diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 41abe90..7892c38 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -32,7 +32,7 @@ jobs: curl -sfL "https://github.com/gitleaks/gitleaks/releases/download/${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION#v}_linux_x64.tar.gz" \ | tar -xz -C /usr/local/bin gitleaks - name: Detect secrets - run: gitleaks detect --source . --redact + run: gitleaks detect --config .gitleaks.toml --source . --redact validate: name: Manifest validation diff --git a/.gitleaks.toml b/.gitleaks.toml index 249abf4..14ba0d6 100644 --- a/.gitleaks.toml +++ b/.gitleaks.toml @@ -8,5 +8,6 @@ useDefault = true description = "generated Talos inline manifests" paths = [ '''omni\/patches\/.*-inline-manifests\.yaml''', + '''omni\/cluster-templates\/patches\/.*-inline-manifests\.yaml''', '''clusters\/.*\/omni\/inline-manifests\.yaml''', ] diff --git a/clusters/unraid-lab/apps/etcd-metrics-network-policy/application.yaml b/clusters/unraid-lab/apps/etcd-metrics-network-policy/application.yaml index e1b5aa2..af7fc3e 100644 --- a/clusters/unraid-lab/apps/etcd-metrics-network-policy/application.yaml +++ b/clusters/unraid-lab/apps/etcd-metrics-network-policy/application.yaml @@ -1,5 +1,5 @@ # The Talos etcd metrics listener is unauthenticated. Only the Grafana metrics -# collector may initiate connections to control-plane port 2381. +# collector may initiate connections to control-plane port 2383. apiVersion: argoproj.io/v1alpha1 kind: Application metadata: diff --git a/clusters/unraid-lab/apps/etcd-metrics-network-policy/manifests/policy.yaml b/clusters/unraid-lab/apps/etcd-metrics-network-policy/manifests/policy.yaml index 189ae0e..3f15bba 100644 --- a/clusters/unraid-lab/apps/etcd-metrics-network-policy/manifests/policy.yaml +++ b/clusters/unraid-lab/apps/etcd-metrics-network-policy/manifests/policy.yaml @@ -19,5 +19,5 @@ spec: - remote-node toPorts: - ports: - - port: "2381" + - port: "2383" protocol: TCP diff --git a/omni/cluster-templates/oci-lab.yaml b/omni/cluster-templates/oci-lab.yaml index 6dcbaeb..0790d1d 100644 --- a/omni/cluster-templates/oci-lab.yaml +++ b/omni/cluster-templates/oci-lab.yaml @@ -4,19 +4,20 @@ labels: environment: oci kubernetes: # Not touched by the talos-images upgrade workflow — bump deliberately, one - # minor at a time. v1.37.0-beta.0 is Talos 1.14.0-beta.1's own + # minor at a time. v1.37.0-rc.0 is Talos 1.14.0-rc.1's own # DefaultKubernetesVersion (same value unraid-lab's canary uses), not an # inherited/mismatched pin — matches the Talos version below on purpose. version: v1.36.3 talos: # Keep in step with installImage in omni/machine-classes/*.yaml. - version: v1.14.0-beta.1 + version: v1.14.0-rc.1 # Patches live in the sibling patches/ directory, so paths no longer traverse # upward and no `--allowed-dir` flag is needed. `status` now works without it. patches: - file: patches/cni-none.yaml - file: patches/disable-kube-proxy.yaml - file: patches/allow-scheduling.yaml + - file: patches/talos-1.14-compat.yaml - file: patches/oci-lab-inline-manifests.yaml --- # omnictl requires ControlPlane and Workers as SEPARATE documents. They were diff --git a/omni/cluster-templates/patches/oci-lab-inline-manifests.yaml b/omni/cluster-templates/patches/oci-lab-inline-manifests.yaml index 6cd840d..a45f554 100644 --- a/omni/cluster-templates/patches/oci-lab-inline-manifests.yaml +++ b/omni/cluster-templates/patches/oci-lab-inline-manifests.yaml @@ -16,7 +16,7 @@ cluster: inlineManifests: - name: cilium - contents: "---\n# Source: cilium/templates/cilium-secrets-namespace.yaml\napiVersion: v1\nkind: Namespace\nmetadata:\n name: \"cilium-secrets\"\n labels:\n app.kubernetes.io/part-of: cilium\n---\n# Source: cilium/templates/cilium-agent/serviceaccount.yaml\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n name: \"cilium\"\n namespace: kube-system\n---\n# Source: cilium/templates/cilium-envoy/serviceaccount.yaml\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n name: \"cilium-envoy\"\n namespace: kube-system\n---\n# Source: cilium/templates/cilium-operator/serviceaccount.yaml\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n name: \"cilium-operator\"\n namespace: kube-system\n---\n# Source: cilium/templates/hubble-relay/serviceaccount.yaml\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n name: \"hubble-relay\"\n namespace: kube-system\nautomountServiceAccountToken: false\n---\n# Source: cilium/templates/hubble-ui/serviceaccount.yaml\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n name: \"hubble-ui\"\n namespace: kube-system\n---\n# Source: cilium/templates/cilium-ca-secret.yaml\napiVersion: v1\nkind: Secret\nmetadata:\n name: cilium-ca\n namespace: kube-system\ndata:\n ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURGRENDQWZ5Z0F3SUJBZ0lSQUlpNkoyUXJkaHR5b045UXM4Z3dnREl3RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEkyTURjek1USXhORFUxT0ZvWERUSTVNRGN6TURJeApORFUxT0Zvd0ZERVNNQkFHQTFVRUF4TUpRMmxzYVhWdElFTkJNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DCkFROEFNSUlCQ2dLQ0FRRUE3SVBQcEZxbVpWanJMU05Jd0pHbjU3OFpzZVh0bTFiNGRoS1FmRWtpN01EU1VEM2UKRDlUTGJsSW0wR1BUUit3YzdWUEt1RFJ3WU1ERzJxNGMwbzNKQUx4NHlQdCsyUkNzMHZ3RHdQRzdFRE5KTlN6WgpmQk1vTXZBVU1VOEl4ei9oM0g2WVRzalhGaTZyNzlhUjlHV2ZRUG9MQk1jU0tMV0ZwZ2Y2bmo1dVdYeUpjWkY3CklWYlFBSkdGTWxNeTdvZUVPWjg2L0JibkdxRzlXMlAxYThwRDQ4ZlJYcTlOT0ZWWFhXMXQvYmUwa2xLdmkxeDMKNE0wampZS2RieGxFQ1lNdWdlUnQvU25lckx5d1lmb2JxbjVpd2V4WjIva3hmZ0VDaS9TQ0pRSWZLcVR5WWJ5egoycTkwaVh6a2tpZjcrN0VDclNkc3RFeUQ5R0RnaVhVZUhwWFZ5UUlEQVFBQm8yRXdYekFPQmdOVkhROEJBZjhFCkJBTUNBcVF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUYKTUFNQkFmOHdIUVlEVlIwT0JCWUVGRG0vMGUyL0NEdWRwOTRVbTNEdjJ5aXJDUTU1TUEwR0NTcUdTSWIzRFFFQgpDd1VBQTRJQkFRQUQ0UHBRMjNsRVY5bGcyS01IT2h4cTdDOUpwMm1Bb1Z5clZrcEFGT0xXV3IzR2FCZEVMQnh2Cnhqd0M1WXZtOHkwem9uOE9VMFNNVHVEZ2l6Mm0yQkg5bjZUaTBUVm5Nc3J0WkNHakhPbWszOWZqVnhMRmdIbXQKcFdyM0pXYmtlanhreFU1VWRHcTEzSXJzQ2pwZS9vTlpBazFjdjNHNnB6Y2dXWGxZYzZWZVNkUENTcHlKTllvTwpscFl0UjFxYkJvVldrd0dUeXRvYk8yYWlvWE16ci9Kd1RhdmdQUnNqeEx2MVV5czRkcmFvcDFSdFZlb2dkZlBYCmVnVVlTM0xOUFlvUVBvTFlPeTJMdWc2Q1I3STZoelA3SVpCUkdQbGNkNTMyS0kxUzB4bUtoQVB6Q2M4aVdPMFUKRFRCbndsVXlKQi91clJZUnBvSlo3MFZjSXd2Syt0eDYKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=\n ca.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcFFJQkFBS0NBUUVBN0lQUHBGcW1aVmpyTFNOSXdKR241Nzhac2VYdG0xYjRkaEtRZkVraTdNRFNVRDNlCkQ5VExibEltMEdQVFIrd2M3VlBLdURSd1lNREcycTRjMG8zSkFMeDR5UHQrMlJDczB2d0R3UEc3RUROSk5TeloKZkJNb012QVVNVThJeHovaDNINllUc2pYRmk2cjc5YVI5R1dmUVBvTEJNY1NLTFdGcGdmNm5qNXVXWHlKY1pGNwpJVmJRQUpHRk1sTXk3b2VFT1o4Ni9CYm5HcUc5VzJQMWE4cEQ0OGZSWHE5Tk9GVlhYVzF0L2JlMGtsS3ZpMXgzCjRNMGpqWUtkYnhsRUNZTXVnZVJ0L1NuZXJMeXdZZm9icW41aXdleFoyL2t4ZmdFQ2kvU0NKUUlmS3FUeVlieXoKMnE5MGlYemtraWY3KzdFQ3JTZHN0RXlEOUdEZ2lYVWVIcFhWeVFJREFRQUJBb0lCQVFDNzRiV29ETzdUNFgvbwp1bmZIcWExbEZsUzJFajNmUVlaY1hVRHp5akY1TzIrV21KNzNtb1lEM0RUREpCbXByN0lIQWFJdkZGRVZPdTU4CnR3VmthWWQ4RXp3c0JFVHU4Q1VwOFZLV0NqRWNuSEVTVWM5dWxkVkFLYUVRem9UZHF5eWp1TmtLOU5hUDQ0Rm8KSTk2TDg5SS9qcUlFS0pPUFRTdWZDZ1dYZ1dhdHBBNmxhWTMzUWdSbmRkMURWa2ExVE9uTTRYNTRKZGliOEhidQpRWTZLanBSOFBXbVZ1YjF0Nm5XVmVYblNxNmUzakFkcW14S25XNlhOWnNPUm9tSW9mKytINUx0WjRKZ1FlSGM3CnZUbXVHUGt5SHlielRiRW5sVmFORDNNZ0Nrc3pCYXh1eTVLUVlZdnZkNnhhNStVZ21iQ2dCTWwvbjBEbE41TzMKZ1p4T1IzSDFBb0dCQVBWTC9rdTJkbi9vWFBRUnFLK0EzSEh2anhrR0xodU8wa0hTRG4vR1JZVDVyV1lRSXA4ZgpVMVdjd3JSenJoRW5YcjdlclFXNENNOUFvT3VVWjh6UzVWYXFQNWo1N0cxK0NxQ3k3Vm54TlVsUENNMlY2UGZGCnJhUXB5UlE1K2lWeHBBUStqSzg1dG9ZcGViazl5VUhNc0xnRkN2cGRPZ2VhOU1RNk5lN3lNVUFEQW9HQkFQYlYKdU1hMFRuVVRSWjhhQXFMaHJ5Vzd2V3E1U0VWUWd5V2JuUzN6bnBzTnJPNWxqUlVnZDhzcE5XVjFHakZwOWZuZwphdjJsZTY0aEpQQm54K2VGTkZ5ZTBERVRrTlNEQUEwZHJwNGl1Q0Y3c3U5aE9uVStJTXhsZm1Yd2x5K2RaTUVYCnRLUWJiL3BHWFpsMGEza0lJRFF2bnNySDVDaEFUV2hBaHhkTHBnZERBb0dBUjk3bU9VVFMzNU16ZVFlYmh5Q1kKZG9HY1NkYTN0N2RXLzVZT1RYM0liTGZEQ0g1OXhtV2xReFpWTGc0ZTJFUFN6Tlh0bUJsZDYydWlPcVFXN2JwMQpHN2x5UE40dFdiOXVXYnRUTStFcW5ib2NlREFPUEZxZEQ5WjJaZ2krdEMzaHdxU1pEOVkzRm9RY2VCd1VWY1VsCm1pVlFIQjhvbTRYWlpZMHd0RHdlRmdVQ2dZRUFxbURKdzNhdjlVWVJONG9ucWJDb1NoNTExOVgrMmNHQ1ZSSSsKQTNyMnpzWTR5UEdWMmJCb24vWlk0aWhicFNJajVKQVFxZlp4RWJmVkhKQTJQMHdGNGF6SnZpWm9RUmdQai80ZQpDdytpRTVLajUzSXdmTDhldXBlUUVPTnFLRGEzVmtWN3JnODJVd1lCRTZ4MWhyeWlKZ044MHpINC9nT3NxcnBuCnhSKzFnYXNDZ1lFQWpwZ3VzaGdEWnRncnpZUU95bzU1YkpLOUkrMGd0S2lESEpwZ1RTZlBETEgydDA1bVp4RnMKbVJKMUN4WGtrTlVJVlRsK08rT2FnL1FqSHpaNDhLUkFzUUtSSGhKVFFmTWcwbGNET085eEdZb0lqK0tneVBLagpXRG5NTllkczY3VTJJaEtEaFVEUDFXYXZGU0JENzJWNDBLdzFBRFpVWDM5WkZUK0V0d3FkbXIwPQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=\n---\n# Source: cilium/templates/hubble/tls-helm/relay-client-secret.yaml\napiVersion: v1\nkind: Secret\nmetadata:\n name: hubble-relay-client-certs\n namespace: kube-system\ntype: kubernetes.io/tls\ndata:\n ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURGRENDQWZ5Z0F3SUJBZ0lSQUlpNkoyUXJkaHR5b045UXM4Z3dnREl3RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEkyTURjek1USXhORFUxT0ZvWERUSTVNRGN6TURJeApORFUxT0Zvd0ZERVNNQkFHQTFVRUF4TUpRMmxzYVhWdElFTkJNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DCkFROEFNSUlCQ2dLQ0FRRUE3SVBQcEZxbVpWanJMU05Jd0pHbjU3OFpzZVh0bTFiNGRoS1FmRWtpN01EU1VEM2UKRDlUTGJsSW0wR1BUUit3YzdWUEt1RFJ3WU1ERzJxNGMwbzNKQUx4NHlQdCsyUkNzMHZ3RHdQRzdFRE5KTlN6WgpmQk1vTXZBVU1VOEl4ei9oM0g2WVRzalhGaTZyNzlhUjlHV2ZRUG9MQk1jU0tMV0ZwZ2Y2bmo1dVdYeUpjWkY3CklWYlFBSkdGTWxNeTdvZUVPWjg2L0JibkdxRzlXMlAxYThwRDQ4ZlJYcTlOT0ZWWFhXMXQvYmUwa2xLdmkxeDMKNE0wampZS2RieGxFQ1lNdWdlUnQvU25lckx5d1lmb2JxbjVpd2V4WjIva3hmZ0VDaS9TQ0pRSWZLcVR5WWJ5egoycTkwaVh6a2tpZjcrN0VDclNkc3RFeUQ5R0RnaVhVZUhwWFZ5UUlEQVFBQm8yRXdYekFPQmdOVkhROEJBZjhFCkJBTUNBcVF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUYKTUFNQkFmOHdIUVlEVlIwT0JCWUVGRG0vMGUyL0NEdWRwOTRVbTNEdjJ5aXJDUTU1TUEwR0NTcUdTSWIzRFFFQgpDd1VBQTRJQkFRQUQ0UHBRMjNsRVY5bGcyS01IT2h4cTdDOUpwMm1Bb1Z5clZrcEFGT0xXV3IzR2FCZEVMQnh2Cnhqd0M1WXZtOHkwem9uOE9VMFNNVHVEZ2l6Mm0yQkg5bjZUaTBUVm5Nc3J0WkNHakhPbWszOWZqVnhMRmdIbXQKcFdyM0pXYmtlanhreFU1VWRHcTEzSXJzQ2pwZS9vTlpBazFjdjNHNnB6Y2dXWGxZYzZWZVNkUENTcHlKTllvTwpscFl0UjFxYkJvVldrd0dUeXRvYk8yYWlvWE16ci9Kd1RhdmdQUnNqeEx2MVV5czRkcmFvcDFSdFZlb2dkZlBYCmVnVVlTM0xOUFlvUVBvTFlPeTJMdWc2Q1I3STZoelA3SVpCUkdQbGNkNTMyS0kxUzB4bUtoQVB6Q2M4aVdPMFUKRFRCbndsVXlKQi91clJZUnBvSlo3MFZjSXd2Syt0eDYKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=\n tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURTRENDQWpDZ0F3SUJBZ0lRRTMxdkc5K01nQkFHbTJhQ0VmaDJYakFOQmdrcWhraUc5dzBCQVFzRkFEQVUKTVJJd0VBWURWUVFERXdsRGFXeHBkVzBnUTBFd0hoY05Nall3TnpNeE1qRTBOVFU1V2hjTk1qY3dOek14TWpFMApOVFU1V2pBak1TRXdId1lEVlFRRERCZ3FMbWgxWW1Kc1pTMXlaV3hoZVM1amFXeHBkVzB1YVc4d2dnRWlNQTBHCkNTcUdTSWIzRFFFQkFRVUFBNElCRHdBd2dnRUtBb0lCQVFEdk5uWGtHSEJGUjkySjdzNG5tUzVpMzgxRGdmZEcKNVhzcHlOcnJzR1pmNGJkMjRMa0hWSUlnYkdPM1lna1VPZHE1WXBQeVBidlI5bjIrV2lZY0dnWmxqT2UzV0htdApSanUyeThvcUZhOGljK21oTFd1SjhnOENwdW5CTTRvT0RsT055VVNPekx6VXpLNUFTUGNscG5uWWJNZ3d5TXhHCjZzNnMyUkNwL0dFMVFGdWc0ZnkvLyszaHlkZnBGdy9nQVRhMXZydVpDZTllZHl6Vzl6d0FLNURnVUdrN2JpVUgKNHlEOTZITU9tTjNEb3dMUCtKUTV0M2dXLzM3aDkzR0VvdXhhdFhGSGw3ZlppdHUxbWxtTWplOUNKZUVNa0pEOAorZlBsVGxWNlRtb2p1Zzg4ZGxqU2g4RlpUaXFGaUQwT1VBd2NuMEhQOUN1K2JuMnlDV3BpbENzNUFnTUJBQUdqCmdZWXdnWU13RGdZRFZSMFBBUUgvQkFRREFnV2dNQjBHQTFVZEpRUVdNQlFHQ0NzR0FRVUZCd01CQmdnckJnRUYKQlFjREFqQU1CZ05WSFJNQkFmOEVBakFBTUI4R0ExVWRJd1FZTUJhQUZEbS8wZTIvQ0R1ZHA5NFVtM0R2MnlpcgpDUTU1TUNNR0ExVWRFUVFjTUJxQ0dDb3VhSFZpWW14bExYSmxiR0Y1TG1OcGJHbDFiUzVwYnpBTkJna3Foa2lHCjl3MEJBUXNGQUFPQ0FRRUFxK1l0ZFN0ck9DSzBQd21aTGE2ZTZ5OUhNSU41YWlwN2hzUk1qNnpEYlkxelhONysKL2FqZFV4eW9iQzJpbTEyVXdaRUpHTkJteC9aQzhTRUpZVHpjejhQc1pTTTZ2U3ZjeTk5QzJPYVdTL0JiK3RRVgpFdlJRTm9oWlU1dTlPZFViNmFxNGUwaTRCaXlkenAzaldJL1J6b0lOOWJzWUJVS2hVVk5qditSVG5UbUFUcVRHClV3aWpMd0g0aTJ6VDdkbk1XNkFGN2FiY1pucEc5emc3bmRTNHdxNVhvS2xHdEdCRXdZSUhXYUxvUXBxdmdTL2EKNDdhVFNxNDdRQjlyek5OTmhYUENhSlFDbFFlT3JqVmc1RTJEcmw0RnZnSnlDS3lWRWtMVzE4K1BYY3FnZXo3TApKY3hzSk01dFBVZmo5TUJTMVFJdTA4SlAwRFZuekVOOHJIQTl4Zz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K\n tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcFFJQkFBS0NBUUVBN3paMTVCaHdSVWZkaWU3T0o1a3VZdC9OUTRIM1J1VjdLY2phNjdCbVgrRzNkdUM1CkIxU0NJR3hqdDJJSkZEbmF1V0tUOGoyNzBmWjl2bG9tSEJvR1pZem50MWg1clVZN3RzdktLaFd2SW5QcG9TMXIKaWZJUEFxYnB3VE9LRGc1VGpjbEVqc3k4MU15dVFFajNKYVo1Mkd6SU1Nak1SdXJPck5rUXFmeGhOVUJib09IOAp2Ly90NGNuWDZSY1A0QUUydGI2N21RbnZYbmNzMXZjOEFDdVE0RkJwTzI0bEIrTWcvZWh6RHBqZHc2TUN6L2lVCk9iZDRGdjkrNGZkeGhLTHNXclZ4UjVlMzJZcmJ0WnBaakkzdlFpWGhESkNRL1BuejVVNVZlazVxSTdvUFBIWlkKMG9mQldVNHFoWWc5RGxBTUhKOUJ6L1Fydm01OXNnbHFZcFFyT1FJREFRQUJBb0lCQVFDckVCVUtRbmUyODRkMwpwZkNDM01ZUkt0NU0wbG9VdHZKMmxRNEkwYUxFR2xQcWpSV0VLbWpMNnZiOEl2MC9HNGhRWGpCU1lOYzVkTDNECkxCQm90Q3V5M3lxdE1IWUM5V0NxZmQxYWJ4dEkxZjlTcFhwcnNWQU9vM0l5R1RzMmhnUTJOcUh5UkhNYzhpb0MKQ3F2Q251UXZZc3RlSjVuOWROakxQb2J1S0c4VGRrcVVFb0NMZTdpR0FRUDhCdkpLaEQ0UTNpeU5FNjZvd0dIVQp3Vld1UjIySXcrd015bXJ4U1gvRDRZdW9WUW9Pa2J2ZWNnTzBTelA1NzZ2c2pIR3RPMVZlcEFXMG4zOWozbWVYCmttQlExTm1kblZ2OXNpd2xLbnhJS3hSaWdzMWRqbEVqVUVhSkt2ZEZoY0FkT3Q1cHhodzVQZDA5MjlEa3BnRlQKdXpqblkvZ2hBb0dCQVBNOUFjTkN3VkVwZ0UveVFiTkxyd1ZFSnhTa1R1YVhJNlVGM2FOaU9qNGZzampJdjFuUAptUzUxZVRYWml6ZGUyc2pObTVVd01VNjBVQ1pwZWVWbUtlZ0xjZzJQVGVsUjBZbzI4MDNHeEhMY1ZQSnpISHBGClBXdEZmUFUwR2xlOWpkOUlWQ29tU1Z3bkVnblpyRVkzNit5MVZVTUdHZEpBeElLQldWNGF3dHFWQW9HQkFQdkQKWXB1MndFYzJsMGhnV2NTZWJHNWwyTkpTQ2FsSWF5V05vaGxFNDR4VEttcENDRUlZQm83RmVaWmRhcURta2NrKwpLb01ZRlBKbEdlcmNmbU1uSndNa0RGWjI4Tk1SUWNLNjVGQUx1SlUzVzlUbUM4MURZbC9uZEgyZTBaQmU0R2pNCkZpZXNUOTlkZmNtVnJUVktjL1BoL0E0c0RNTmttODBPYkxSS0JRa1ZBb0dBREkxYlorNHI5N3BDaXQyZmtsY1gKZ3hnUFJEdHVidXZoeFFSV2ViWDU5M2EvUmJybVZRWW5pNFE0YXhUODREQ2U3Ym5laTRaZkpRYWRGRDVoTWZ0aApzajNVOXVvc1JSd1p5aDRuMUIycnlabWhNSm5NSUdzdVRqalp4L1dXWG16RHc0QUNCK0xONmxtQnpzeFMzWlRKCk1mL3hsSEhlSjBGOFlwZTJPdXI2bnprQ2dZRUF0L2U1Q1pITUJQMldKRlFMcElvakw3U0tjSDEwQTlnZ08ydTQKWklDYlNnSEhmNmZLd3drdFdZeGhZWWZYajhXTUNDSytDOWRBRHpQamNXUTNrcHFjZmtZTUllNTk0YTI5Z043eQpVSytQN0xGc0VERWR0SnNsdW5DMkJjbFUxd3NOTG1iYlZaZ3JNVXZ1eTZ2c3lvRWlJN2NoYVBXMVNkNHRudlNJCmFHR2lObFVDZ1lFQTA4SDZnTVE2V282QjRxUXd2S2FoT0F0NElEdk52UUdCWUlRWXZhd3o4Q2pqSVEyWVhGanQKNmRUUUZxWlRVOGt3Ui8yK21nTWZFSnh3K014V0FtNUVXSTZkZnV6U0s1ckxVYjFWSWFDWUdBYW9aL1JwcDgzTApLb1VTTDd6d0dNQWlDN0JrV3E0WWJ1cVNjOG90Y3hFakRteVhhL3VnODM5TjdZUUNreFlQU21vPQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=\n---\n# Source: cilium/templates/hubble/tls-helm/server-secret.yaml\napiVersion: v1\nkind: Secret\nmetadata:\n name: hubble-server-certs\n namespace: kube-system\ntype: kubernetes.io/tls\ndata:\n ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURGRENDQWZ5Z0F3SUJBZ0lSQUlpNkoyUXJkaHR5b045UXM4Z3dnREl3RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEkyTURjek1USXhORFUxT0ZvWERUSTVNRGN6TURJeApORFUxT0Zvd0ZERVNNQkFHQTFVRUF4TUpRMmxzYVhWdElFTkJNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DCkFROEFNSUlCQ2dLQ0FRRUE3SVBQcEZxbVpWanJMU05Jd0pHbjU3OFpzZVh0bTFiNGRoS1FmRWtpN01EU1VEM2UKRDlUTGJsSW0wR1BUUit3YzdWUEt1RFJ3WU1ERzJxNGMwbzNKQUx4NHlQdCsyUkNzMHZ3RHdQRzdFRE5KTlN6WgpmQk1vTXZBVU1VOEl4ei9oM0g2WVRzalhGaTZyNzlhUjlHV2ZRUG9MQk1jU0tMV0ZwZ2Y2bmo1dVdYeUpjWkY3CklWYlFBSkdGTWxNeTdvZUVPWjg2L0JibkdxRzlXMlAxYThwRDQ4ZlJYcTlOT0ZWWFhXMXQvYmUwa2xLdmkxeDMKNE0wampZS2RieGxFQ1lNdWdlUnQvU25lckx5d1lmb2JxbjVpd2V4WjIva3hmZ0VDaS9TQ0pRSWZLcVR5WWJ5egoycTkwaVh6a2tpZjcrN0VDclNkc3RFeUQ5R0RnaVhVZUhwWFZ5UUlEQVFBQm8yRXdYekFPQmdOVkhROEJBZjhFCkJBTUNBcVF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUYKTUFNQkFmOHdIUVlEVlIwT0JCWUVGRG0vMGUyL0NEdWRwOTRVbTNEdjJ5aXJDUTU1TUEwR0NTcUdTSWIzRFFFQgpDd1VBQTRJQkFRQUQ0UHBRMjNsRVY5bGcyS01IT2h4cTdDOUpwMm1Bb1Z5clZrcEFGT0xXV3IzR2FCZEVMQnh2Cnhqd0M1WXZtOHkwem9uOE9VMFNNVHVEZ2l6Mm0yQkg5bjZUaTBUVm5Nc3J0WkNHakhPbWszOWZqVnhMRmdIbXQKcFdyM0pXYmtlanhreFU1VWRHcTEzSXJzQ2pwZS9vTlpBazFjdjNHNnB6Y2dXWGxZYzZWZVNkUENTcHlKTllvTwpscFl0UjFxYkJvVldrd0dUeXRvYk8yYWlvWE16ci9Kd1RhdmdQUnNqeEx2MVV5czRkcmFvcDFSdFZlb2dkZlBYCmVnVVlTM0xOUFlvUVBvTFlPeTJMdWc2Q1I3STZoelA3SVpCUkdQbGNkNTMyS0kxUzB4bUtoQVB6Q2M4aVdPMFUKRFRCbndsVXlKQi91clJZUnBvSlo3MFZjSXd2Syt0eDYKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=\n tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURWakNDQWo2Z0F3SUJBZ0lRTjZhMlVyemRZR2lQa1l4V1N6STBmakFOQmdrcWhraUc5dzBCQVFzRkFEQVUKTVJJd0VBWURWUVFERXdsRGFXeHBkVzBnUTBFd0hoY05Nall3TnpNeE1qRTBOVFU0V2hjTk1qY3dOek14TWpFMApOVFU0V2pBcU1TZ3dKZ1lEVlFRRERCOHFMbVJsWm1GMWJIUXVhSFZpWW14bExXZHljR011WTJsc2FYVnRMbWx2Ck1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBMVBiTGhnZTRIc3lUdzMzMXVkVEwKRmlVd1Jrdmk3UWtIb2RFVFhvK0lXUjkyU2Z6dW8yTWFROWtxQ2E0eElXNnZkNWorRFVnSmY1QXY5eUNCNHRlYgpFaEJVd0dzQzJrVFBuUXd0NUNmMmNuV1V4ZmdHOWVGbjF4bkxLdmRFTWN3NW9GYUZrbjRqOGdPdXVWTzZnbk4yCkJHbVNteXE4Y21NdHg1a2V4dWZHRTBhOWx0ZGdhNlh4N0w1VXA1YkVZRTdnWUZ1bWtNWDVlVmx1OXpDRks1TXYKQUd3ZXN2eWFLMGR6TGNCTVUrRVpJRFdndjdzclV4WGZyanRFdGE0ZjZJUEdpUUNPZTYzMEdtMUpxbTM1dW54NAp3RmhHUENKQ3FYQmF1NzNPNDhoZnVJODQ1SnprQ0V3SDVvTjRkM0hmcEttWjl3RXAwZmcwR09aaFpQUHRIdUJICnl3SURBUUFCbzRHTk1JR0tNQTRHQTFVZER3RUIvd1FFQXdJRm9EQWRCZ05WSFNVRUZqQVVCZ2dyQmdFRkJRY0QKQVFZSUt3WUJCUVVIQXdJd0RBWURWUjBUQVFIL0JBSXdBREFmQmdOVkhTTUVHREFXZ0JRNXY5SHR2d2c3bmFmZQpGSnR3Nzlzb3F3a09lVEFxQmdOVkhSRUVJekFoZ2g4cUxtUmxabUYxYkhRdWFIVmlZbXhsTFdkeWNHTXVZMmxzCmFYVnRMbWx2TUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFBckMyUGxvbzFQdTJBbHk0TTJ5RlR5UG1rZ21xRDMKeXlQWmlOL3Q5UW02N051RjhONkc0NDZsVGZxa3JSWm1UTXUwN1B1eXRYeEJqMGRoRlNjN2xuT2JFc3BVVFJUQwpWcG41c2NESC9pWUMya0h0TWliY04wNVloWWRPVmt2ZUo3R2VvaFh5eElxdERQai9CZS9JQlBpRTZ6c0EwVWEvCk5qYXZSQ1ZGa29jLzVyUnRTb0VYbTBwNHpabGUvZzBEM1hsY3BjT2Nld1Q5MHBkWFJGUzVKb09XVDZ2QlZ0Q3UKUE1VTHcxQnZrZDBrRnZSVHhWeGpGeGoyZ2FLVSt4dFhsSEhWS2krNXpGYmxVVUFjUkpXbEZ2L2xHeElzaXlxRgppVDFIMEd5WmJsanJzWEt6REdpNFBCNzFDSWdZcjEycjhaaGRuWC9xQmNMbEplaFAwV0UwVHpacQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==\n tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBMVBiTGhnZTRIc3lUdzMzMXVkVExGaVV3Umt2aTdRa0hvZEVUWG8rSVdSOTJTZnp1Cm8yTWFROWtxQ2E0eElXNnZkNWorRFVnSmY1QXY5eUNCNHRlYkVoQlV3R3NDMmtUUG5Rd3Q1Q2YyY25XVXhmZ0cKOWVGbjF4bkxLdmRFTWN3NW9GYUZrbjRqOGdPdXVWTzZnbk4yQkdtU215cThjbU10eDVrZXh1ZkdFMGE5bHRkZwphNlh4N0w1VXA1YkVZRTdnWUZ1bWtNWDVlVmx1OXpDRks1TXZBR3dlc3Z5YUswZHpMY0JNVStFWklEV2d2N3NyClV4WGZyanRFdGE0ZjZJUEdpUUNPZTYzMEdtMUpxbTM1dW54NHdGaEdQQ0pDcVhCYXU3M080OGhmdUk4NDVKemsKQ0V3SDVvTjRkM0hmcEttWjl3RXAwZmcwR09aaFpQUHRIdUJIeXdJREFRQUJBb0lCQUc3UXRQcmJUVzJKV21KaApTdG9WNWs5eHJuc0Z4ZUU5ejZEZUlFd1dPQWJZSGo5RnhBOTA1QmZtQ3IvYXltbnhKSkVCSlVGWCtNbE9DQWQ1Ci9OeERBTWdYZzJKVXpMa3pFUzFSUnhmdnk0ZW5zM0NJTFdjSWtYWVdUK2ZkbnJpaTRtR1NaQkxrWEdQMGtwaVEKL3Y0ZWdveXRPc0pQTEp3QkM3Tk84L3JnWSt0bThwNmdaOFQ5NkxwcytDV0lWQkYrS01pU1VQckh4ek1JQVVwagprb045eWp3TEtES01LRmwxTnVvZVBWOXlYUllDQkpuLzM0RmpEZ1JUMzJiT1k1a2h6bllBcHlCOEdNZWdHb3dUCmRoUWNlV0VzNEFTUmoyTVRmMDVXbmVHYVlJSU9nS1l3bzUzRFlJN1ZaTXRQOHd0SWRSOEFON3BaZi9zUXRTZFcKOURlVDZRRUNnWUVBOTBUbndMY1RqLzcxNzFpWTFlVCtEUzdRSXVmT3JyVTlxNXF3eWwvbXRXVk85MHNxVEFmMQpzd1BPRE1OcVplZ1ZReVRJRnF3UXdiaXJNRFdlV1ZyTGluRW0zM0FPWU51dTVtK2pRRzFJN2lOeWJiczBxOS9xClYrbnRFdFVSRlhGelhGWjluUHBMUndaeHhSeGFIaW9pNllZRmx6OTMzZGdNNktkNDE2enpNOEVDZ1lFQTNIdk4KUVJ1b3FrTkNMdWpzdHJqTG9yazdOWDF6U29FMmg4RHZSbm5RK2IveWYzcUdxTGdRYkVHLzNhbHJKb1cxbVJyUgpmNkdVcnV3RHp1K3d6M1hhS3ovSFZCVlgxRy9nanNTdHE4Y0JCaDV2VVdZV0srM3BCaWRrL25vUUJWRHpSaVJUClRVQ2JZTUZsZHgyQUxJaGJpVjFSMGozUWVsOUswdlVtcmZzbXJvc0NnWUVBb1VhUEJkSWk3ME56TXZZTlVVMDMKS25BRER4RTBiQjBJS1RvTzN5QW53TjVmMzhsbHdBdGRCTEtSblIrRDhRMnJlSXl2K0tHbm1FS1RYVEZMbzZvbApvWmxscWt4VEJIZWtudVhuaTZqNzdWNnZUc1RRZU4zbDRndFFObjFEMUVHWDVYMEFGdmZsUzJEM3FZRnhnY1VuCjJqb3d3VktESXUyOGxhNU5raFphMWNFQ2dZQiszY1czSndFZ0oxOVh1ck1xV0o3ajNRMlNzOEs1Sml5SVpKM0oKd2FKYmN2VklJT3FHL3BLRW1EaWNoVFdnanVOMVc1Y2NoNDhVTDczcFBzWlFPWkgxdk5jbkxMakRCalVDTVcxMQpJQ2NZckQ2RmFlWnNGSk0yOVVnSm5aYkdXRlFERWpmVWhjNWlHQ1lZS2lOc2ZIR2ZVdEVYMW5XMVZFdXJvMkJFClQvVnNEUUtCZ1FDaE1kRTZzL2tWcGxJVitqbVk0YzBhTUR1d2pqSldMSXpDQkZCZFVCNjRwelBTT1pKakxLcmoKd091emV3V1RYMTQvZm9QenAwbHIyc2YrK09CTExCa3A4L0RhTlE3TlhWTVBwd1VaU0xFNHkzQXEzMVR0Y2J0cwpxYjk1VktHUVpXSC9FSW0veExtem43N0VLTVVXTFpMS1laNnJKWFBZQktwZlVYUm1UTjJDWVE9PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=\n---\n# Source: cilium/templates/cilium-configmap.yaml\napiVersion: v1\nkind: ConfigMap\nmetadata:\n name: cilium-config\n namespace: kube-system\ndata:\n\n # Identity allocation mode selects how identities are shared between cilium\n # nodes by setting how they are stored. The options are \"crd\", \"kvstore\" or\n # \"doublewrite-readkvstore\" / \"doublewrite-readcrd\".\n # - \"crd\" stores identities in kubernetes as CRDs (custom resource definition).\n # These can be queried with:\n # kubectl get ciliumid\n # - \"kvstore\" stores identities in an etcd kvstore, that is\n # configured below. Cilium versions before 1.6 supported only the kvstore\n # backend. Upgrades from these older cilium versions should continue using\n # the kvstore by commenting out the identity-allocation-mode below, or\n # setting it to \"kvstore\".\n # - \"doublewrite\" modes store identities in both the kvstore and CRDs. This is useful\n # for seamless migrations from the kvstore mode to the crd mode. Consult the\n # documentation for more information on how to perform the migration.\n identity-allocation-mode: crd\n\n identity-heartbeat-timeout: \"30m0s\"\n identity-gc-interval: \"15m0s\"\n cilium-endpoint-gc-interval: \"5m0s\"\n nodes-gc-interval: \"5m0s\"\n\n # If you want to run cilium in debug mode change this value to true\n debug: \"false\"\n debug-verbose: \"\"\n # The agent can be put into the following three policy enforcement modes\n # default, always and never.\n # https://docs.cilium.io/en/latest/security/policy/intro/#policy-enforcement-modes\n enable-policy: \"default\"\n policy-cidr-match-mode: \"\"\n # If you want metrics enabled in cilium-operator, set the port for\n # which the Cilium Operator will have their metrics exposed.\n # NOTE that this will open the port on the nodes where Cilium operator pod\n # is scheduled.\n operator-prometheus-serve-addr: \":9963\"\n enable-metrics: \"true\"\n enable-policy-secrets-sync: \"true\"\n policy-secrets-only-from-secrets-namespace: \"true\"\n policy-secrets-namespace: \"cilium-secrets\"\n\n # Enable IPv4 addressing. If enabled, all endpoints are allocated an IPv4\n # address.\n enable-ipv4: \"true\"\n\n # Enable IPv6 addressing. If enabled, all endpoints are allocated an IPv6\n # address.\n enable-ipv6: \"false\"\n # Users who wish to specify their own custom CNI configuration file must set\n # custom-cni-conf to \"true\", otherwise Cilium may overwrite the configuration.\n custom-cni-conf: \"false\"\n enable-bpf-clock-probe: \"false\"\n # If you want cilium monitor to aggregate tracing for packets, set this level\n # to \"low\", \"medium\", or \"maximum\". The higher the level, the less packets\n # that will be seen in monitor output.\n monitor-aggregation: medium\n\n # The monitor aggregation interval governs the typical time between monitor\n # notification events for each allowed connection.\n #\n # Only effective when monitor aggregation is set to \"medium\" or higher.\n monitor-aggregation-interval: \"5s\"\n\n # The monitor aggregation flags determine which TCP flags which, upon the\n # first observation, cause monitor notifications to be generated.\n #\n # Only effective when monitor aggregation is set to \"medium\" or higher.\n monitor-aggregation-flags: all\n # Specifies the ratio (0.0-1.0] of total system memory to use for dynamic\n # sizing of the TCP CT, non-TCP CT, NAT and policy BPF maps.\n bpf-map-dynamic-size-ratio: \"0.0025\"\n # bpf-policy-map-max specifies the maximum number of entries in endpoint\n # policy map (per endpoint)\n bpf-policy-map-max: \"16384\"\n # bpf-lb-map-max specifies the maximum number of entries in bpf lb service,\n # backend and affinity maps.\n bpf-lb-map-max: \"65536\"\n bpf-lb-external-clusterip: \"false\"\n bpf-lb-source-range-all-types: \"false\"\n bpf-lb-algorithm-annotation: \"false\"\n bpf-lb-mode-annotation: \"false\"\n\n bpf-distributed-lru: \"false\"\n bpf-events-drop-enabled: \"true\"\n bpf-events-policy-verdict-enabled: \"true\"\n bpf-events-trace-enabled: \"true\"\n\n # Pre-allocation of map entries allows per-packet latency to be reduced, at\n # the expense of up-front memory allocation for the entries in the maps. The\n # default value below will minimize memory usage in the default installation;\n # users who are sensitive to latency may consider setting this to \"true\".\n #\n # This option was introduced in Cilium 1.4. Cilium 1.3 and earlier ignore\n # this option and behave as though it is set to \"true\".