helmrelease.yaml

---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: cilium
spec:
  interval: 30m
  chart:
    spec:
      chart: cilium
      version: 1.15.3
      sourceRef:
        kind: HelmRepository
        name: cilium-charts
        namespace: flux-system
  install:
    remediation:
      retries: 3
  upgrade:
    cleanupOnFail: true
    remediation:
      strategy: rollback
      retries: 3
  values:
    autoDirectNodeRoutes: true
    bandwidthManager:
      enabled: true
      bbr: true
    bpf:
      masquerade: true
      tproxy: true
    bgpControlPlane:
      enabled: true
    cni:
      exclusive: false
    cgroup:
      autoMount:
        enabled: false
      hostRoot: /sys/fs/cgroup
    cluster:
      name: k8s
      id: 1
    containerRuntime:
      integration: containerd
    dashboards:
      enabled: true
      annotations:
        grafana_folder: Cilium
    devices: bond+
    endpointRoutes:
      enabled: true
    hubble:
      enabled: true
      metrics:
        enabled:
          - dns:query
          - drop
          - tcp
          - flow
          - port-distribution
          - icmp
          - http
        serviceMonitor:
          enabled: true
        dashboards:
          enabled: true
          annotations:
            grafana_folder: Cilium
      relay:
        enabled: true
        rollOutPods: true
        prometheus:
          serviceMonitor:
            enabled: true
      ui:
        enabled: true
        rollOutPods: true
        ingress:
          enabled: true
          className: internal
          annotations:
            external-dns.alpha.kubernetes.io/target: internal.${PUBLIC_DOMAIN}
            hajimari.io/icon: simple-icons:cilium
          hosts:
            - &host hubble.${PUBLIC_DOMAIN}
          tls:
            - hosts:
                - *host
    ipam:
      mode: kubernetes
    ipv4NativeRoutingCIDR: ${CLUSTER_POD_CIDR}
    k8sServiceHost: 127.0.0.1
    k8sServicePort: 7445
    kubeProxyReplacement: true
    kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
    l2announcements:
      enabled: true
    loadBalancer:
      algorithm: maglev
      mode: dsr
    localRedirectPolicy: true
    operator:
      enabled: true
      rollOutPods: true
      prometheus:
        enabled: true
        serviceMonitor:
          enabled: true
      dashboards:
        enabled: true
        annotations:
          grafana_folder: Cilium
    podAnnotations:
      webhooks.kyverno.io/exclude: "true"
    prometheus:
      enabled: true
      serviceMonitor:
        enabled: true
        trustCRDsExist: true
    rollOutCiliumPods: true
    routingMode: native
    securityContext:
      privileged: false
      capabilities:
        ciliumAgent:
          - CHOWN
          - KILL
          - NET_ADMIN
          - NET_RAW
          - IPC_LOCK
          - SYS_ADMIN
          - SYS_RESOURCE
          - DAC_OVERRIDE
          - FOWNER
          - SETGID
          - SETUID
        cleanCiliumState:
          - NET_ADMIN
          - SYS_ADMIN
          - SYS_RESOURCE