helm: Add encryption.wireguard.userspaceFallback value

To enable the fallback to user-space mode implemented in the previous
commits.

Signed-off-by: Sebastian Wicki <sebastian@isovalent.com>

Documentation/spelling_wordlist.txt

@@ -894,6 +894,7 @@ url
 useAPIServer
 username
 userspace
+userspaceFallback
 usr
 uuid
 vCPU
@@ -926,6 +927,7 @@ whitelists
 whitespace
 wildcard
 wildcards
+wireguard
 workflow
 workflows
 workspace

install/kubernetes/cilium/README.md

@@ -142,6 +142,7 @@ contributors across the globe, there is almost always someone available to help.
 | encryption.nodeEncryption | bool | `false` | Enable encryption for pure node to node traffic. This option is only effective when encryption.type is set to ipsec. |
 | encryption.secretName | string | `"cilium-ipsec-keys"` | Deprecated in favor of encryption.ipsec.secretName. Name of the Kubernetes secret containing the encryption keys. This option is only effective when encryption.type is set to ipsec. |
 | encryption.type | string | `"ipsec"` | Encryption method. Can be either ipsec or wireguard. |
+| encryption.wireguard.userspaceFallback | bool | `false` | Enables the fallback to the user-space implementation. |
 | endpointHealthChecking.enabled | bool | `true` | Enable connectivity health checking between virtual endpoints. |
 | endpointRoutes.enabled | bool | `false` | Enable use of per endpoint routes instead of routing via the cilium_host interface. |
 | endpointStatus | object | `{"enabled":false,"status":""}` | Enable endpoint status. Status can be: policy, health, controllers, logs and / or state. For 2 or more options use a comma. |

install/kubernetes/cilium/templates/cilium-configmap.yaml

@@ -454,6 +454,9 @@ data:
     {{- end }}
   {{- else if eq .Values.encryption.type "wireguard" }}
   enable-wireguard: {{ .Values.encryption.enabled | quote }}
+    {{- if .Values.encryption.wireguard.userspaceFallback }}
+  enable-wireguard-userspace-fallback: {{ .Values.encryption.wireguard.userspaceFallback | quote }}
+    {{- end }}
   {{- end }}
 {{- end }}
 

install/kubernetes/cilium/values.yaml

@@ -442,6 +442,10 @@ encryption:
     # -- The interface to use for encrypted traffic.
     interface: ""
 
+  wireguard:
+    # -- Enables the fallback to the user-space implementation.
+    userspaceFallback: false
+
   # -- Deprecated in favor of encryption.ipsec.keyFile.
   # Name of the key file inside the Kubernetes secret configured via secretName.
   # This option is only effective when encryption.type is set to ipsec.