\n #\n # If this value is modified, then during the next Cilium startup the restore\n # of existing endpoints and tracking of ongoing connections may be disrupted.\n # As a result, reply packets may be dropped and the load-balancing decisions\n # for established connections may change.\n #\n # If this option is set to \"false\" during an upgrade from 1.3 or earlier to\n # 1.4 or later, then it may cause one-time disruptions during the upgrade.\n preallocate-bpf-maps: \"false\"\n\n # Name of the cluster. Only relevant when building a mesh of clusters.\n cluster-name: default\n # Unique ID of the cluster. Must be unique across all conneted clusters and\n # in the range of 1 and 255. Only relevant when building a mesh of clusters.\n cluster-id: \"0\"\n\n # Encapsulation mode for communication between nodes\n # Possible values:\n # - disabled\n # - vxlan (default)\n # - geneve\n\n routing-mode: \"tunnel\"\n tunnel-protocol: \"vxlan\"\n tunnel-source-port-range: \"0-0\"\n service-no-backend-response: \"reject\"\n\n\n # Enables L7 proxy for L7 policy enforcement and visibility\n enable-l7-proxy: \"true\"\n\n enable-ipv4-masquerade: \"true\"\n enable-ipv4-big-tcp: \"false\"\n enable-ipv6-big-tcp: \"false\"\n enable-ipv6-masquerade: \"true\"\n enable-tcx: \"true\"\n datapath-mode: \"veth\"\n enable-masquerade-to-route-source: \"false\"\n\n enable-xt-socket-fallback: \"true\"\n install-no-conntrack-iptables-rules: \"false\"\n iptables-random-fully: \"false\"\n\n auto-direct-node-routes: \"false\"\n direct-routing-skip-unreachable: \"false\"\n enable-local-redirect-policy: \"false\"\n enable-runtime-device-detection: \"true\"\n\n kube-proxy-replacement: \"true\"\n kube-proxy-replacement-healthz-bind-address: \"\"\n bpf-lb-sock: \"false\"\n nodeport-addresses: \"\"\n enable-health-check-nodeport: \"true\"\n enable-health-check-loadbalancer-ip: \"false\"\n node-port-bind-protection: \"true\"\n enable-auto-protect-node-port-range: \"true\"\n bpf-lb-acceleration: \"disabled\"\n enable-experimental-lb: \"false\"\n enable-svc-source-range-check: \"true\"\n enable-l2-neigh-discovery: \"true\"\n arping-refresh-period: \"30s\"\n k8s-require-ipv4-pod-cidr: \"false\"\n k8s-require-ipv6-pod-cidr: \"false\"\n enable-k8s-networkpolicy: \"true\"\n enable-endpoint-lockdown-on-policy-overflow: \"false\"\n # Tell the agent to generate and write a CNI configuration file\n write-cni-conf-when-ready: /host/etc/cni/net.d/05-cilium.conflist\n cni-exclusive: \"true\"\n cni-log-file: \"/var/run/cilium/cilium-cni.log\"\n enable-endpoint-health-checking: \"true\"\n enable-health-checking: \"true\"\n health-check-icmp-failure-threshold: \"3\"\n enable-well-known-identities: \"false\"\n enable-node-selector-labels: \"false\"\n synchronize-k8s-nodes: \"true\"\n operator-api-serve-addr: \"127.0.0.1:9234\"\n\n enable-hubble: \"true\"\n # UNIX domain socket for Hubble server to listen to.\n hubble-socket-path: \"/var/run/cilium/hubble.sock\"\n hubble-export-file-max-size-mb: \"10\"\n hubble-export-file-max-backups: \"5\"\n # An additional address for Hubble server to listen to (e.g. \":4244\").\n hubble-listen-address: \":4244\"\n hubble-disable-tls: \"false\"\n hubble-tls-cert-file: /var/lib/cilium/tls/hubble/server.crt\n hubble-tls-key-file: /var/lib/cilium/tls/hubble/server.key\n hubble-tls-client-ca-files: /var/lib/cilium/tls/hubble/client-ca.crt\n ipam: \"kubernetes\"\n ipam-cilium-node-update-rate: \"15s\"\n\n default-lb-service-ipam: \"lbipam\"\n egress-gateway-reconciliation-trigger-interval: \"1s\"\n enable-vtep: \"false\"\n vtep-endpoint: \"\"\n vtep-cidr: \"\"\n vtep-mask: \"\"\n vtep-mac: \"\"\n procfs: \"/host/proc\"\n bpf-root: \"/sys/fs/bpf\"\n cgroup-root: \"/run/cilium/cgroupv2\"\n enable-k8s-terminating-endpoint: \"true\"\n enable-sctp: \"false\"\n remove-cilium-node-taints: \"true\"\n set-cilium-node-taints: \"true\"\n set-cilium-is-up-condition: \"true\"\n unmanaged-pod-watcher-interval: \"15\"\n # default DNS proxy to transparent mode in non-chaining modes\n dnsproxy-enable-transparent-mode: \"true\"\n dnsproxy-socket-linger-timeout: \"10\"\n tofqdns-dns-reject-response-code: \"refused\"\n tofqdns-enable-dns-compression: \"true\"\n tofqdns-endpoint-max-ip-per-hostname: \"1000\"\n tofqdns-idle-connection-grace-period: \"0s\"\n tofqdns-max-deferred-connection-deletes: \"10000\"\n tofqdns-proxy-response-max-delay: \"100ms\"\n agent-not-ready-taint-key: \"node.cilium.io/agent-not-ready\"\n\n mesh-auth-enabled: \"true\"\n mesh-auth-queue-size: \"1024\"\n mesh-auth-rotated-identities-queue-size: \"1024\"\n mesh-auth-gc-interval: \"5m0s\"\n\n proxy-xff-num-trusted-hops-ingress: \"0\"\n proxy-xff-num-trusted-hops-egress: \"0\"\n proxy-connect-timeout: \"2\"\n proxy-initial-fetch-timeout: \"30\"\n proxy-max-requests-per-connection: \"0\"\n proxy-max-connection-duration-seconds: \"0\"\n proxy-idle-timeout-seconds: \"60\"\n proxy-max-concurrent-retries: \"128\"\n http-retry-count: \"3\"\n\n external-envoy-proxy: \"true\"\n envoy-base-id: \"0\"\n envoy-access-log-buffer-size: \"4096\"\n envoy-keep-cap-netbindservice: \"false\"\n max-connected-clusters: \"255\"\n clustermesh-enable-endpoint-sync: \"false\"\n clustermesh-enable-mcs-api: \"false\"\n\n nat-map-stats-entries: \"32\"\n nat-map-stats-interval: \"30s\"\n enable-internal-traffic-policy: \"true\"\n enable-lb-ipam: \"true\"\n enable-non-default-deny-policies: \"true\"\n enable-source-ip-verification: \"true\"\n\n# Extra config allows adding arbitrary properties to the cilium config.\n# By putting it at the end of the ConfigMap, it's also possible to override existing properties.\n---\n# Source: cilium/templates/cilium-envoy/configmap.yaml\napiVersion: v1\nkind: ConfigMap\nmetadata:\n name: cilium-envoy-config\n namespace: kube-system\ndata:\n # Keep the key name as bootstrap-config.json to avoid breaking changes\n bootstrap-config.json: |\n {\"admin\":{\"address\":{\"pipe\":{\"path\":\"/var/run/cilium/envoy/sockets/admin.sock\"}}},\"applicationLogConfig\":{\"logFormat\":{\"textFormat\":\"[%Y-%m-%d %T.%e][%t][%l][%n] [%g:%#] %v\"}},\"bootstrapExtensions\":[{\"name\":\"envoy.bootstrap.internal_listener\",\"typedConfig\":{\"@type\":\"type.googleapis.com/envoy.extensions.bootstrap.internal_listener.v3.InternalListener\"}}],\"dynamicResources\":{\"cdsConfig\":{\"apiConfigSource\":{\"apiType\":\"GRPC\",\"grpcServices\":[{\"envoyGrpc\":{\"clusterName\":\"xds-grpc-cilium\"}}],\"setNodeOnFirstMessageOnly\":true,\"transportApiVersion\":\"V3\"},\"initialFetchTimeout\":\"30s\",\"resourceApiVersion\":\"V3\"},\"ldsConfig\":{\"apiConfigSource\":{\"apiType\":\"GRPC\",\"grpcServices\":[{\"envoyGrpc\":{\"clusterName\":\"xds-grpc-cilium\"}}],\"setNodeOnFirstMessageOnly\":true,\"transportApiVersion\":\"V3\"},\"initialFetchTimeout\":\"30s\",\"resourceApiVersion\":\"V3\"}},\"node\":{\"cluster\":\"ingress-cluster\",\"id\":\"host~127.0.0.1~no-id~localdomain\"},\"overloadManager\":{\"resourceMonitors\":[{\"name\":\"envoy.resource_monitors.global_downstream_max_connections\",\"typedConfig\":{\"@type\":\"type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig\",\"max_active_downstream_connections\":\"50000\"}}]},\"staticResources\":{\"clusters\":[{\"circuitBreakers\":{\"thresholds\":[{\"maxRetries\":128}]},\"cleanupInterval\":\"2.500s\",\"connectTimeout\":\"2s\",\"lbPolicy\":\"CLUSTER_PROVIDED\",\"name\":\"ingress-cluster\",\"type\":\"ORIGINAL_DST\",\"typedExtensionProtocolOptions\":{\"envoy.extensions.upstreams.http.v3.HttpProtocolOptions\":{\"@type\":\"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\"commonHttpProtocolOptions\":{\"idleTimeout\":\"60s\",\"maxConnectionDuration\":\"0s\",\"maxRequestsPerConnection\":0},\"useDownstreamProtocolConfig\":{}}}},{\"circuitBreakers\":{\"thresholds\":[{\"maxRetries\":128}]},\"cleanupInterval\":\"2.500s\",\"connectTimeout\":\"2s\",\"lbPolicy\":\"CLUSTER_PROVIDED\",\"name\":\"egress-cluster-tls\",\"transportSocket\":{\"name\":\"cilium.tls_wrapper\",\"typedConfig\":{\"@type\":\"type.googleapis.com/cilium.UpstreamTlsWrapperContext\"}},\"type\":\"ORIGINAL_DST\",\"typedExtensionProtocolOptions\":{\"envoy.extensions.upstreams.http.v3.HttpProtocolOptions\":{\"@type\":\"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\"commonHttpProtocolOptions\":{\"idleTimeout\":\"60s\",\"maxConnectionDuration\":\"0s\",\"maxRequestsPerConnection\":0},\"upstreamHttpProtocolOptions\":{},\"useDownstreamProtocolConfig\":{}}}},{\"circuitBreakers\":{\"thresholds\":[{\"maxRetries\":128}]},\"cleanupInterval\":\"2.500s\",\"connectTimeout\":\"2s\",\"lbPolicy\":\"CLUSTER_PROVIDED\",\"name\":\"egress-cluster\",\"type\":\"ORIGINAL_DST\",\"typedExtensionProtocolOptions\":{\"envoy.extensions.upstreams.http.v3.HttpProtocolOptions\":{\"@type\":\"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\"commonHttpProtocolOptions\":{\"idleTimeout\":\"60s\",\"maxConnectionDuration\":\"0s\",\"maxRequestsPerConnection\":0},\"useDownstreamProtocolConfig\":{}}}},{\"circuitBreakers\":{\"thresholds\":[{\"maxRetries\":128}]},\"cleanupInterval\":\"2.500s\",\"connectTimeout\":\"2s\",\"lbPolicy\":\"CLUSTER_PROVIDED\",\"name\":\"ingress-cluster-tls\",\"transportSocket\":{\"name\":\"cilium.tls_wrapper\",\"typedConfig\":{\"@type\":\"type.googleapis.com/cilium.UpstreamTlsWrapperContext\"}},\"type\":\"ORIGINAL_DST\",\"typedExtensionProtocolOptions\":{\"envoy.extensions.upstreams.http.v3.HttpProtocolOptions\":{\"@type\":\"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\"commonHttpProtocolOptions\":{\"idleTimeout\":\"60s\",\"maxConnectionDuration\":\"0s\",\"maxRequestsPerConnection\":0},\"upstreamHttpProtocolOptions\":{},\"useDownstreamProtocolConfig\":{}}}},{\"connectTimeout\":\"2s\",\"loadAssignment\":{\"clusterName\":\"xds-grpc-cilium\",\"endpoints\":[{\"lbEndpoints\":[{\"endpoint\":{\"address\":{\"pipe\":{\"path\":\"/var/run/cilium/envoy/sockets/xds.sock\"}}}}]}]},\"name\":\"xds-grpc-cilium\",\"type\":\"STATIC\",\"typedExtensionProtocolOptions\":{\"envoy.extensions.upstreams.http.v3.HttpProtocolOptions\":{\"@type\":\"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\"explicitHttpConfig\":{\"http2ProtocolOptions\":{}}}}},{\"connectTimeout\":\"2s\",\"loadAssignment\":{\"clusterName\":\"/envoy-admin\",\"endpoints\":[{\"lbEndpoints\":[{\"endpoint\":{\"address\":{\"pipe\":{\"path\":\"/var/run/cilium/envoy/sockets/admin.sock\"}}}}]}]},\"name\":\"/envoy-admin\",\"type\":\"STATIC\"}],\"listeners\":[{\"address\":{\"socketAddress\":{\"address\":\"0.0.0.0\",\"portValue\":9964}},\"filterChains\":[{\"filters\":[{\"name\":\"envoy.filters.network.http_connection_manager\",\"typedConfig\":{\"@type\":\"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\",\"httpFilters\":[{\"name\":\"envoy.filters.http.router\",\"typedConfig\":{\"@type\":\"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\"}}],\"internalAddressConfig\":{\"cidrRanges\":[{\"addressPrefix\":\"10.0.0.0\",\"prefixLen\":8},{\"addressPrefix\":\"172.16.0.0\",\"prefixLen\":12},{\"addressPrefix\":\"192.168.0.0\",\"prefixLen\":16},{\"addressPrefix\":\"127.0.0.1\",\"prefixLen\":32}]},\"routeConfig\":{\"virtualHosts\":[{\"domains\":[\"*\"],\"name\":\"prometheus_metrics_route\",\"routes\":[{\"match\":{\"prefix\":\"/metrics\"},\"name\":\"prometheus_metrics_route\",\"route\":{\"cluster\":\"/envoy-admin\",\"prefixRewrite\":\"/stats/prometheus\"}}]}]},\"statPrefix\":\"envoy-prometheus-metrics-listener\",\"streamIdleTimeout\":\"0s\"}}]}],\"name\":\"envoy-prometheus-metrics-listener\"},{\"address\":{\"socketAddress\":{\"address\":\"127.0.0.1\",\"portValue\":9878}},\"filterChains\":[{\"filters\":[{\"name\":\"envoy.filters.network.http_connection_manager\",\"typedConfig\":{\"@type\":\"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\",\"httpFilters\":[{\"name\":\"envoy.filters.http.router\",\"typedConfig\":{\"@type\":\"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\"}}],\"internalAddressConfig\":{\"cidrRanges\":[{\"addressPrefix\":\"10.0.0.0\",\"prefixLen\":8},{\"addressPrefix\":\"172.16.0.0\",\"prefixLen\":12},{\"addressPrefix\":\"192.168.0.0\",\"prefixLen\":16},{\"addressPrefix\":\"127.0.0.1\",\"prefixLen\":32}]},\"routeConfig\":{\"virtual_hosts\":[{\"domains\":[\"*\"],\"name\":\"health\",\"routes\":[{\"match\":{\"prefix\":\"/healthz\"},\"name\":\"health\",\"route\":{\"cluster\":\"/envoy-admin\",\"prefixRewrite\":\"/ready\"}}]}]},\"statPrefix\":\"envoy-health-listener\",\"streamIdleTimeout\":\"0s\"}}]}],\"name\":\"envoy-health-listener\"}]}}\n---\n# Source: cilium/templates/hubble-relay/configmap.yaml\napiVersion: v1\nkind: ConfigMap\nmetadata:\n name: hubble-relay-config\n namespace: kube-system\ndata:\n config.yaml: |\n cluster-name: default\n peer-service: \"hubble-peer.kube-system.svc.cluster.local.:443\"\n listen-address: :4245\n gops: true\n gops-port: \"9893\"\n retry-timeout: \n sort-buffer-len-max: \n sort-buffer-drain-timeout: \n tls-hubble-client-cert-file: /var/lib/hubble-relay/tls/client.crt\n tls-hubble-client-key-file: /var/lib/hubble-relay/tls/client.key\n tls-hubble-server-ca-files: /var/lib/hubble-relay/tls/hubble-server-ca.crt\n \n disable-server-tls: true\n---\n# Source: cilium/templates/hubble-ui/configmap.yaml\napiVersion: v1\nkind: ConfigMap\nmetadata:\n name: hubble-ui-nginx\n namespace: kube-system\ndata:\n nginx.conf: \"server {\\n listen 8081;\\n listen [::]:8081;\\n server_name localhost;\\n root /app;\\n index index.html;\\n client_max_body_size 1G;\\n\\n location / {\\n proxy_set_header Host $host;\\n proxy_set_header X-Real-IP $remote_addr;\\n\\n location /api {\\n proxy_http_version 1.1;\\n proxy_pass_request_headers on;\\n proxy_pass http://127.0.0.1:8090;\\n }\\n location / {\\n # double `/index.html` is required here \\n try_files $uri $uri/ /index.html /index.html;\\n }\\n\\n # Liveness probe\\n location /healthz {\\n access_log off;\\n add_header Content-Type text/plain;\\n return 200 'ok';\\n }\\n }\\n}\"\n---\n# Source: cilium/templates/cilium-agent/clusterrole.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRole\nmetadata:\n name: cilium\n labels:\n app.kubernetes.io/part-of: cilium\nrules:\n- apiGroups:\n - networking.k8s.io\n resources:\n - networkpolicies\n verbs:\n - get\n - list\n - watch\n- apiGroups:\n - discovery.k8s.io\n resources:\n - endpointslices\n verbs:\n - get\n - list\n - watch\n- apiGroups:\n - \"\"\n resources:\n - namespaces\n - services\n - pods\n - endpoints\n - nodes\n verbs:\n - get\n - list\n - watch\n- apiGroups:\n - apiextensions.k8s.io\n resources:\n - customresourcedefinitions\n verbs:\n - list\n - watch\n # This is used when validating policies in preflight. This will need to stay\n # until we figure out how to avoid \"get\" inside the preflight, and then\n # should be removed ideally.\n - get\n- apiGroups:\n - cilium.io\n resources:\n - ciliumloadbalancerippools\n - ciliumbgppeeringpolicies\n - ciliumbgpnodeconfigs\n - ciliumbgpadvertisements\n - ciliumbgppeerconfigs\n - ciliumclusterwideenvoyconfigs\n - ciliumclusterwidenetworkpolicies\n - ciliumegressgatewaypolicies\n - ciliumendpoints\n - ciliumendpointslices\n - ciliumenvoyconfigs\n - ciliumidentities\n - ciliumlocalredirectpolicies\n - ciliumnetworkpolicies\n - ciliumnodes\n - ciliumnodeconfigs\n - ciliumcidrgroups\n - ciliuml2announcementpolicies\n - ciliumpodippools\n verbs:\n - list\n - watch\n- apiGroups:\n - cilium.io\n resources:\n - ciliumidentities\n - ciliumendpoints\n - ciliumnodes\n verbs:\n - create\n- apiGroups:\n - cilium.io\n # To synchronize garbage collection of such resources\n resources:\n - ciliumidentities\n verbs:\n - update\n- apiGroups:\n - cilium.io\n resources:\n - ciliumendpoints\n verbs:\n - delete\n - get\n- apiGroups:\n - cilium.io\n resources:\n - ciliumnodes\n - ciliumnodes/status\n verbs:\n - get\n - update\n- apiGroups:\n - cilium.io\n resources:\n - ciliumendpoints/status\n - ciliumendpoints\n - ciliuml2announcementpolicies/status\n - ciliumbgpnodeconfigs/status\n verbs:\n - patch\n---\n# Source: cilium/templates/cilium-operator/clusterrole.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRole\nmetadata:\n name: cilium-operator\n labels:\n app.kubernetes.io/part-of: cilium\nrules:\n- apiGroups:\n - \"\"\n resources:\n - pods\n verbs:\n - get\n - list\n - watch\n # to automatically delete [core|kube]dns pods so that are starting to being\n # managed by Cilium\n - delete\n- apiGroups:\n - \"\"\n resources:\n - configmaps\n resourceNames:\n - cilium-config\n verbs:\n # allow patching of the configmap to set annotations\n - patch\n- apiGroups:\n - \"\"\n resources:\n - nodes\n verbs:\n - list\n - watch\n- apiGroups:\n - \"\"\n resources:\n # To remove node taints\n - nodes\n # To set NetworkUnavailable false on startup\n - nodes/status\n verbs:\n - patch\n- apiGroups:\n - discovery.k8s.io\n resources:\n - endpointslices\n verbs:\n - get\n - list\n - watch\n- apiGroups:\n - \"\"\n resources:\n # to perform LB IP allocation for BGP\n - services/status\n verbs:\n - update\n - patch\n- apiGroups:\n - \"\"\n resources:\n # to check apiserver connectivity\n - namespaces\n - secrets\n verbs:\n - get\n - list\n - watch\n- apiGroups:\n - \"\"\n resources:\n # to perform the translation of a CNP that contains `ToGroup` to its endpoints\n - services\n - endpoints\n verbs:\n - get\n - list\n - watch\n- apiGroups:\n - cilium.io\n resources:\n - ciliumnetworkpolicies\n - ciliumclusterwidenetworkpolicies\n verbs:\n # Create auto-generated CNPs and CCNPs from Policies that have 'toGroups'\n - create\n - update\n - deletecollection\n # To update the status of the CNPs and CCNPs\n - patch\n - get\n - list\n - watch\n- apiGroups:\n - cilium.io\n resources:\n - ciliumnetworkpolicies/status\n - ciliumclusterwidenetworkpolicies/status\n verbs:\n # Update the auto-generated CNPs and CCNPs status.\n - patch\n - update\n- apiGroups:\n - cilium.io\n resources:\n - ciliumendpoints\n - ciliumidentities\n verbs:\n # To perform garbage collection of such resources\n - delete\n - list\n - watch\n- apiGroups:\n - cilium.io\n resources:\n - ciliumidentities\n verbs:\n # To synchronize garbage collection of such resources\n - update\n- apiGroups:\n - cilium.io\n resources:\n - ciliumnodes\n verbs:\n - create\n - update\n - get\n - list\n - watch\n # To perform CiliumNode garbage collector\n - delete\n- apiGroups:\n - cilium.io\n resources:\n - ciliumnodes/status\n verbs:\n - update\n- apiGroups:\n - cilium.io\n resources:\n - ciliumendpointslices\n - ciliumenvoyconfigs\n - ciliumbgppeerconfigs\n - ciliumbgpadvertisements\n - ciliumbgpnodeconfigs\n verbs:\n - create\n - update\n - get\n - list\n - watch\n - delete\n - patch\n- apiGroups:\n - cilium.io\n resources:\n - ciliumbgpclusterconfigs/status\n - ciliumbgppeerconfigs/status\n verbs:\n - update\n- apiGroups:\n - apiextensions.k8s.io\n resources:\n - customresourcedefinitions\n verbs:\n - create\n - get\n - list\n - watch\n- apiGroups:\n - apiextensions.k8s.io\n resources:\n - customresourcedefinitions\n verbs:\n - update\n resourceNames:\n - ciliumloadbalancerippools.cilium.io\n - ciliumbgppeeringpolicies.cilium.io\n - ciliumbgpclusterconfigs.cilium.io\n - ciliumbgppeerconfigs.cilium.io\n - ciliumbgpadvertisements.cilium.io\n - ciliumbgpnodeconfigs.cilium.io\n - ciliumbgpnodeconfigoverrides.cilium.io\n - ciliumclusterwideenvoyconfigs.cilium.io\n - ciliumclusterwidenetworkpolicies.cilium.io\n - ciliumegressgatewaypolicies.cilium.io\n - ciliumendpoints.cilium.io\n - ciliumendpointslices.cilium.io\n - ciliumenvoyconfigs.cilium.io\n - ciliumexternalworkloads.cilium.io\n - ciliumidentities.cilium.io\n - ciliumlocalredirectpolicies.cilium.io\n - ciliumnetworkpolicies.cilium.io\n - ciliumnodes.cilium.io\n - ciliumnodeconfigs.cilium.io\n - ciliumcidrgroups.cilium.io\n - ciliuml2announcementpolicies.cilium.io\n - ciliumpodippools.cilium.io\n- apiGroups:\n - cilium.io\n resources:\n - ciliumloadbalancerippools\n - ciliumpodippools\n - ciliumbgppeeringpolicies\n - ciliumbgpclusterconfigs\n - ciliumbgpnodeconfigoverrides\n - ciliumbgppeerconfigs\n verbs:\n - get\n - list\n - watch\n- apiGroups:\n - cilium.io\n resources:\n - ciliumpodippools\n verbs:\n - create\n- apiGroups:\n - cilium.io\n resources:\n - ciliumloadbalancerippools/status\n verbs:\n - patch\n# For cilium-operator running in HA mode.\n#\n# Cilium operator running in HA mode requires the use of ResourceLock for Leader Election\n# between multiple running instances.\n# The preferred way of doing this is to use LeasesResourceLock as edits to Leases are less\n# common and fewer objects in the cluster watch \"all Leases\".\n- apiGroups:\n - coordination.k8s.io\n resources:\n - leases\n verbs:\n - create\n - get\n - update\n---\n# Source: cilium/templates/hubble-ui/clusterrole.yaml\nkind: ClusterRole\napiVersion: rbac.authorization.k8s.io/v1\nmetadata:\n name: hubble-ui\n labels:\n app.kubernetes.io/part-of: cilium\n\nrules:\n- apiGroups:\n - networking.k8s.io\n resources:\n - networkpolicies\n verbs:\n - get\n - list\n - watch\n- apiGroups:\n - \"\"\n resources:\n - componentstatuses\n - endpoints\n - namespaces\n - nodes\n - pods\n - services\n verbs:\n - get\n - list\n - watch\n- apiGroups:\n - apiextensions.k8s.io\n resources:\n - customresourcedefinitions\n verbs:\n - get\n - list\n - watch\n- apiGroups:\n - cilium.io\n resources:\n - \"*\"\n verbs:\n - get\n - list\n - watch\n---\n# Source: cilium/templates/cilium-agent/clusterrolebinding.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRoleBinding\nmetadata:\n name: cilium\n labels:\n app.kubernetes.io/part-of: cilium\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: ClusterRole\n name: cilium\nsubjects:\n- kind: ServiceAccount\n name: \"cilium\"\n namespace: kube-system\n---\n# Source: cilium/templates/cilium-operator/clusterrolebinding.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRoleBinding\nmetadata:\n name: cilium-operator\n labels:\n app.kubernetes.io/part-of: cilium\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: ClusterRole\n name: cilium-operator\nsubjects:\n- kind: ServiceAccount\n name: \"cilium-operator\"\n namespace: kube-system\n---\n# Source: cilium/templates/hubble-ui/clusterrolebinding.yaml\nkind: ClusterRoleBinding\napiVersion: rbac.authorization.k8s.io/v1\nmetadata:\n name: hubble-ui\n labels:\n app.kubernetes.io/part-of: cilium\n\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: ClusterRole\n name: hubble-ui\nsubjects:\n- kind: ServiceAccount\n name: \"hubble-ui\"\n namespace: kube-system\n---\n# Source: cilium/templates/cilium-agent/role.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: Role\nmetadata:\n name: cilium-config-agent\n namespace: kube-system\n labels:\n app.kubernetes.io/part-of: cilium\nrules:\n- apiGroups:\n - \"\"\n resources:\n - configmaps\n verbs:\n - get\n - list\n - watch\n---\n# Source: cilium/templates/cilium-agent/role.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: Role\nmetadata:\n name: cilium-tlsinterception-secrets\n namespace: \"cilium-secrets\" \n labels:\n app.kubernetes.io/part-of: cilium\nrules:\n- apiGroups:\n - \"\"\n resources:\n - secrets\n verbs:\n - get\n - list\n - watch\n---\n# Source: cilium/templates/cilium-operator/role.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: Role\nmetadata:\n name: cilium-operator-tlsinterception-secrets\n namespace: \"cilium-secrets\"\n labels:\n app.kubernetes.io/part-of: cilium\nrules:\n- apiGroups:\n - \"\"\n resources:\n - secrets\n verbs:\n - create\n - delete\n - update\n - patch\n---\n# Source: cilium/templates/cilium-agent/rolebinding.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: RoleBinding\nmetadata:\n name: cilium-config-agent\n namespace: kube-system\n labels:\n app.kubernetes.io/part-of: cilium\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: Role\n name: cilium-config-agent\nsubjects:\n - kind: ServiceAccount\n name: \"cilium\"\n namespace: kube-system\n---\n# Source: cilium/templates/cilium-agent/rolebinding.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: RoleBinding\nmetadata:\n name: cilium-tlsinterception-secrets\n namespace: \"cilium-secrets\"\n labels:\n app.kubernetes.io/part-of: cilium\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: Role\n name: cilium-tlsinterception-secrets\nsubjects:\n- kind: ServiceAccount\n name: \"cilium\"\n namespace: kube-system\n---\n# Source: cilium/templates/cilium-operator/rolebinding.