - secret:
                  name: clustermesh-apiserver-local-cert
                  optional: true
                  items:
                    - key: tls.key
                      path: local-etcd-client.key
                    - key: tls.crt
                      path: local-etcd-client.crt
                    - key: ca.crt
                      path: local-etcd-client-ca.crt
        - name: host-proc-sys-net
          hostPath:
            path: /proc/sys/net
            type: Directory
        - name: host-proc-sys-kernel
          hostPath:
            path: /proc/sys/kernel
            type: Directory
        - name: hubble-tls
          projected:
            defaultMode: 0400
            sources:
              - secret:
                  name: hubble-server-certs
                  optional: true
                  items:
                    - key: tls.crt
                      path: server.crt
                    - key: tls.key
                      path: server.key
                    - key: ca.crt
                      path: client-ca.crt
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: cilium-operator
  namespace: kube-system
  labels:
    io.cilium/app: operator
    name: cilium-operator
    app.kubernetes.io/part-of: cilium
    app.kubernetes.io/name: cilium-operator
spec:
  replicas: 2
  selector:
    matchLabels:
      io.cilium/app: operator
      name: cilium-operator
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 50%
    type: RollingUpdate
  template:
    metadata:
      annotations:
        cilium.io/cilium-configmap-checksum: "e129393f7260ae593c00137d4b9c2c92e786de76c1125c2293f366cfe5b3512b"
      labels:
        io.cilium/app: operator
        name: cilium-operator
        app.kubernetes.io/part-of: cilium
        app.kubernetes.io/name: cilium-operator
    spec:
      securityContext:
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: cilium-operator
          image: "quay.io/cilium/operator-generic:v1.18.6@sha256:34a827ce9ed021c8adf8f0feca131f53b3c54a3ef529053d871d0347ec4d69af"
          imagePullPolicy: IfNotPresent
          command:
            - cilium-operator-generic
          args:
            - --config-dir=/tmp/cilium/config-map
            - --debug=$(CILIUM_DEBUG)
          env:
            - name: K8S_NODE_NAME
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: spec.nodeName
            - name: CILIUM_K8S_NAMESPACE
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.namespace
            - name: CILIUM_DEBUG
              valueFrom:
                configMapKeyRef:
                  key: debug
                  name: cilium-config
                  optional: true
            - name: KUBERNETES_SERVICE_HOST
              value: "localhost"
            - name: KUBERNETES_SERVICE_PORT
              value: "7445"
          ports:
            - name: prometheus
              containerPort: 9963
              hostPort: 9963
              protocol: TCP
          livenessProbe:
            httpGet:
              host: "127.0.0.1"
              path: /healthz
              port: 9234
              scheme: HTTP
            initialDelaySeconds: 60
            periodSeconds: 10
            timeoutSeconds: 3
          readinessProbe:
            httpGet:
              host: "127.0.0.1"
              path: /healthz
              port: 9234
              scheme: HTTP
            initialDelaySeconds: 0
            periodSeconds: 5
            timeoutSeconds: 3
            failureThreshold: 5
          volumeMounts:
            - name: cilium-config-path
              mountPath: /tmp/cilium/config-map
              readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
          terminationMessagePolicy: FallbackToLogsOnError
      hostNetwork: true
      restartPolicy: Always
      priorityClassName: system-cluster-critical
      serviceAccountName: "cilium-operator"
      automountServiceAccountToken: true
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchLabels:
                  io.cilium/app: operator
              topologyKey: kubernetes.io/hostname
      nodeSelector:
        kubernetes.io/os: linux
      tolerations:
        - key: node-role.kubernetes.io/control-plane
          operator: Exists
