docs: Update the docs for Helm mode Cilium CLI

[michi-covalent]

• Consistently use the --set flag.
• Replace --helm-auto-gen-values with --dry-run-helm-values.
• Set kubeProxyReplacement to "true" instead of "strict".

Ref: #26430
Fixes: cilium/cilium-cli#1624

[giorio94]

Thanks @michi-covalent for tackling this!

A couple of additional aspects:

• I wonder if it could make sense to add a callout to the cli-download.rst (or somewhere else) to explicitly state that these guides require Cilium CLI v0.15 or subsequent, and users should upgrade it if appropriate. Otherwise users that already have the CLI installed might be puzzled about why it is not working as expected.
• Similarly, I wonder if it could make sense to explicitly state that using the new CLI against an installation performed with older CLI versions is not supported, and can lead to errors/issues.
• There seems to be still a couple of leftover occurrences of --helm-set in installation/k3s.rts and servicemesh/installation.rst.

[michi-covalent]

I wonder if it could make sense to add a callout to the cli-download.rst (or somewhere else) to explicitly state that these guides require Cilium CLI v0.15 or subsequent, and users should upgrade it if appropriate. Otherwise users that already have the CLI installed might be puzzled about why it is not working as expected.

Similarly, I wonder if it could make sense to explicitly state that using the new CLI against an installation performed with older CLI versions is not supported, and can lead to errors/issues.

yeah let's do that. i'll move this to draft, and add notes about cilium-cli version / incompatibility with the classic mode 📝

There seems to be still a couple of leftover occurrences of --helm-set in installation/k3s.rts and servicemesh/installation.rst.

updated 📝 🚀

[learnitall]

Thank you, looks great! LGTM pending a couple of things:

• @giorio94's comment on calling out compatibility concerns
• I think there are some files and changes that we missed. These are some grep calls in Documentation/

kube proxy replacement, strict vs true. Some of these may not be related to the cilium-cli changes however and may not need to be changed:

grep -i '.*proxy.*replacement.*strict' -n --exclude-dir '_*' -R .
./network/kubernetes/ipam-multi-pool.rst:32:   * ``--set kubeProxyReplacement=strict``
./network/kubernetes/kubeproxy-free.rst:105:        --set kubeProxyReplacement=strict \\
./network/kubernetes/kubeproxy-free.rst:158:    KubeProxyReplacement:   Strict	[eth0 (Direct Routing), eth1]
./network/kubernetes/kubeproxy-free.rst:383:        --set kubeProxyReplacement=strict \\
./network/kubernetes/kubeproxy-free.rst:447:        --set kubeProxyReplacement=strict \\
./network/kubernetes/kubeproxy-free.rst:519:        --set kubeProxyReplacement=strict \\
./network/kubernetes/kubeproxy-free.rst:550:        --set kubeProxyReplacement=strict \\
./network/kubernetes/kubeproxy-free.rst:566:        --set kubeProxyReplacement=strict \\
./network/kubernetes/kubeproxy-free.rst:595:        --set kubeProxyReplacement=strict \\
./network/kubernetes/kubeproxy-free.rst:631:        --set kubeProxyReplacement=strict \\
./network/kubernetes/kubeproxy-free.rst:667:        --set kubeProxyReplacement=strict \\
./network/kubernetes/kubeproxy-free.rst:808:        --set kubeProxyReplacement=strict \\
./network/kubernetes/kubeproxy-free.rst:869:     --set kubeProxyReplacement=strict \\
./network/kubernetes/kubeproxy-free.rst:962:        --set kubeProxyReplacement=strict \\
./network/kubernetes/kubeproxy-free.rst:974:By specifying ``kubeProxyReplacement=strict`` the native hostPort support is
./network/kubernetes/kubeproxy-free.rst:996:        --set kubeProxyReplacement=strict \\
./network/kubernetes/kubeproxy-free.rst:1113:- ``kubeProxyReplacement=strict``: When using this option, it's highly recommended
./network/kubernetes/kubeproxy-free.rst:1149:  The following Helm setup below would be equivalent to ``kubeProxyReplacement=strict``
./network/kubernetes/kubeproxy-free.rst:1200:    KubeProxyReplacement:   Strict	[eth0 (DR)]
./network/kubernetes/kubeproxy-free.rst:1301:Cilium's eBPF kube-proxy replacement restricts access from outside (e.g. external
./network/kubernetes/kata.rst:81:   :ref:`kube-proxy replacement <kubeproxy-free>` in strict mode. These
./network/egress-gateway.rst:93:               --set kubeProxyReplacement=strict \\
./network/egress-gateway.rst:103:            kube-proxy-replacement: strict
./network/l2-announcements.rst:42:               --set kubeProxyReplacement=strict \\
./network/l2-announcements.rst:52:            kube-proxy-replacement: strict
./network/l2-announcements.rst:57:* Kube Proxy replacement mode must be enabled and set to ``strict`` mode, see :ref:`kubeproxy-free` for details.
./network/l2-announcements.rst:292:               --set kubeProxyReplacement=strict \\
./network/l2-announcements.rst:304:            kube-proxy-replacement: strict
./operations/upgrade.rst:208:      kubeProxyReplacement: "strict"
./operations/performance/tuning.rst:91:             --set kubeProxyReplacement=strict
./operations/performance/tuning.rst:148:             --set kubeProxyReplacement=strict
./operations/performance/tuning.rst:260:             --set kubeProxyReplacement=strict
./operations/performance/tuning.rst:308:             --set kubeProxyReplacement=strict
./operations/troubleshooting_servicemesh.rst:23: #. Validate that the ``kubeProxyReplacement`` is set to either partial or strict.
./operations/troubleshooting_servicemesh.rst:31:        KubeProxyReplacement:    Strict   [eth0 192.168.49.2]
./configuration/per-node-config.rst:65:nodes with ``io.cilium.migration/kube-proxy-replacement: strict``
./configuration/per-node-config.rst:79:        kubectl -n kube-system patch daemonset kube-proxy --patch '{"spec": {"template": {"spec": {"affinity": {"nodeAffinity": {"requiredDuringSchedulingIgnoredDuringExecution": {"nodeSelectorTerms": [{"matchExpressions": [{"key": "io.cilium.migration/kube-proxy-replacement", "operator": "NotIn", "values": ["strict"]}]}]}}}}}}}'
./configuration/per-node-config.rst:90:          name: kube-proxy-replacement-strict
./configuration/per-node-config.rst:94:              io.cilium.migration/kube-proxy-replacement: strict
./configuration/per-node-config.rst:96:            kube-proxy-replacement: strict
./configuration/per-node-config.rst:106:        kubectl label node $NODE --overwrite 'io.cilium.migration/kube-proxy-replacement=strict'
./configuration/per-node-config.rst:133:        cilium config set --restart=false kube-proxy-replacement strict
./configuration/per-node-config.rst:135:        kubectl -n kube-system delete ciliumnodeconfig kube-proxy-replacement-strict

--set over --helm-set:

grep -i 'helm-set' -n --exclude-dir '_*' -R .
./network/clustermesh/clustermesh.rst:56: * ``cilium install`` option ``--helm-set ipv4NativeRoutingCIDR=10.0.0.0/9``
./network/clustermesh/clustermesh.rst:107: * Cilium CLI install options (*helm* mode) ``--helm-set cluster.name`` and ``--helm-set cluster.id``

[michi-covalent]

kube proxy replacement, strict vs true. Some of these may not be related to the cilium-cli changes however and may not need to be changed:

yeah let's deal with kpr values in a separate PR if necessary. summoning @brb to check if we need to update all the pages to use true instead of strict 🍅

grep -i 'helm-set' -n --exclude-dir '_*' -R .
./network/clustermesh/clustermesh.rst:56: * ``cilium install`` option ``--helm-set ipv4NativeRoutingCIDR=10.0.0.0/9``
./network/clustermesh/clustermesh.rst:107: * Cilium CLI install options (*helm* mode) ``--helm-set cluster.name`` and ``--helm-set cluster.id``

these are addressed in #26608 ✅

[michi-covalent]

• cilium-cli installation instructions: https://deploy-preview-26606--docs-cilium-io.netlify.app/gettingstarted/k8s-install-default.html#install-the-cilium-cli
• upgrade guide: https://deploy-preview-26606--docs-cilium-io.netlify.app/operations/upgrade.html#cilium-cli

[michi-covalent]

/test

[giorio94]

/lgtm

[learnitall]

A couple of nits, but otherwise looks good! Since I am new to reviewing docs, let's also have another docs-structure team member take a look.

[qmonnet]

Looks all in order to me once the feedback from Marco and Ryan is addressed 👍.

Skimming through the discussion: the other values for KPR should have been updated with #26577.

[learnitall]

LGTM! Thank you!

[michi-covalent]

docs only change. marking it ready to merge