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: RoleBinding\nmetadata:\n name: cilium-operator-tlsinterception-secrets\n namespace: \"cilium-secrets\"\n labels:\n app.kubernetes.io/part-of: cilium\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: Role\n name: cilium-operator-tlsinterception-secrets\nsubjects:\n- kind: ServiceAccount\n name: \"cilium-operator\"\n namespace: kube-system\n---\n# Source: cilium/templates/cilium-envoy/service.yaml\napiVersion: v1\nkind: Service\nmetadata:\n name: cilium-envoy\n namespace: kube-system\n annotations:\n prometheus.io/scrape: \"true\"\n prometheus.io/port: \"9964\"\n labels:\n k8s-app: cilium-envoy\n app.kubernetes.io/name: cilium-envoy\n app.kubernetes.io/part-of: cilium\n io.cilium/app: proxy\nspec:\n clusterIP: None\n type: ClusterIP\n selector:\n k8s-app: cilium-envoy\n ports:\n - name: envoy-metrics\n port: 9964\n protocol: TCP\n targetPort: envoy-metrics\n---\n# Source: cilium/templates/hubble-relay/service.yaml\nkind: Service\napiVersion: v1\nmetadata:\n name: hubble-relay\n namespace: kube-system\n annotations:\n labels:\n k8s-app: hubble-relay\n app.kubernetes.io/name: hubble-relay\n app.kubernetes.io/part-of: cilium\n\nspec:\n type: \"ClusterIP\"\n selector:\n k8s-app: hubble-relay\n ports:\n - protocol: TCP\n port: 80\n targetPort: grpc\n---\n# Source: cilium/templates/hubble-ui/service.yaml\nkind: Service\napiVersion: v1\nmetadata:\n name: hubble-ui\n namespace: kube-system\n labels:\n k8s-app: hubble-ui\n app.kubernetes.io/name: hubble-ui\n app.kubernetes.io/part-of: cilium\n\nspec:\n type: \"ClusterIP\"\n selector:\n k8s-app: hubble-ui\n ports:\n - name: http\n port: 80\n targetPort: 8081\n---\n# Source: cilium/templates/hubble/peer-service.yaml\napiVersion: v1\nkind: Service\nmetadata:\n name: hubble-peer\n namespace: kube-system\n labels:\n k8s-app: cilium\n app.kubernetes.io/part-of: cilium\n app.kubernetes.io/name: hubble-peer\n\nspec:\n selector:\n k8s-app: cilium\n ports:\n - name: peer-service\n port: 443\n protocol: TCP\n targetPort: 4244\n internalTrafficPolicy: Local\n---\n# Source: cilium/templates/cilium-agent/daemonset.yaml\napiVersion: apps/v1\nkind: DaemonSet\nmetadata:\n name: cilium\n namespace: kube-system\n labels:\n k8s-app: cilium\n app.kubernetes.io/part-of: cilium\n app.kubernetes.io/name: cilium-agent\nspec:\n selector:\n matchLabels:\n k8s-app: cilium\n updateStrategy:\n rollingUpdate:\n maxUnavailable: 2\n type: RollingUpdate\n template:\n metadata:\n annotations:\n labels:\n k8s-app: cilium\n app.kubernetes.io/name: cilium-agent\n app.kubernetes.io/part-of: cilium\n spec:\n securityContext:\n appArmorProfile:\n type: Unconfined\n containers:\n - name: cilium-agent\n image: \"quay.io/cilium/cilium:v1.17.2@sha256:3c4c9932b5d8368619cb922a497ff2ebc8def5f41c18e410bcc84025fcd385b1\"\n imagePullPolicy: IfNotPresent\n command:\n - cilium-agent\n args:\n - --config-dir=/tmp/cilium/config-map\n startupProbe:\n httpGet:\n host: \"127.0.0.1\"\n path: /healthz\n port: 9879\n scheme: HTTP\n httpHeaders:\n - name: \"brief\"\n value: \"true\"\n failureThreshold: 105\n periodSeconds: 2\n successThreshold: 1\n initialDelaySeconds: 5\n livenessProbe:\n httpGet:\n host: \"127.0.0.1\"\n path: /healthz\n port: 9879\n scheme: HTTP\n httpHeaders:\n - name: \"brief\"\n value: \"true\"\n periodSeconds: 30\n successThreshold: 1\n failureThreshold: 10\n timeoutSeconds: 5\n readinessProbe:\n httpGet:\n host: \"127.0.0.1\"\n path: /healthz\n port: 9879\n scheme: HTTP\n httpHeaders:\n - name: \"brief\"\n value: \"true\"\n periodSeconds: 30\n successThreshold: 1\n failureThreshold: 3\n timeoutSeconds: 5\n env:\n - name: K8S_NODE_NAME\n valueFrom:\n fieldRef:\n apiVersion: v1\n fieldPath: spec.nodeName\n - name: CILIUM_K8S_NAMESPACE\n valueFrom:\n fieldRef:\n apiVersion: v1\n fieldPath: metadata.namespace\n - name: CILIUM_CLUSTERMESH_CONFIG\n value: /var/lib/cilium/clustermesh/\n - name: GOMEMLIMIT\n valueFrom:\n resourceFieldRef:\n resource: limits.memory\n divisor: '1'\n - name: KUBERNETES_SERVICE_HOST\n value: \"localhost\"\n - name: KUBERNETES_SERVICE_PORT\n value: \"7445\"\n lifecycle:\n postStart:\n exec:\n command:\n - \"bash\"\n - \"-c\"\n - |\n set -o errexit\n set -o pipefail\n set -o nounset\n \n # When running in AWS ENI mode, it's likely that 'aws-node' has\n # had a chance to install SNAT iptables rules. These can result\n # in dropped traffic, so we should attempt to remove them.\n # We do it using a 'postStart' hook since this may need to run\n # for nodes which might have already been init'ed but may still\n # have dangling rules. This is safe because there are no\n # dependencies on anything that is part of the startup script\n # itself, and can be safely run multiple times per node (e.g. in\n # case of a restart).\n if [[ \"$(iptables-save | grep -E -c 'AWS-SNAT-CHAIN|AWS-CONNMARK-CHAIN')\" != \"0\" ]];\n then\n echo 'Deleting iptables rules created by the AWS CNI VPC plugin'\n iptables-save | grep -E -v 'AWS-SNAT-CHAIN|AWS-CONNMARK-CHAIN' | iptables-restore\n fi\n echo 'Done!'\n \n preStop:\n exec:\n command:\n - /cni-uninstall.sh\n securityContext:\n seLinuxOptions:\n level: s0\n type: spc_t\n capabilities:\n add:\n - CHOWN\n - KILL\n - NET_ADMIN\n - NET_RAW\n - IPC_LOCK\n - SYS_MODULE\n - SYS_ADMIN\n - SYS_RESOURCE\n - DAC_OVERRIDE\n - FOWNER\n - SETGID\n - SETUID\n drop:\n - ALL\n terminationMessagePolicy: FallbackToLogsOnError\n volumeMounts:\n - name: envoy-sockets\n mountPath: /var/run/cilium/envoy/sockets\n readOnly: false\n # Unprivileged containers need to mount /proc/sys/net from the host\n # to have write access\n - mountPath: /host/proc/sys/net\n name: host-proc-sys-net\n # Unprivileged containers need to mount /proc/sys/kernel from the host\n # to have write access\n - mountPath: /host/proc/sys/kernel\n name: host-proc-sys-kernel\n - name: bpf-maps\n mountPath: /sys/fs/bpf\n # Unprivileged containers can't set mount propagation to bidirectional\n # in this case we will mount the bpf fs from an init container that\n # is privileged and set the mount propagation from host to container\n # in Cilium.\n mountPropagation: HostToContainer\n - name: cilium-run\n mountPath: /var/run/cilium\n - name: cilium-netns\n mountPath: /var/run/cilium/netns\n mountPropagation: HostToContainer\n - name: etc-cni-netd\n mountPath: /host/etc/cni/net.d\n - name: clustermesh-secrets\n mountPath: /var/lib/cilium/clustermesh\n readOnly: true\n # Needed to be able to load kernel modules\n - name: lib-modules\n mountPath: /lib/modules\n readOnly: true\n - name: xtables-lock\n mountPath: /run/xtables.lock\n - name: hubble-tls\n mountPath: /var/lib/cilium/tls/hubble\n readOnly: true\n - name: tmp\n mountPath: /tmp\n initContainers:\n - name: config\n image: \"quay.io/cilium/cilium:v1.17.2@sha256:3c4c9932b5d8368619cb922a497ff2ebc8def5f41c18e410bcc84025fcd385b1\"\n imagePullPolicy: IfNotPresent\n command:\n - cilium-dbg\n - build-config\n env:\n - name: K8S_NODE_NAME\n valueFrom:\n fieldRef:\n apiVersion: v1\n fieldPath: spec.nodeName\n - name: CILIUM_K8S_NAMESPACE\n valueFrom:\n fieldRef:\n apiVersion: v1\n fieldPath: metadata.namespace\n - name: KUBERNETES_SERVICE_HOST\n value: \"localhost\"\n - name: KUBERNETES_SERVICE_PORT\n value: \"7445\"\n volumeMounts:\n - name: tmp\n mountPath: /tmp\n terminationMessagePolicy: FallbackToLogsOnError\n # Required to mount cgroup2 filesystem on the underlying Kubernetes node.\n # We use nsenter command with host's cgroup and mount namespaces enabled.\n - name: mount-cgroup\n image: \"quay.io/cilium/cilium:v1.17.2@sha256:3c4c9932b5d8368619cb922a497ff2ebc8def5f41c18e410bcc84025fcd385b1\"\n imagePullPolicy: IfNotPresent\n env:\n - name: CGROUP_ROOT\n value: /run/cilium/cgroupv2\n - name: BIN_PATH\n value: /opt/cni/bin\n command:\n - sh\n - -ec\n # The statically linked Go program binary is invoked to avoid any\n # dependency on utilities like sh and mount that can be missing on certain\n # distros installed on the underlying host. Copy the binary to the\n # same directory where we install cilium cni plugin so that exec permissions\n # are available.\n - |\n cp /usr/bin/cilium-mount /hostbin/cilium-mount;\n nsenter --cgroup=/hostproc/1/ns/cgroup --mount=/hostproc/1/ns/mnt \"${BIN_PATH}/cilium-mount\" $CGROUP_ROOT;\n rm /hostbin/cilium-mount\n volumeMounts:\n - name: hostproc\n mountPath: /hostproc\n - name: cni-path\n mountPath: /hostbin\n terminationMessagePolicy: FallbackToLogsOnError\n securityContext:\n seLinuxOptions:\n level: s0\n type: spc_t\n capabilities:\n add:\n - SYS_ADMIN\n - SYS_CHROOT\n - SYS_PTRACE\n drop:\n - ALL\n - name: apply-sysctl-overwrites\n image: \"quay.io/cilium/cilium:v1.17.2@sha256:3c4c9932b5d8368619cb922a497ff2ebc8def5f41c18e410bcc84025fcd385b1\"\n imagePullPolicy: IfNotPresent\n env:\n - name: BIN_PATH\n value: /opt/cni/bin\n command:\n - sh\n - -ec\n # The statically linked Go program binary is invoked to avoid any\n # dependency on utilities like sh that can be missing on certain\n # distros installed on the underlying host. Copy the binary to the\n # same directory where we install cilium cni plugin so that exec permissions\n # are available.\n - |\n cp /usr/bin/cilium-sysctlfix /hostbin/cilium-sysctlfix;\n nsenter --mount=/hostproc/1/ns/mnt \"${BIN_PATH}/cilium-sysctlfix\";\n rm /hostbin/cilium-sysctlfix\n volumeMounts:\n - name: hostproc\n mountPath: /hostproc\n - name: cni-path\n mountPath: /hostbin\n terminationMessagePolicy: FallbackToLogsOnError\n securityContext:\n seLinuxOptions:\n level: s0\n type: spc_t\n capabilities:\n add:\n - SYS_ADMIN\n - SYS_CHROOT\n - SYS_PTRACE\n drop:\n - ALL\n # Mount the bpf fs if it is not mounted. We will perform this task\n # from a privileged container because the mount propagation bidirectional\n # only works from privileged containers.\n - name: mount-bpf-fs\n image: \"quay.io/cilium/cilium:v1.17.2@sha256:3c4c9932b5d8368619cb922a497ff2ebc8def5f41c18e410bcc84025fcd385b1\"\n imagePullPolicy: IfNotPresent\n args:\n - 'mount | grep \"/sys/fs/bpf type bpf\" || mount -t bpf bpf /sys/fs/bpf'\n command:\n - /bin/bash\n - -c\n - --\n terminationMessagePolicy: FallbackToLogsOnError\n securityContext:\n privileged: true\n volumeMounts:\n - name: bpf-maps\n mountPath: /sys/fs/bpf\n mountPropagation: Bidirectional\n - name: clean-cilium-state\n image: \"quay.io/cilium/cilium:v1.17.2@sha256:3c4c9932b5d8368619cb922a497ff2ebc8def5f41c18e410bcc84025fcd385b1\"\n imagePullPolicy: IfNotPresent\n command:\n - /init-container.sh\n env:\n - name: CILIUM_ALL_STATE\n valueFrom:\n configMapKeyRef:\n name: cilium-config\n key: clean-cilium-state\n optional: true\n - name: CILIUM_BPF_STATE\n valueFrom:\n configMapKeyRef:\n name: cilium-config\n key: clean-cilium-bpf-state\n optional: true\n - name: WRITE_CNI_CONF_WHEN_READY\n valueFrom:\n configMapKeyRef:\n name: cilium-config\n key: write-cni-conf-when-ready\n optional: true\n - name: KUBERNETES_SERVICE_HOST\n value: \"localhost\"\n - name: KUBERNETES_SERVICE_PORT\n value: \"7445\"\n terminationMessagePolicy: FallbackToLogsOnError\n securityContext:\n seLinuxOptions:\n level: s0\n type: spc_t\n capabilities:\n add:\n - NET_ADMIN\n - SYS_MODULE\n - SYS_ADMIN\n - SYS_RESOURCE\n drop:\n - ALL\n volumeMounts:\n - name: bpf-maps\n mountPath: /sys/fs/bpf\n # Required to mount cgroup filesystem from the host to cilium agent pod\n - name: cilium-cgroup\n mountPath: /run/cilium/cgroupv2\n mountPropagation: HostToContainer\n - name: cilium-run\n mountPath: /var/run/cilium # wait-for-kube-proxy\n # Install the CNI binaries in an InitContainer so we don't have a writable host mount in the agent\n - name: install-cni-binaries\n image: \"quay.io/cilium/cilium:v1.17.2@sha256:3c4c9932b5d8368619cb922a497ff2ebc8def5f41c18e410bcc84025fcd385b1\"\n imagePullPolicy: IfNotPresent\n command:\n - \"/install-plugin.sh\"\n resources:\n requests:\n cpu: 100m\n memory: 10Mi\n securityContext:\n seLinuxOptions:\n level: s0\n type: spc_t\n capabilities:\n drop:\n - ALL\n terminationMessagePolicy: FallbackToLogsOnError\n volumeMounts:\n - name: cni-path\n mountPath: /host/opt/cni/bin # .Values.cni.install\n restartPolicy: Always\n priorityClassName: system-node-critical\n serviceAccountName: \"cilium\"\n automountServiceAccountToken: true\n terminationGracePeriodSeconds: 1\n hostNetwork: true\n affinity:\n podAntiAffinity:\n requiredDuringSchedulingIgnoredDuringExecution:\n - labelSelector:\n matchLabels:\n k8s-app: cilium\n topologyKey: kubernetes.io/hostname\n nodeSelector:\n kubernetes.io/os: linux\n tolerations:\n - operator: Exists\n volumes:\n # For sharing configuration between the \"config\" initContainer and the agent\n - name: tmp\n emptyDir: {}\n # To keep state between restarts / upgrades\n - name: cilium-run\n hostPath:\n path: /var/run/cilium\n type: DirectoryOrCreate\n # To exec into pod network namespaces\n - name: cilium-netns\n hostPath:\n path: /var/run/netns\n type: DirectoryOrCreate\n # To keep state between restarts / upgrades for bpf maps\n - name: bpf-maps\n hostPath:\n path: /sys/fs/bpf\n type: DirectoryOrCreate\n # To mount cgroup2 filesystem on the host or apply sysctlfix\n - name: hostproc\n hostPath:\n path: /proc\n type: Directory\n # To keep state between restarts / upgrades for cgroup2 filesystem\n - name: cilium-cgroup\n hostPath:\n path: /run/cilium/cgroupv2\n type: DirectoryOrCreate\n # To install cilium cni plugin in the host\n - name: cni-path\n hostPath:\n path: /opt/cni/bin\n type: DirectoryOrCreate\n # To install cilium cni configuration in the host\n - name: etc-cni-netd\n hostPath:\n path: /etc/cni/net.d\n type: DirectoryOrCreate\n # To be able to load kernel modules\n - name: lib-modules\n hostPath:\n path: /lib/modules\n # To access iptables concurrently with other processes (e.g. kube-proxy)\n - name: xtables-lock\n hostPath:\n path: /run/xtables.lock\n type: FileOrCreate\n # Sharing socket with Cilium Envoy on the same node by using a host path\n - name: envoy-sockets\n hostPath:\n path: \"/var/run/cilium/envoy/sockets\"\n type: DirectoryOrCreate\n # To read the clustermesh configuration\n - name: clustermesh-secrets\n projected:\n # note: the leading zero means this number is in octal representation: do not remove it\n defaultMode: 0400\n sources:\n - secret:\n name: cilium-clustermesh\n optional: true\n # note: items are not explicitly listed here, since the entries of this secret\n # depend on the peers configured, and that would cause a restart of all agents\n # at every addition/removal. Leaving the field empty makes each secret entry\n # to be automatically projected into the volume as a file whose name is the key.\n - secret:\n name: clustermesh-apiserver-remote-cert\n optional: true\n items:\n - key: tls.key\n path: common-etcd-client.key\n - key: tls.crt\n path: common-etcd-client.crt\n - key: ca.crt\n path: common-etcd-client-ca.crt\n # note: we configure the volume for the kvstoremesh-specific certificate\n # regardless of whether KVStoreMesh is enabled or not, so that it can be\n # automatically mounted in case KVStoreMesh gets subsequently enabled,\n # without requiring an agent restart.\n - secret:\n name: clustermesh-apiserver-local-cert\n optional: true\n items:\n - key: tls.key\n path: local-etcd-client.key\n - key: tls.crt\n path: local-etcd-client.crt\n - key: ca.crt\n path: local-etcd-client-ca.crt\n - name: host-proc-sys-net\n hostPath:\n path: /proc/sys/net\n type: Directory\n - name: host-proc-sys-kernel\n hostPath:\n path: /proc/sys/kernel\n type: Directory\n - name: hubble-tls\n projected:\n # note: the leading zero means this number is in octal representation: do not remove it\n defaultMode: 0400\n sources:\n - secret:\n name: hubble-server-certs\n optional: true\n items:\n - key: tls.crt\n path: server.crt\n - key: tls.key\n path: server.key\n - key: ca.crt\n path: client-ca.crt\n---\n# Source: cilium/templates/cilium-envoy/daemonset.yaml\napiVersion: apps/v1\nkind: DaemonSet\nmetadata:\n name: cilium-envoy\n namespace: kube-system\n labels:\n k8s-app: cilium-envoy\n app.kubernetes.io/part-of: cilium\n app.kubernetes.io/name: cilium-envoy\n name: cilium-envoy\nspec:\n selector:\n matchLabels:\n k8s-app: cilium-envoy\n updateStrategy:\n rollingUpdate:\n maxUnavailable: 2\n type: RollingUpdate\n template:\n metadata:\n annotations:\n labels:\n k8s-app: cilium-envoy\n name: cilium-envoy\n app.kubernetes.io/name: cilium-envoy\n app.kubernetes.io/part-of: cilium\n spec:\n securityContext:\n appArmorProfile:\n type: Unconfined\n containers:\n - name: cilium-envoy\n image: \"quay.io/cilium/cilium-envoy:v1.31.5-1741765102-efed3defcc70ab5b263a0fc44c93d316b846a211@sha256:377c78c13d2731f3720f931721ee309159e782d882251709cb0fac3b42c03f4b\"\n imagePullPolicy: IfNotPresent\n command:\n - /usr/bin/cilium-envoy-starter\n args:\n - '--'\n - '-c /var/run/cilium/envoy/bootstrap-config.json'\n - '--base-id 0'\n - '--log-level info'\n startupProbe:\n httpGet:\n host: \"127.0.0.1\"\n path: /healthz\n port: 9878\n scheme: HTTP\n failureThreshold: 105\n periodSeconds: 2\n successThreshold: 1\n initialDelaySeconds: 5\n livenessProbe:\n httpGet:\n host: \"127.0.0.1\"\n path: /healthz\n port: 9878\n scheme: HTTP\n periodSeconds: 30\n successThreshold: 1\n failureThreshold: 10\n timeoutSeconds: 5\n readinessProbe:\n httpGet:\n host: \"127.0.0.1\"\n path: /healthz\n port: 9878\n scheme: HTTP\n periodSeconds: 30\n successThreshold: 1\n failureThreshold: 3\n timeoutSeconds: 5\n env:\n - name: K8S_NODE_NAME\n valueFrom:\n fieldRef:\n apiVersion: v1\n fieldPath: spec.nodeName\n - name: CILIUM_K8S_NAMESPACE\n valueFrom:\n fieldRef:\n apiVersion: v1\n fieldPath: metadata.namespace\n - name: KUBERNETES_SERVICE_HOST\n value: \"localhost\"\n - name: KUBERNETES_SERVICE_PORT\n value: \"7445\"\n ports:\n - name: envoy-metrics\n containerPort: 9964\n hostPort: 9964\n protocol: TCP\n securityContext:\n seLinuxOptions:\n level: s0\n type: spc_t\n capabilities:\n add:\n - NET_ADMIN\n - SYS_ADMIN\n drop:\n - ALL\n terminationMessagePolicy: FallbackToLogsOnError\n volumeMounts:\n - name: envoy-sockets\n mountPath: /var/run/cilium/envoy/sockets\n readOnly: false\n - name: envoy-artifacts\n mountPath: /var/run/cilium/envoy/artifacts\n readOnly: true\n - name: envoy-config\n mountPath: /var/run/cilium/envoy/\n readOnly: true\n - name: bpf-maps\n mountPath: /sys/fs/bpf\n mountPropagation: HostToContainer\n restartPolicy: Always\n priorityClassName: system-node-critical\n serviceAccountName: \"cilium-envoy\"\n automountServiceAccountToken: true\n terminationGracePeriodSeconds: 1\n hostNetwork: true\n affinity:\n nodeAffinity:\n requiredDuringSchedulingIgnoredDuringExecution:\n nodeSelectorTerms:\n - matchExpressions:\n - key: cilium.io/no-schedule\n operator: NotIn\n values:\n - \"true\"\n podAffinity:\n requiredDuringSchedulingIgnoredDuringExecution:\n - labelSelector:\n matchLabels:\n k8s-app: cilium\n topologyKey: kubernetes.io/hostname\n podAntiAffinity:\n requiredDuringSchedulingIgnoredDuringExecution:\n - labelSelector:\n matchLabels:\n k8s-app: cilium-envoy\n topologyKey: kubernetes.io/hostname\n nodeSelector:\n kubernetes.io/os: linux\n tolerations:\n - operator: Exists\n volumes:\n - name: envoy-sockets\n hostPath:\n path: \"/var/run/cilium/envoy/sockets\"\n type: DirectoryOrCreate\n - name: envoy-artifacts\n hostPath:\n path: \"/var/run/cilium/envoy/artifacts\"\n type: DirectoryOrCreate\n - name: envoy-config\n configMap:\n name: \"cilium-envoy-config\"\n # note: the leading zero means this number is in octal representation: do not remove it\n defaultMode: 0400\n items:\n - key: bootstrap-config.json\n path: bootstrap-config.json\n # To keep state between restarts / upgrades\n # To keep state between restarts / upgrades for bpf maps\n - name: bpf-maps\n hostPath:\n path: /sys/fs/bpf\n type: DirectoryOrCreate\n---\n# Source: cilium/templates/cilium-operator/deployment.yaml\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: cilium-operator\n namespace: kube-system\n labels:\n io.cilium/app: operator\n name: cilium-operator\n app.kubernetes.io/part-of: cilium\n app.kubernetes.io/name: cilium-operator\nspec:\n # See docs on ServerCapabilities.LeasesResourceLock in file pkg/k8s/version/version.go\n # for more details.\n replicas: 2\n selector:\n matchLabels:\n io.cilium/app: operator\n name: cilium-operator\n # ensure operator update on single node k8s clusters, by using rolling update with maxUnavailable=100% in case\n # of one replica and no user configured Recreate strategy.\n # otherwise an update might get stuck due to the default maxUnavailable=50% in combination with the\n # podAntiAffinity which prevents deployments of multiple operator replicas on the same node.\n strategy:\n rollingUpdate:\n maxSurge: 25%\n maxUnavailable: 50%\n type: RollingUpdate\n template:\n metadata:\n annotations:\n prometheus.io/port: \"9963\"\n prometheus.io/scrape: \"true\"\n labels:\n io.cilium/app: operator\n name: cilium-operator\n app.kubernetes.io/part-of: cilium\n app.kubernetes.io/name: cilium-operator\n spec:\n containers:\n - name: cilium-operator\n image: \"quay.io/cilium/operator-generic:v1.17.2@sha256:81f2d7198366e8dec2903a3a8361e4c68d47d19c68a0d42f0b7b6e3f0523f249\"\n imagePullPolicy: IfNotPresent\n command:\n - cilium-operator-generic\n args:\n - --config-dir=/tmp/cilium/config-map\n - --debug=$(CILIUM_DEBUG)\n env:\n - name: K8S_NODE_NAME\n valueFrom:\n fieldRef:\n apiVersion: v1\n fieldPath: spec.nodeName\n - name: CILIUM_K8S_NAMESPACE\n valueFrom:\n fieldRef:\n apiVersion: v1\n fieldPath: metadata.namespace\n - name: CILIUM_DEBUG\n valueFrom:\n configMapKeyRef:\n key: debug\n name: cilium-config\n optional: true\n - name: KUBERNETES_SERVICE_HOST\n value: \"localhost\"\n - name: KUBERNETES_SERVICE_PORT\n value: \"7445\"\n ports:\n - name: prometheus\n containerPort: 9963\n hostPort: 9963\n protocol: TCP\n livenessProbe:\n httpGet:\n host: \"127.0.0.1\"\n path: /healthz\n port: 9234\n scheme: HTTP\n initialDelaySeconds: 60\n periodSeconds: 10\n timeoutSeconds: 3\n readinessProbe:\n httpGet:\n host: \"127.0.0.1\"\n path: /healthz\n port: 9234\n scheme: HTTP\n initialDelaySeconds: 0\n periodSeconds: 5\n timeoutSeconds: 3\n failureThreshold: 5\n volumeMounts:\n - name: cilium-config-path\n mountPath: /tmp/cilium/config-map\n readOnly: true\n terminationMessagePolicy: FallbackToLogsOnError\n hostNetwork: true\n restartPolicy: Always\n priorityClassName: system-cluster-critical\n serviceAccountName: \"cilium-operator\"\n automountServiceAccountToken: true\n # In HA mode, cilium-operator pods must not be scheduled on the same\n # node as they will clash with each other.\n affinity:\n podAntiAffinity:\n requiredDuringSchedulingIgnoredDuringExecution:\n - labelSelector:\n matchLabels:\n io.cilium/app: operator\n topologyKey: kubernetes.io/hostname\n nodeSelector:\n kubernetes.io/os: linux\n tolerations:\n - operator: Exists\n volumes:\n # To read the configuration from the config map\n - name: cilium-config-path\n configMap:\n name: cilium-config\n---\n# Source: cilium/templates/hubble-relay/deployment.yaml\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: hubble-relay\n namespace: kube-system\n labels:\n k8s-app: hubble-relay\n app.kubernetes.io/name: hubble-relay\n app.kubernetes.io/part-of: cilium\n\nspec:\n replicas: 1\n selector:\n matchLabels:\n k8s-app: hubble-relay\n strategy:\n rollingUpdate:\n maxUnavailable: 1\n type: RollingUpdate\n template:\n metadata:\n annotations:\n labels:\n k8s-app: hubble-relay\n app.kubernetes.io/name: hubble-relay\n app.kubernetes.io/part-of: cilium\n spec:\n securityContext:\n fsGroup: 65532\n containers:\n - name: hubble-relay\n securityContext:\n capabilities:\n drop:\n - ALL\n runAsGroup: 65532\n runAsNonRoot: true\n runAsUser: 65532\n image: \"quay.io/cilium/hubble-relay:v1.17.2@sha256:42a8db5c256c516cacb5b8937c321b2373ad7a6b0a1e5a5120d5028433d586cc\"\n imagePullPolicy: IfNotPresent\n command:\n - hubble-relay\n args:\n - serve\n ports:\n - name: grpc\n containerPort: 4245\n readinessProbe:\n grpc:\n port: 4222\n timeoutSeconds: 3\n # livenessProbe will kill the pod, we should be very conservative\n # here on failures since killing the pod should be a last resort, and\n # we should provide enough time for relay to retry before killing it.