        - key: node-role.kubernetes.io/master
          operator: Exists
        - key: node.kubernetes.io/not-ready
          operator: Exists
        - key: node.cloudprovider.kubernetes.io/uninitialized
          operator: Exists
        - key: node.cilium.io/agent-not-ready
          operator: Exists
      volumes:
        - name: cilium-config-path
          configMap:
            name: cilium-config
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: hubble-relay
  namespace: kube-system
  labels:
    k8s-app: hubble-relay
    app.kubernetes.io/name: hubble-relay
    app.kubernetes.io/part-of: cilium
spec:
  replicas: 1
  selector:
    matchLabels:
      k8s-app: hubble-relay
  strategy:
    rollingUpdate:
      maxUnavailable: 1
    type: RollingUpdate
  template:
    metadata:
      annotations:
      labels:
        k8s-app: hubble-relay
        app.kubernetes.io/name: hubble-relay
        app.kubernetes.io/part-of: cilium
    spec:
      securityContext:
        fsGroup: 65532
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: hubble-relay
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            runAsGroup: 65532
            runAsNonRoot: true
            runAsUser: 65532
            seccompProfile:
              type: RuntimeDefault
          image: "quay.io/cilium/hubble-relay:v1.18.6@sha256:fb6135e34c31e5f175cb5e75f86cea52ef2ff12b49bcefb7088ed93f5009eb8e"
          imagePullPolicy: IfNotPresent
          command:
            - hubble-relay
          args:
            - serve
          ports:
            - name: grpc
              containerPort: 4245
          readinessProbe:
            grpc:
              port: 4222
            timeoutSeconds: 3
          livenessProbe:
            grpc:
              port: 4222
            timeoutSeconds: 10
            initialDelaySeconds: 10
            periodSeconds: 10
            failureThreshold: 12
          startupProbe:
            grpc:
              port: 4222
            initialDelaySeconds: 10
            failureThreshold: 20
            periodSeconds: 3
          volumeMounts:
            - name: config
              mountPath: /etc/hubble-relay
              readOnly: true
            - name: tls
              mountPath: /var/lib/hubble-relay/tls
              readOnly: true
          terminationMessagePolicy: FallbackToLogsOnError
      restartPolicy: Always
      priorityClassName:
      serviceAccountName: "hubble-relay"
      automountServiceAccountToken: false
      terminationGracePeriodSeconds: 1
      affinity:
        podAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchLabels:
                  k8s-app: cilium
              topologyKey: kubernetes.io/hostname
      nodeSelector:
        kubernetes.io/os: linux
      volumes:
        - name: config
          configMap:
            name: hubble-relay-config
            items:
              - key: config.yaml
                path: config.yaml
        - name: tls
          projected:
            defaultMode: 0400
            sources:
              - secret:
                  name: hubble-relay-client-certs
                  items:
                    - key: tls.crt
                      path: client.crt
                    - key: tls.key
                      path: client.key
                    - key: ca.crt
                      path: hubble-server-ca.crt
---
kind: Deployment
apiVersion: apps/v1
metadata:
  name: hubble-ui
  namespace: kube-system
  labels:
    k8s-app: hubble-ui
    app.kubernetes.io/name: hubble-ui
    app.kubernetes.io/part-of: cilium
spec:
  replicas: 1
  selector:
    matchLabels:
      k8s-app: hubble-ui
  strategy:
    rollingUpdate:
      maxUnavailable: 1
    type: RollingUpdate
  template:
    metadata:
      annotations:
      labels:
        k8s-app: hubble-ui
        app.kubernetes.io/name: hubble-ui
        app.kubernetes.io/part-of: cilium
    spec:
      securityContext:
        fsGroup: 1001
        runAsGroup: 1001
        runAsUser: 1001
      priorityClassName:
      serviceAccountName: "hubble-ui"
      automountServiceAccountToken: true
      containers:
        - name: frontend
          image: "quay.io/cilium/hubble-ui:v0.13.3@sha256:661d5de7050182d495c6497ff0b007a7a1e379648e60830dd68c4d78ae21761d"
          imagePullPolicy: IfNotPresent
          ports:
            - name: http
              containerPort: 8081
          livenessProbe:
            httpGet:
              path: /healthz
              port: 8081
          readinessProbe:
            httpGet:
              path: /
              port: 8081
          volumeMounts:
            - name: hubble-ui-nginx-conf
              mountPath: /etc/nginx/conf.d/default.conf
              subPath: nginx.conf
            - name: tmp-dir
              mountPath: /tmp
          terminationMessagePolicy: FallbackToLogsOnError
          securityContext:
            allowPrivilegeEscalation: false
        - name: backend
          image: "quay.io/cilium/hubble-ui-backend:v0.13.3@sha256:db1454e45dc39ca41fbf7cad31eec95d99e5b9949c39daaad0fa81ef29d56953"
          imagePullPolicy: IfNotPresent
          env:
            - name: EVENTS_SERVER_PORT
              value: "8090"
            - name: FLOWS_API_ADDR
              value: "hubble-relay:80"
          ports:
            - name: grpc
              containerPort: 8090
          volumeMounts:
          terminationMessagePolicy: FallbackToLogsOnError
          securityContext:
            allowPrivilegeEscalation: false
      nodeSelector:
        kubernetes.io/os: linux
      volumes:
        - configMap:
            defaultMode: 420
            name: hubble-ui-nginx
          name: hubble-ui-nginx-conf
        - emptyDir: {}
          name: tmp-dir
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: hubble
  namespace: kube-system
  labels:
    app.kubernetes.io/name: hubble
    app.kubernetes.io/instance: cilium
    app.kubernetes.io/part-of: cilium
spec:
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: traefik-gateway
      namespace: traefik
  hostnames:
    - hubble.alexlebens.net
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - group: ''
          kind: Service
          name: hubble-ui
          port: 80
          weight: 100
---
apiVersion: batch/v1
kind: Job
metadata:
  name: hubble-generate-certs
  namespace: kube-system
  labels:
    k8s-app: hubble-generate-certs
    app.kubernetes.io/name: hubble-generate-certs
    app.kubernetes.io/part-of: cilium
  annotations:
    "helm.sh/hook": post-install,post-upgrade
spec:
  template:
    metadata:
      labels:
        k8s-app: hubble-generate-certs
    spec:
      securityContext:
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: certgen
          image: "quay.io/cilium/certgen:v0.3.1@sha256:2825dbfa6f89cbed882fd1d81e46a56c087e35885825139923aa29eb8aec47a9"
          imagePullPolicy: IfNotPresent
          securityContext:
            capabilities:
              drop:
                - ALL
            allowPrivilegeEscalation: false
          command:
            - "/usr/bin/cilium-certgen"
          args:
            - "--ca-generate=true"
            - "--ca-reuse-secret"
            - "--ca-secret-namespace=kube-system"
            - "--ca-secret-name=cilium-ca"
            - "--ca-common-name=Cilium CA"
          env:
            - name: CILIUM_CERTGEN_CONFIG
              value: |
                certs:
                - name: hubble-server-certs
                  namespace: kube-system
                  commonName: "*.default.hubble-grpc.cilium.io"
                  hosts:
                  - "*.default.hubble-grpc.cilium.io"
                  usage:
                  - signing
                  - key encipherment
                  - server auth
                  - client auth
                  validity: 8760h
                - name: hubble-relay-client-certs
                  namespace: kube-system
                  commonName: "*.hubble-relay.cilium.io"
                  hosts:
                  - "*.hubble-relay.cilium.io"
                  usage:
                  - signing
                  - key encipherment
                  - client auth
                  validity: 8760h
      hostNetwork: false
      serviceAccount: "hubble-generate-certs"
      serviceAccountName: "hubble-generate-certs"
      automountServiceAccountToken: true
      restartPolicy: OnFailure
      affinity:
  ttlSecondsAfterFinished: 1800
---
apiVersion: v1
kind: Namespace
metadata:
  name: "cilium-secrets"
  labels:
    app.kubernetes.io/part-of: cilium
  annotations:
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: cilium-config-agent
  namespace: kube-system
  labels:
    app.kubernetes.io/part-of: cilium
rules:
  - apiGroups:
      - ""
    resources:
      - configmaps
    verbs:
      - get
      - list
      - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: cilium-gateway-secrets
  namespace: "cilium-secrets"
  labels:
    app.kubernetes.io/part-of: cilium
rules:
  - apiGroups:
      - ""
    resources:
      - secrets
    verbs:
      - get
      - list
      - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: cilium-operator-gateway-secrets
  namespace: "cilium-secrets"
  labels:
    app.kubernetes.io/part-of: cilium
rules:
  - apiGroups:
      - ""
    resources:
      - secrets
    verbs:
      - create
      - delete
      - update
      - patch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: cilium-operator-tlsinterception-secrets
  namespace: "cilium-secrets"
  labels:
    app.kubernetes.io/part-of: cilium
rules:
  - apiGroups:
      - ""
    resources:
      - secrets
    verbs:
      - create
      - delete
      - update
      - patch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: cilium-tlsinterception-secrets
  namespace: "cilium-secrets"
  labels:
    app.kubernetes.io/part-of: cilium
rules:
  - apiGroups:
      - ""
    resources:
      - secrets
    verbs:
      - get
      - list
      - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: hubble-generate-certs
  namespace: kube-system
  labels:
    app.kubernetes.io/part-of: cilium
rules:
  - apiGroups:
      - ""
    resources:
      - secrets
    verbs:
      - create
  - apiGroups:
      - ""
    resources:
      - secrets
    resourceNames:
      - hubble-server-certs
      - hubble-relay-client-certs
      - hubble-relay-server-certs
      - hubble-metrics-server-certs
      - hubble-ui-client-certs
    verbs:
      - update
  - apiGroups:
      - ""
    resources:
      - secrets
    resourceNames:
      - cilium-ca
    verbs:
      - get
      - update
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: cilium-config-agent
  namespace: kube-system
  labels:
    app.kubernetes.io/part-of: cilium
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: cilium-config-agent
subjects:
  - kind: ServiceAccount
    name: "cilium"
    namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: cilium-gateway-secrets
  namespace: "cilium-secrets"
  labels:
    app.kubernetes.io/part-of: cilium
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: cilium-gateway-secrets
subjects:
  - kind: ServiceAccount
    name: "cilium"
    namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: cilium-operator-gateway-secrets
  namespace: "cilium-secrets"
  labels:
    app.kubernetes.io/part-of: cilium
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: cilium-operator-gateway-secrets
subjects:
  - kind: ServiceAccount
    name: "cilium-operator"
    namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: cilium-operator-tlsinterception-secrets
  namespace: "cilium-secrets"
  labels:
    app.kubernetes.io/part-of: cilium
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: cilium-operator-tlsinterception-secrets
subjects:
  - kind: ServiceAccount
    name: "cilium-operator"
    namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: cilium-tlsinterception-secrets
  namespace: "cilium-secrets"
  labels:
    app.kubernetes.io/part-of: cilium
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: cilium-tlsinterception-secrets
subjects:
  - kind: ServiceAccount
    name: "cilium"
    namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: hubble-generate-certs
  namespace: kube-system
  labels:
    app.kubernetes.io/part-of: cilium
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: hubble-generate-certs
subjects:
  - kind: ServiceAccount
    name: "hubble-generate-certs"
    namespace: kube-system
---
apiVersion: v1
kind: Service
metadata:
  name: cilium-agent
  namespace: kube-system
  labels:
    k8s-app: cilium
    app.kubernetes.io/name: cilium-agent
    app.kubernetes.io/part-of: cilium
spec:
  clusterIP: None
  type: ClusterIP
  selector:
    k8s-app: cilium
  ports:
    - name: metrics
      port: 9962
      protocol: TCP
      targetPort: prometheus
---
apiVersion: v1
kind: Service
metadata:
  name: cilium-envoy
  namespace: kube-system
  labels:
    k8s-app: cilium-envoy
    app.kubernetes.io/name: cilium-envoy
    app.kubernetes.io/part-of: cilium
    io.cilium/app: proxy
spec:
  clusterIP: None
  type: ClusterIP
  selector:
    k8s-app: cilium-envoy
  ports:
    - name: envoy-metrics
      port: 9964
      protocol: TCP
      targetPort: envoy-metrics
---
kind: Service
apiVersion: v1
metadata:
  name: cilium-operator
  namespace: kube-system
  labels:
    io.cilium/app: operator
    name: cilium-operator
    app.kubernetes.io/part-of: cilium
    app.kubernetes.io/name: cilium-operator
spec:
  clusterIP: None
  type: ClusterIP
  ports:
    - name: metrics
      port: 9963
      protocol: TCP
      targetPort: prometheus
  selector:
    io.cilium/app: operator
    name: cilium-operator
---
apiVersion: v1
kind: Service
metadata:
  name: hubble-peer
  namespace: kube-system
  labels:
    k8s-app: cilium
    app.kubernetes.io/part-of: cilium
    app.kubernetes.io/name: hubble-peer
spec:
  selector:
    k8s-app: cilium
  ports:
    - name: peer-service
      port: 443
      protocol: TCP
      targetPort: 4244
  internalTrafficPolicy: Local
---
kind: Service
apiVersion: v1
metadata:
  name: hubble-relay
  namespace: kube-system
  annotations:
  labels:
    k8s-app: hubble-relay
    app.kubernetes.io/name: hubble-relay
    app.kubernetes.io/part-of: cilium
spec:
  type: "ClusterIP"
  selector:
    k8s-app: hubble-relay
  ports:
    - protocol: TCP
      port: 80
      targetPort: grpc
---
kind: Service
apiVersion: v1
metadata:
  name: hubble-ui
  namespace: kube-system
  labels:
    k8s-app: hubble-ui
    app.kubernetes.io/name: hubble-ui
    app.kubernetes.io/part-of: cilium
spec:
  type: "ClusterIP"
  selector:
    k8s-app: hubble-ui
  ports:
    - name: http
      port: 80
      targetPort: 8081
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: "cilium-envoy"
  namespace: kube-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: "cilium-operator"
  namespace: kube-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: "cilium"
  namespace: kube-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: "hubble-generate-certs"
  namespace: kube-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: "hubble-relay"
  namespace: kube-system
automountServiceAccountToken: false
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: "hubble-ui"
  namespace: kube-system
---
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: cilium-agent
  namespace: kube-system
  labels:
    app.kubernetes.io/part-of: cilium
    app.kubernetes.io/name: cilium-agent
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: cilium-agent
  namespaceSelector:
    matchNames:
      - kube-system
  endpoints:
    - port: metrics
      interval: "10s"
      honorLabels: true
      path: /metrics
      relabelings:
        - action: replace
          replacement: ${1}
          sourceLabels:
            - __meta_kubernetes_pod_node_name
          targetLabel: node
  targetLabels:
    - k8s-app
---
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: cilium-envoy
  namespace: kube-system
  labels:
    app.kubernetes.io/part-of: cilium
    app.kubernetes.io/name: cilium-envoy
spec:
  selector:
    matchLabels:
      k8s-app: cilium-envoy
  namespaceSelector:
    matchNames:
      - kube-system
  endpoints:
    - port: envoy-metrics
      interval: "10s"
      honorLabels: true
      path: /metrics
      relabelings:
        - action: replace
          replacement: ${1}
          sourceLabels:
            - __meta_kubernetes_pod_node_name
          targetLabel: node
  targetLabels:
    - k8s-app
---
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: cilium-operator
  namespace: kube-system
  labels:
    app.kubernetes.io/part-of: cilium
    app.kubernetes.io/name: cilium-operator
spec:
  selector:
    matchLabels:
      io.cilium/app: operator
      name: cilium-operator
  namespaceSelector:
    matchNames:
      - kube-system
  endpoints:
    - port: metrics
      interval: "10s"
      honorLabels: true
      path: /metrics
  targetLabels:
    - io.cilium/app