\n livenessProbe:\n grpc:\n port: 4222\n timeoutSeconds: 10\n # Give relay time to establish connections and make a few retries\n # before starting livenessProbes.\n initialDelaySeconds: 10\n # 10 second * 12 failures = 2 minutes of failure.\n # If relay cannot become healthy after 2 minutes, then killing it\n # might resolve whatever issue is occurring.\n #\n # 10 seconds is a reasonable retry period so we can see if it's\n # failing regularly or only sporadically.\n periodSeconds: 10\n failureThreshold: 12\n startupProbe:\n grpc:\n port: 4222\n # Give relay time to get it's certs and establish connections and\n # make a few retries before starting startupProbes.\n initialDelaySeconds: 10\n # 20 * 3 seconds = 1 minute of failure before we consider startup as failed.\n failureThreshold: 20\n # Retry more frequently at startup so that it can be considered started more quickly.\n periodSeconds: 3\n volumeMounts:\n - name: config\n mountPath: /etc/hubble-relay\n readOnly: true\n - name: tls\n mountPath: /var/lib/hubble-relay/tls\n readOnly: true\n terminationMessagePolicy: FallbackToLogsOnError\n \n restartPolicy: Always\n priorityClassName: \n serviceAccountName: \"hubble-relay\"\n automountServiceAccountToken: false\n terminationGracePeriodSeconds: 1\n affinity:\n podAffinity:\n requiredDuringSchedulingIgnoredDuringExecution:\n - labelSelector:\n matchLabels:\n k8s-app: cilium\n topologyKey: kubernetes.io/hostname\n nodeSelector:\n kubernetes.io/os: linux\n volumes:\n - name: config\n configMap:\n name: hubble-relay-config\n items:\n - key: config.yaml\n path: config.yaml\n - name: tls\n projected:\n # note: the leading zero means this number is in octal representation: do not remove it\n defaultMode: 0400\n sources:\n - secret:\n name: hubble-relay-client-certs\n items:\n - key: tls.crt\n path: client.crt\n - key: tls.key\n path: client.key\n - key: ca.crt\n path: hubble-server-ca.crt\n---\n# Source: cilium/templates/hubble-ui/deployment.yaml\nkind: Deployment\napiVersion: apps/v1\nmetadata:\n name: hubble-ui\n namespace: kube-system\n labels:\n k8s-app: hubble-ui\n app.kubernetes.io/name: hubble-ui\n app.kubernetes.io/part-of: cilium\nspec:\n replicas: 1\n selector:\n matchLabels:\n k8s-app: hubble-ui\n strategy:\n rollingUpdate:\n maxUnavailable: 1\n type: RollingUpdate\n template:\n metadata:\n annotations:\n labels:\n k8s-app: hubble-ui\n app.kubernetes.io/name: hubble-ui\n app.kubernetes.io/part-of: cilium\n spec:\n securityContext:\n fsGroup: 1001\n runAsGroup: 1001\n runAsUser: 1001\n priorityClassName: \n serviceAccountName: \"hubble-ui\"\n automountServiceAccountToken: true\n containers:\n - name: frontend\n image: \"quay.io/cilium/hubble-ui:v0.13.2@sha256:9e37c1296b802830834cc87342a9182ccbb71ffebb711971e849221bd9d59392\"\n imagePullPolicy: IfNotPresent\n ports:\n - name: http\n containerPort: 8081\n livenessProbe:\n httpGet:\n path: /healthz\n port: 8081\n readinessProbe:\n httpGet:\n path: /\n port: 8081\n volumeMounts:\n - name: hubble-ui-nginx-conf\n mountPath: /etc/nginx/conf.d/default.conf\n subPath: nginx.conf\n - name: tmp-dir\n mountPath: /tmp\n terminationMessagePolicy: FallbackToLogsOnError\n - name: backend\n image: \"quay.io/cilium/hubble-ui-backend:v0.13.2@sha256:a034b7e98e6ea796ed26df8f4e71f83fc16465a19d166eff67a03b822c0bfa15\"\n imagePullPolicy: IfNotPresent\n env:\n - name: EVENTS_SERVER_PORT\n value: \"8090\"\n - name: FLOWS_API_ADDR\n value: \"hubble-relay:80\"\n ports:\n - name: grpc\n containerPort: 8090\n volumeMounts:\n terminationMessagePolicy: FallbackToLogsOnError\n nodeSelector:\n kubernetes.io/os: linux\n volumes:\n - configMap:\n defaultMode: 420\n name: hubble-ui-nginx\n name: hubble-ui-nginx-conf\n - emptyDir: {}\n name: tmp-dir\n" + contents: "---\n# Source: cilium/templates/cilium-secrets-namespace.yaml\napiVersion: v1\nkind: Namespace\nmetadata:\n name: \"cilium-secrets\"\n labels:\n app.kubernetes.io/part-of: cilium\n\n---\n# Source: cilium/templates/cilium-agent/serviceaccount.yaml\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n name: \"cilium\"\n namespace: kube-system\n\n---\n# Source: cilium/templates/cilium-envoy/serviceaccount.yaml\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n name: \"cilium-envoy\"\n namespace: kube-system\n\n---\n# Source: cilium/templates/cilium-operator/serviceaccount.yaml\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n name: \"cilium-operator\"\n namespace: kube-system\n\n---\n# Source: cilium/templates/hubble-relay/serviceaccount.yaml\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n name: \"hubble-relay\"\n namespace: kube-system\nautomountServiceAccountToken: false\n\n---\n# Source: cilium/templates/hubble-ui/serviceaccount.yaml\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n name: \"hubble-ui\"\n namespace: kube-system\n\n---\n# Source: cilium/templates/cilium-ca-secret.yaml\napiVersion: v1\nkind: Secret\nmetadata:\n name: cilium-ca\n namespace: kube-system\ndata:\n ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURGRENDQWZ5Z0F3SUJBZ0lSQUtSMlUwT0VVRU9OSEQySE82Z24yZDh3RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEkyTURneU16QXhNRE15T0ZvWERUSTVNRGd5TWpBeApNRE15T0Zvd0ZERVNNQkFHQTFVRUF4TUpRMmxzYVhWdElFTkJNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DCkFROEFNSUlCQ2dLQ0FRRUEwOVBDTENSRWQvaHNBZU9VYzlYSUFTK0ttQ3RFakdBSVhsSWVET0EvcHpkN0pqTDAKSnhiRy9QWElSR0M4L1dJakx5d1EyTFhBUGVzcllzN3ZQU09QaGl0Vld6b01CYW4yOUorVG1Ebkc3RGlZc2IwcgpDNXA1VnBzdFozNDgvOGcrR3VpeUlKVkxVL2Q2dmxvbE9LcHRQY1ZHMXVvdUxBdmpFeDNCRlJVc3dHNHU5ektmCk9kU3BTQVp3Z01XZzh5NzRoczJ3WGRpRXhIZ1pYZndLUkxBTkc2OFRuTnFBeEJjTFM2NDJqeXhnRS9wWnROMy8KN3M2N05rMkpCempSODBNL2JWSDJqQkZTaFJvL0RBZXBkVllQTjJSQUpaY3BTOE0vUVV4YVppamJpS085a1hpaQoyTGhBcUNic2FGZnRmRmZhMmJnL1lSaDhzdU5UNmc2QVVad0t3d0lEQVFBQm8yRXdYekFPQmdOVkhROEJBZjhFCkJBTUNBcVF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUYKTUFNQkFmOHdIUVlEVlIwT0JCWUVGRmRmcnFLaC9pZUtZa0tHcVJnNGFvc2ttSkd1TUEwR0NTcUdTSWIzRFFFQgpDd1VBQTRJQkFRQzlqRk85REx3MWlqbGV6b25FNVZJQnRoL0dvSkdha0loOHB6d1BRejBiUzFBSU5NZFBla3poCmd2Uys2SnJDODBPT29BSkNOU0xiY0ROVDlZV2t6MUNsZUxBYzlFMThPVUZFTkxlQnFYazRxcmV1eUJXN2MxbG8KbFBFclZudGhxOXF0NXllK0lwTjlxSFpoejVOaFIyd1dCUWdWQkphTmNiT1NocUVTMklXWmlQT1hFNVhocmxUbwpmL1k1cEJMNFpiejFTSUphZmU1UzZDNld2Znd6ZitXdzRsMzFzbTc5UDFRTG5id2ZCZXVpakg2Qm4wVk9VYmo3CmJWN3RhWGFNZzZMd29TVTBZdXNMQzZvdjJGdE1VZ3V5NUNFL20xdW5KQkJXR3AzVW8xYktRbWdBbldCR08zUmIKbytWUUpBWmFrdDVqSFRGaUQ0Tk5Xa24xSUN1SFh1dTYKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=\n ca.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBMDlQQ0xDUkVkL2hzQWVPVWM5WElBUytLbUN0RWpHQUlYbEllRE9BL3B6ZDdKakwwCkp4YkcvUFhJUkdDOC9XSWpMeXdRMkxYQVBlc3JZczd2UFNPUGhpdFZXem9NQmFuMjlKK1RtRG5HN0RpWXNiMHIKQzVwNVZwc3RaMzQ4LzhnK0d1aXlJSlZMVS9kNnZsb2xPS3B0UGNWRzF1b3VMQXZqRXgzQkZSVXN3RzR1OXpLZgpPZFNwU0Fad2dNV2c4eTc0aHMyd1hkaUV4SGdaWGZ3S1JMQU5HNjhUbk5xQXhCY0xTNjQyanl4Z0UvcFp0TjMvCjdzNjdOazJKQnpqUjgwTS9iVkgyakJGU2hSby9EQWVwZFZZUE4yUkFKWmNwUzhNL1FVeGFaaWpiaUtPOWtYaWkKMkxoQXFDYnNhRmZ0ZkZmYTJiZy9ZUmg4c3VOVDZnNkFVWndLd3dJREFRQUJBb0lCQUFNZjRqWStyTFVUSHh2dQowdktvZHgzaTlmQVllbjJyL1YwMkFlRGVKTHZTWjhpNktYdVp1VTk5VDIwN2xIZXRqVFMxMHYxa0pPNStlOWltCks4VnZtWXdTWmltZkJubGZVRmZ1eTlzTDMrMzk0Ym5yQytuTXpaN0toUHc4SDF6U0hXNEJMdVVPV0U0QnF3UzcKbFhqRk5UQzB4Q1VKTmQ2TERyNkQ4U1JGSzVicmJ4RlJFOVl1blUxSmhOTlNSVjNLS0FLQzlyU2dmYjJEbE5WYgp6enNIL0hGdE0xN3FGUVVBQXgrK1dyNzQxbmg4TW9HcXdkZE1EeEx6R05FaDNoTjdiU003aFJQMkVEQ2VWUTV1CnZTY1lWeHFxZEYrKzZRUEw3dUZiMjBEVTB0Yk15MjF3RDZwc1pJM0Y4VDNjKzVaZnpUNkJmSHEvbGJqSmV4VWsKZVJiNlBwa0NnWUVBMmtDSlFxTzZwWmJrTWpsMVlNLzdZK3IxQkdGQXRvRTlyaFFWYklXUTVzcklsUEVHZWJ5bAplMjB4QmFYV3pNU2orMWVyZGl4dVFIZEpwbXFad3Q1M3pNN25mekZnM29PbHFUSTBCQmdFcjlkWG1QemVPWUF5CjR0N0xRenNwYzNReHdVbEFkWEpVaTJXVUxIbmwwUm1VOU52NnpNOWxzb2UwMnBGS1ZNN2l6Z2tDZ1lFQStIYS8KdVlXWEExSWNoUlNUUUxzRUVueEpldDJIMklsRVZsUzRkaERrcUhpTy85OUV1YWRpc3dXd0Y0anJEZHlnWXpnOQpCZGE5enlROGllcVdoNDk4QmdCTjFpb094SmhEZnFLNElwMWFVdGtBd0lkUjJuTHhaWDhsMjNzcUU1OStGSlY0ClVNSGVaNHQ2a1YvM2loeUl5dGhrZjdpd2Fnd0p4emxEd0Q3cnhXc0NnWUEva2dhbysybTFLN05DRWN4bnE0ek0KdUxZdlZXaDFBRVlIKzErV0lYMW9TKzZLdTMyb1hkTlJsU2R2UHJQSEp3dWdmUk83TXd2V0NTalJxVUVxS29SNAppbGVSaTc5c2NLb0RFMVZsVDkybG5qS3NwQkxTYXMzbm1QOVprTlR0QlE0cy8zb2YrM0kydkJxaHJjdkwwUWk3CkhZdjZ0Zm9vT3pEcGJPSmF1M3dDaVFLQmdRRGh0bjdWZXBhRlhjS3E0dFlpcDhJN1NNMDM0S2ZYL2xzbVVqQ0EKa1Rnb0U5MVVkTzlwK0xXaEREbThKNVhoTWR4Q1JvU3BHVHUxUWFYOVpDNzdWMDNENWVMUCs4VU9zNFFkTnBVdwpYT0lCQVVHOXBUQ20wbVNaWDdoMGVwN3UxS1VrN2VRdStPK2lBUU9IclRhak1PalQzV0R1NWtqZERiS1VXV0ZDCjgrWWJvUUtCZ0hpakhGMEg3dXpZaDVVaS83L2lNMHBySXVUWmhzN0xabkZQaTdsVXRXWEZPZW5mMWdrLy8wOFIKMkdLdURscHp2T0p3WTFJK2YrbndZeWNXMWF0TFNUUDFjUnBHUDByUTBnOHlMY0ZkWERNMGxFamtEVFlCdGtDcgp3bFp6djNBL3NSekFaQnhKeGUxdTdKazNPYngvaGpxNmxXMzBIZFhFWHJtL3ZxbVZBZnlzCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==\n\n---\n# Source: cilium/templates/hubble/tls-helm/relay-client-secret.yaml\napiVersion: v1\nkind: Secret\nmetadata:\n name: hubble-relay-client-certs\n namespace: kube-system\ntype: kubernetes.io/tls\ndata:\n ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURGRENDQWZ5Z0F3SUJBZ0lSQUtSMlUwT0VVRU9OSEQySE82Z24yZDh3RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEkyTURneU16QXhNRE15T0ZvWERUSTVNRGd5TWpBeApNRE15T0Zvd0ZERVNNQkFHQTFVRUF4TUpRMmxzYVhWdElFTkJNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DCkFROEFNSUlCQ2dLQ0FRRUEwOVBDTENSRWQvaHNBZU9VYzlYSUFTK0ttQ3RFakdBSVhsSWVET0EvcHpkN0pqTDAKSnhiRy9QWElSR0M4L1dJakx5d1EyTFhBUGVzcllzN3ZQU09QaGl0Vld6b01CYW4yOUorVG1Ebkc3RGlZc2IwcgpDNXA1VnBzdFozNDgvOGcrR3VpeUlKVkxVL2Q2dmxvbE9LcHRQY1ZHMXVvdUxBdmpFeDNCRlJVc3dHNHU5ektmCk9kU3BTQVp3Z01XZzh5NzRoczJ3WGRpRXhIZ1pYZndLUkxBTkc2OFRuTnFBeEJjTFM2NDJqeXhnRS9wWnROMy8KN3M2N05rMkpCempSODBNL2JWSDJqQkZTaFJvL0RBZXBkVllQTjJSQUpaY3BTOE0vUVV4YVppamJpS085a1hpaQoyTGhBcUNic2FGZnRmRmZhMmJnL1lSaDhzdU5UNmc2QVVad0t3d0lEQVFBQm8yRXdYekFPQmdOVkhROEJBZjhFCkJBTUNBcVF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUYKTUFNQkFmOHdIUVlEVlIwT0JCWUVGRmRmcnFLaC9pZUtZa0tHcVJnNGFvc2ttSkd1TUEwR0NTcUdTSWIzRFFFQgpDd1VBQTRJQkFRQzlqRk85REx3MWlqbGV6b25FNVZJQnRoL0dvSkdha0loOHB6d1BRejBiUzFBSU5NZFBla3poCmd2Uys2SnJDODBPT29BSkNOU0xiY0ROVDlZV2t6MUNsZUxBYzlFMThPVUZFTkxlQnFYazRxcmV1eUJXN2MxbG8KbFBFclZudGhxOXF0NXllK0lwTjlxSFpoejVOaFIyd1dCUWdWQkphTmNiT1NocUVTMklXWmlQT1hFNVhocmxUbwpmL1k1cEJMNFpiejFTSUphZmU1UzZDNld2Znd6ZitXdzRsMzFzbTc5UDFRTG5id2ZCZXVpakg2Qm4wVk9VYmo3CmJWN3RhWGFNZzZMd29TVTBZdXNMQzZvdjJGdE1VZ3V5NUNFL20xdW5KQkJXR3AzVW8xYktRbWdBbldCR08zUmIKbytWUUpBWmFrdDVqSFRGaUQ0Tk5Xa24xSUN1SFh1dTYKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=\n tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURTRENDQWpDZ0F3SUJBZ0lRTU1lN3U0N2RVK0RueUpOZXQxcWRqREFOQmdrcWhraUc5dzBCQVFzRkFEQVUKTVJJd0VBWURWUVFERXdsRGFXeHBkVzBnUTBFd0hoY05Nall3T0RJek1ERXdNekk0V2hjTk1qY3dPREl6TURFdwpNekk0V2pBak1TRXdId1lEVlFRRERCZ3FMbWgxWW1Kc1pTMXlaV3hoZVM1amFXeHBkVzB1YVc4d2dnRWlNQTBHCkNTcUdTSWIzRFFFQkFRVUFBNElCRHdBd2dnRUtBb0lCQVFDd3YzUEVoa2FaMThoQTQ1cE5tbVFGYUV3MkcyNDAKWVdiZlU1TzJSZDhoclBPYlFIazJGYXNRTzVub1BNYk5KdHo3OTdlYndERVh4S0ZlU1lwUERWK0c0RkJWOWhVQgpEd0FkbTBWWkQxRTBCajhGdVhQMXhhT2F6SElSM01jS1c5cG5zMjdoSFd3SkJQN2hvSitPKzd2MzkvNFd2TWJmCmxkR3VSTHd3WnYwb1EwWG5CdVl0V0NmTytPRHdwZkVYdHRZNlJZRzJ5dGVQZjFTeU52OGU5Ylo0WDIvSWR5ZVIKWXpQZmFRb245eXFFMWVaRk1zTlV5Rndra05zRUdIL3ZyVzR2a3dKbndPRWlhWWFmWWVoZlNnd0gySEtHZGJCcgo5MGE4UWhpeW85UW9kMk40U2FJb3BlMExuTU9XUkRobjhoZlJPNTA2a1BvZWhqbUl0WVBwaytnbkFnTUJBQUdqCmdZWXdnWU13RGdZRFZSMFBBUUgvQkFRREFnV2dNQjBHQTFVZEpRUVdNQlFHQ0NzR0FRVUZCd01CQmdnckJnRUYKQlFjREFqQU1CZ05WSFJNQkFmOEVBakFBTUI4R0ExVWRJd1FZTUJhQUZGZGZycUtoL2llS1lrS0dxUmc0YW9zawptSkd1TUNNR0ExVWRFUVFjTUJxQ0dDb3VhSFZpWW14bExYSmxiR0Y1TG1OcGJHbDFiUzVwYnpBTkJna3Foa2lHCjl3MEJBUXNGQUFPQ0FRRUFjdEg4Z3hHNDdIRTVuTjNxOW16ZURKbU1MTUdkNmRUZ0ZRMUg0YVlHY294OGszZUIKY3VEdDJZMGZlVmtyUVNPZWZLaS9hU0xHb3Yvb1ljenJNK1BjL08vanBXMVlVUE96T0w3YmRzQjdvckw5WDNieQplaUg2bEJkRzNpNFhodDkrdm5uc1BGODNHYzlNZ01ybklTT1dOWnRsdW5sMGdQSU92VFlhQlpySWZVWmRHNnpyClNibUhxNDRNRXBLaHZLYjdkMlFHOVVrbWdBYmJNWS84SU14Yy9BUWQwUTR4ZG9pSkpPVHRiRXdBaktCaVMrTGoKRlVyZkhNRDBTNXAvUkNCK2pQTUgyWVd0QjA0dFF5cStuTzVZa28rZXBxbEdpbTNVYm4xUkFLQVZPMkxDVUc0agpTcHljUnVIbGtpL0huQzhlaVB2elliOUNXcU5XdHV1TkZacjUwdz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K\n tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBc0w5enhJWkdtZGZJUU9PYVRacGtCV2hNTmh0dU5HRm0zMU9UdGtYZklhenptMEI1Ck5oV3JFRHVaNkR6R3pTYmMrL2UzbThBeEY4U2hYa21LVHcxZmh1QlFWZllWQVE4QUhadEZXUTlSTkFZL0JibHoKOWNXam1zeHlFZHpIQ2x2YVo3TnU0UjFzQ1FUKzRhQ2ZqdnU3OS9mK0ZyekczNVhScmtTOE1HYjlLRU5GNXdibQpMVmduenZqZzhLWHhGN2JXT2tXQnRzclhqMzlVc2piL0h2VzJlRjl2eUhjbmtXTXozMmtLSi9jcWhOWG1SVExEClZNaGNKSkRiQkJoLzc2MXVMNU1DWjhEaEltbUduMkhvWDBvTUI5aHlobld3YS9kR3ZFSVlzcVBVS0hkamVFbWkKS0tYdEM1ekRsa1E0Wi9JWDBUdWRPcEQ2SG9ZNWlMV0Q2WlBvSndJREFRQUJBb0lCQUJJc1ZVaHZNQUl3ZkRBagoxdUZFenlUNU1PRGRXQ3I5bXRpNm5MVUFvUzB5dmNlSVRRNUJFeG96cnFNQTRNWUdTWEdFNm5XU3dObDdSOFpNCmxIS0ZZdjJZd2RuYzJCTUlTbEJBLzFQbGJjbUdIT1BIU2tPS2cwUnU0Z214SkN3Ti9ycHI2aW91WHNYY3BDSnAKNUE0TkZ5b3JidzVDY2NaYWZybEc2dnlsRWtHWjRXZFVaekR5MzEvZjlCN2VJNlFzT0ZvYXdxZ1I3VGlYN0JtNQprcFJXVkNQY2NTQ01ic0tUeVA5S21HTE1EZms0QVVDaWJGMXlBaUpoWXdrdmpkdjl1T1hZZFBXaTNQbStGQlZkCkFxejhQVndWOGRzVWlHQXFNVjNaUWY4cDY3UWtsQTRXR0NucHBGV0E3VVdUREhYMjZCQ1VZbjFnL3F5R2dkeXIKQ0Nna1B6MENnWUVBM093TWpNazJKOXpLL0F6YUJRNFRiNlZDYlNxemlhUEQwRGRweHVubDFCblJmU3U5bVVZZQpOSVRXc2dVM3NsMVhQa1FZZUROS2RYc015QzZCcnh6Y2pvclN5RjBSaEtIVFg2RTNISmw4OEc4R2xzQ3VzbXhSCkdXQmc5ZUpNSVJKcW8rM3dIQm9WQis4UWNkSkRuUWJINDE1TTdod2c2N2R1bmlwcThRZFJvbzBDZ1lFQXpNL1QKOEpsOC9uNHpTZmlDdHJTM0o2aEFBZUdhMWdDbzdzV2VIbHVwL29OaUlEMUZZMEFQZ1BtWTFYMXZFaU9WSVByeApDU0NISVRYQjhjeDN5MjFXL0IxdkIzUWlnYnFuTjN1bGo3RExxNGY2ZENieFVNRDJRcUhReEpTOUJwRnpvMnZNCnJzMDE0UVdoUGVWL2ViTkpaT00zTktDRXJ1UzRiUFRCM3YzVElvTUNnWUJITkdHYkl1TXNsL0pvcUsvQWYxZnUKWFNKNjB3K0k1bHFmaXF5eUt3TWppS3JIb0VoODFXZTQzN1BmTHVWVHZOZjR2clB3VWYvR3U4RlQ2QUZ1Y212NApHWEIwbWVLaWtCSHp1WjlzdlYvU2tzWlo0b0tzQ1ZOZVRYMFM0enhNVUlaRWpkVWRDWjhMcnBiclNLejRPSTVHCmowZFdXNFNVMU10M2VRNTgzeklGcFFLQmdFcmxuVjJZNDRxMVg5QW5Iclh0dENTK2RGbTd4TUdKa0QxdzZ2ZXoKRWFGUExtMFh1dTRtbVFUVFFiNmdsaU9OKzVVSjcyY2xEQVZyQVRlSlRDMktHSXN0d0ZKN2Q3cjFKUDAzTEQ0MQpxdVZaWG85blJrdi9wSTZOV2lqcE00N1pWZTVuRjN5ODhuME5iLytRazJOUDJ3RVh6akppbU9MVUpWVkMxRHJWCm00WTlBb0dCQUpMUFFDU3MrdnVwWjRFdlJIVjhZNGRKYmk1UGZPREZRTmppMjZTa091K2tRT3ovQk9GQU83ZFEKTVVOcXZLemxnZ0VjRUh3U0lmWFljSGpEOVNOSnIxKzc1cEsyUmUyMmhOeVE5MCtMSnZvR2VQc21YVTB4QzVaRApnUnpob293SlQzVUJNM2hlSkVzc1Q0MDV0V0FtQUE2NHNDekZZN3gwdlk2cXM3SXMvNnFuCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==\n\n---\n# Source: cilium/templates/hubble/tls-helm/server-secret.yaml\napiVersion: v1\nkind: Secret\nmetadata:\n name: hubble-server-certs\n namespace: kube-system\ntype: kubernetes.io/tls\ndata:\n ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURGRENDQWZ5Z0F3SUJBZ0lSQUtSMlUwT0VVRU9OSEQySE82Z24yZDh3RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEkyTURneU16QXhNRE15T0ZvWERUSTVNRGd5TWpBeApNRE15T0Zvd0ZERVNNQkFHQTFVRUF4TUpRMmxzYVhWdElFTkJNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DCkFROEFNSUlCQ2dLQ0FRRUEwOVBDTENSRWQvaHNBZU9VYzlYSUFTK0ttQ3RFakdBSVhsSWVET0EvcHpkN0pqTDAKSnhiRy9QWElSR0M4L1dJakx5d1EyTFhBUGVzcllzN3ZQU09QaGl0Vld6b01CYW4yOUorVG1Ebkc3RGlZc2IwcgpDNXA1VnBzdFozNDgvOGcrR3VpeUlKVkxVL2Q2dmxvbE9LcHRQY1ZHMXVvdUxBdmpFeDNCRlJVc3dHNHU5ektmCk9kU3BTQVp3Z01XZzh5NzRoczJ3WGRpRXhIZ1pYZndLUkxBTkc2OFRuTnFBeEJjTFM2NDJqeXhnRS9wWnROMy8KN3M2N05rMkpCempSODBNL2JWSDJqQkZTaFJvL0RBZXBkVllQTjJSQUpaY3BTOE0vUVV4YVppamJpS085a1hpaQoyTGhBcUNic2FGZnRmRmZhMmJnL1lSaDhzdU5UNmc2QVVad0t3d0lEQVFBQm8yRXdYekFPQmdOVkhROEJBZjhFCkJBTUNBcVF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUYKTUFNQkFmOHdIUVlEVlIwT0JCWUVGRmRmcnFLaC9pZUtZa0tHcVJnNGFvc2ttSkd1TUEwR0NTcUdTSWIzRFFFQgpDd1VBQTRJQkFRQzlqRk85REx3MWlqbGV6b25FNVZJQnRoL0dvSkdha0loOHB6d1BRejBiUzFBSU5NZFBla3poCmd2Uys2SnJDODBPT29BSkNOU0xiY0ROVDlZV2t6MUNsZUxBYzlFMThPVUZFTkxlQnFYazRxcmV1eUJXN2MxbG8KbFBFclZudGhxOXF0NXllK0lwTjlxSFpoejVOaFIyd1dCUWdWQkphTmNiT1NocUVTMklXWmlQT1hFNVhocmxUbwpmL1k1cEJMNFpiejFTSUphZmU1UzZDNld2Znd6ZitXdzRsMzFzbTc5UDFRTG5id2ZCZXVpakg2Qm4wVk9VYmo3CmJWN3RhWGFNZzZMd29TVTBZdXNMQzZvdjJGdE1VZ3V5NUNFL20xdW5KQkJXR3AzVW8xYktRbWdBbldCR08zUmIKbytWUUpBWmFrdDVqSFRGaUQ0Tk5Xa24xSUN1SFh1dTYKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=\n tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURWekNDQWorZ0F3SUJBZ0lSQUlpN2xLVStIRTQ2VnorQnlyLzNiR013RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEkyTURneU16QXhNRE15T0ZvWERUSTNNRGd5TXpBeApNRE15T0Zvd0tqRW9NQ1lHQTFVRUF3d2ZLaTVrWldaaGRXeDBMbWgxWW1Kc1pTMW5jbkJqTG1OcGJHbDFiUzVwCmJ6Q0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCQUs0S0RvMG8wZWJoQzRXZW81dVEKWVR5dHZkK1BZZHZBR0k3UFltQUp0R3JFdGt1TDZKZEpYUnp1QU84dW9zK00zMk43bmV3OG40dFQ5Um9BeHpkWQpwbGdabnlvcDk2VStuSUZnUjhGWkxTV3UxN2R6bjJRYVFHRW55Yy9IMnVqQ1hlSFZYQUg2ZHQvTUU0bUZuTm8yCmcrZktGWHlQcUYvSmpDd0xpR0w2QjlKa2ZEOG51QlAyZHJOa2lRZllGay9OaVlyUXQyb2YxdlhwSy9CdGpzYkIKbnhVYmxCNG9TY3RjclBqcEVMYkpCWlNrMENOZXEycnRvdExXd1o4NTNKU0Vab1R0c0tteFE1VC9mejN1OVluKwpzRWluMUdNSGFIaURYRmQ0Qit0RDUrRnNpdm45clUxK2l6TlU5Y3YzMXNxSGtKcStVREtTWUdBeWtobTNKOTU1CjQ0OENBd0VBQWFPQmpUQ0JpakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdIUVlEVlIwbEJCWXdGQVlJS3dZQkJRVUgKQXdFR0NDc0dBUVVGQndNQ01Bd0dBMVVkRXdFQi93UUNNQUF3SHdZRFZSMGpCQmd3Rm9BVVYxK3VvcUgrSjRwaQpRb2FwR0RocWl5U1lrYTR3S2dZRFZSMFJCQ013SVlJZktpNWtaV1poZFd4MExtaDFZbUpzWlMxbmNuQmpMbU5wCmJHbDFiUzVwYnpBTkJna3Foa2lHOXcwQkFRc0ZBQU9DQVFFQXcza3ZUZFl2Wm14ZFNGSjR3RmNyRFpIei9ORDgKSlFvNS9PTkM2S2kzSmlFazk1MGtPMlFiQ0t4US82aDRydFFQVFJSS0MzRWcxTk9RWCt6NVR1UHN2ZkFRcXpTNApLeXlQbmdEcVI5SWQrQXlsQi9PL0dIYktCdlRCbW13dXpQdzB2aU9mdHdEM1FOSjIyYUlGcVRod0UydyswdjdZCkhNc0dHTlhjTWExaXByL2RvQzg4SU1sSURHM0V1ZS9lUytvM3VUNnRQK2VseHdTWnVkZFl0TTRiM3lsQklRVVAKb3lWSFh6WEN1Vk1lYXNJNUdIY1MvTGYzTkM5eUNueXl3Tyt0SEJMd1NSTmpiSDdGdTY3T1VMd3k2ZDVmWkFWaQptVW9NL0NqNmxNbit5cUQ0QUJUNDc3amFRdndXWTFsWFZpNjI2UmNFRlBiMTQ1OUxOUVJRV3VsL0lRPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=\n tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBcmdvT2pTalI1dUVMaFo2am01QmhQSzI5MzQ5aDI4QVlqczlpWUFtMGFzUzJTNHZvCmwwbGRITzRBN3k2aXo0emZZM3VkN0R5ZmkxUDFHZ0RITjFpbVdCbWZLaW4zcFQ2Y2dXQkh3Vmt0SmE3WHQzT2YKWkJwQVlTZkp6OGZhNk1KZDRkVmNBZnAyMzh3VGlZV2MyamFENThvVmZJK29YOG1NTEF1SVl2b0gwbVI4UHllNApFL1oyczJTSkI5Z1dUODJKaXRDM2FoL1c5ZWtyOEcyT3hzR2ZGUnVVSGloSnkxeXMrT2tRdHNrRmxLVFFJMTZyCmF1MmkwdGJCbnpuY2xJUm1oTzJ3cWJGRGxQOS9QZTcxaWY2d1NLZlVZd2RvZUlOY1YzZ0g2MFBuNFd5SytmMnQKVFg2TE0xVDF5L2ZXeW9lUW1yNVFNcEpnWURLU0diY24zbm5qandJREFRQUJBb0lCQUFWZVFUNkR6UU9HZlQ0NQp1MkRXdmsxWFh4NHpxSWRWTzBJRTlGeEFIMUNsNWtLaVNDSTBuTE5PemkvRnJqY2hlYVkycytpMktzcHpaRitkCjQ1aENYMW5PYzdZOFM5SUFFM2UrN29SNUtiSGVaWXo2WWNDZ1N1NTRnajdNLzNXV09UT2kvZzdkMUo4K0JyLzYKeFp0ajRUY0dpdmVuOGVxSHlhQ0c5OTkwbllwN1Y0VkREb1FXZXFyNjQ4aDl5dUt1ZXVJaTFvWGYwMDJWbjFNWgpBd21UM0dNQnh5OUxRV1JJYk5BYUp4b0k5MmlvVDdlVHZUM2QxbURnNmlzQzJSWFJMSzI2L3NCN09jenUrcWlMCm9IbUVOTjg4c1d3QUl3TDBHWVZpb09LUjIyL2VoSmJmejJRcVZ5VDJOQk8rVlNTTUhFYW9vV3c3M3BzNkF5ek8KK2pEdHZRRUNnWUVBNVNmTXpSOFlPTGxCbXJBSUZlYndrbExsWC9OWVk0bDVJbFk2b2RtM0w0Sy9vdHY0SENCTgo2SlRicUVUcDMwbWZ0MzkyWHpQUGNxdDJIM01GMGcvMndMNHBjTHFEMXZuc2diOStuaExyOWUyVmFPaHdZbnAxCm1vaDlsQjA2bEpNS2V3WlZzMGlCWjFXeTNickZMSGg4U0FqY1d4SXhPSklzZDJRODI0LzVCMEVDZ1lFQXdtMWQKTEwvS0ZpVXpIS2RZa01EM25ZZUpIcjF6ZjlkeERiL1lOM3doNEpnYzg4Njh4K3lsb29DbTlxNUhkQ3BtSDRiWgpVV1g5aEgyRDREeHJjbVdydFZrd0RZTmQ1bitXVjg2R0tkMWhVRysxMnRvTWF2YmEydDA2UXc2THpGdlVYb2QwClV3SkE2OU96NVJBaUJiRytjNnBXRFNuRjQ0elYxQ1JjcDk4UmhzOENnWUFFZnlGdnJQcUdzbXZ0SXlNbGV1Q2gKbm1yTjFUS1kwV3ZGRnJnVDBQZmRRTTJOM284aHppaDVOZUtSakxpaUh3bTVTaEVDa1R1eTNsWjFDNGJEdG5oNwpFOEF3YkJpR01XVklybjlIanN0K2llanlwQTBBZ2JLcEU2Q1ROWGVlenJ2WDZpbm9XTFhoVnpjcFRxN3J6bmx4CjJHcXFodExjYjFIY0RlVjcwWGxyZ1FLQmdBTkgrVFNTSUFUenA4TXFCOUtaanhRM2YxYm5kNVdHdXoreUp5SDQKbEZISC8yVVY3aFdwcHJueFZkLy8zUERXN2xaRjNsRURXWjNzeUZiMmJoSEdLWG1zQWFXWXUvTHg0RVduRkppTQpSZUlub0hnTENmNmNIK0Zscm1BSFZOQ2tGQmRzVGNoQTEzdWpYUHZXbzl4WXZaQVNKZFdmQ05ub1BJdVIrWVpUCnUyWDlBb0dCQUlrQzJiUENUREFOMktzdGVWa24vbWFBamMxT3ZFYWlodTVkMW1xOUVEMkVXRFFuazNoSlJsNmQKNFpSQUlIZ281YSsxTmZEcEhqckhtRGtrTTVjQmMwTmhnUzlwK0w1NW16WERscnQ2RUxHdG43U2N1ZlpkaGVVbwpzcldBSy9oSkduZXM2bGtrckRtaTNsOTQ4VUJPdThkcFludldBd2pRRGp2WW5zeWtLL0k3Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==\n\n---\n# Source: cilium/templates/cilium-configmap.yaml\napiVersion: v1\nkind: ConfigMap\nmetadata:\n name: cilium-config\n namespace: kube-system\ndata:\n\n # Identity allocation mode selects how identities are shared between cilium\n # nodes by setting how they are stored. The options are \"crd\", \"kvstore\" or\n # \"doublewrite-readkvstore\" / \"doublewrite-readcrd\".\n # - \"crd\" stores identities in kubernetes as CRDs (custom resource definition).\n # These can be queried with:\n # kubectl get ciliumid\n # - \"kvstore\" stores identities in an etcd kvstore, that is\n # configured below. Cilium versions before 1.6 supported only the kvstore\n # backend. Upgrades from these older cilium versions should continue using\n # the kvstore by commenting out the identity-allocation-mode below, or\n # setting it to \"kvstore\".\n # - \"doublewrite\" modes store identities in both the kvstore and CRDs. This is useful\n # for seamless migrations from the kvstore mode to the crd mode. Consult the\n # documentation for more information on how to perform the migration.\n identity-allocation-mode: crd\n\n identity-heartbeat-timeout: \"30m0s\"\n identity-gc-interval: \"15m0s\"\n cilium-endpoint-gc-interval: \"5m0s\"\n nodes-gc-interval: \"5m0s\"\n\n # If you want to run cilium in debug mode change this value to true\n debug: \"false\"\n # The agent can be put into the following three policy enforcement modes\n # default, always and never.\n # https://docs.cilium.io/en/latest/security/policy/intro/#policy-enforcement-modes\n enable-policy: \"default\"\n # If you want metrics enabled in cilium-operator, set the port for\n # which the Cilium Operator will have their metrics exposed.\n # NOTE that this will open the port on the nodes where Cilium operator pod\n # is scheduled.\n operator-prometheus-serve-addr: \":9963\"\n enable-metrics: \"true\"\n enable-policy-secrets-sync: \"true\"\n policy-secrets-only-from-secrets-namespace: \"true\"\n policy-secrets-namespace: \"cilium-secrets\"\n\n # Enable IPv4 addressing. If enabled, all endpoints are allocated an IPv4\n # address.\n enable-ipv4: \"true\"\n\n # Enable IPv6 addressing. If enabled, all endpoints are allocated an IPv6\n # address.\n enable-ipv6: \"false\"\n # Users who wish to specify their own custom CNI configuration file must set\n # custom-cni-conf to \"true\", otherwise Cilium may overwrite the configuration.\n custom-cni-conf: \"false\"\n enable-bpf-clock-probe: \"false\"\n # If you want cilium monitor to aggregate tracing for packets, set this level\n # to \"low\", \"medium\", or \"maximum\". The higher the level, the less packets\n # that will be seen in monitor output.\n monitor-aggregation: medium\n\n # The monitor aggregation interval governs the typical time between monitor\n # notification events for each allowed connection.\n #\n # Only effective when monitor aggregation is set to \"medium\" or higher.\n monitor-aggregation-interval: \"5s\"\n\n # The monitor aggregation flags determine which TCP flags which, upon the\n # first observation, cause monitor notifications to be generated.\n #\n # Only effective when monitor aggregation is set to \"medium\" or higher.\n monitor-aggregation-flags: all\n # Specifies the ratio (0.0-1.0] of total system memory to use for dynamic\n # sizing of the TCP CT, non-TCP CT, NAT and policy BPF maps.\n bpf-map-dynamic-size-ratio: \"0.0025\"\n # bpf-policy-map-max specifies the maximum number of entries in endpoint\n # policy map (per endpoint)\n bpf-policy-map-max: \"16384\"\n # bpf-lb-map-max specifies the maximum number of entries in bpf lb service,\n # backend and affinity maps.\n bpf-lb-map-max: \"65536\"\n bpf-lb-external-clusterip: \"false\"\n bpf-lb-source-range-all-types: \"false\"\n bpf-lb-algorithm-annotation: \"false\"\n bpf-lb-mode-annotation: \"false\"\n\n bpf-distributed-lru: \"false\"\n bpf-events-drop-enabled: \"true\"\n bpf-events-policy-verdict-enabled: \"true\"\n bpf-events-trace-enabled: \"true\"\n\n # Pre-allocation of map entries allows per-packet latency to be reduced, at\n # the expense of up-front memory allocation for the entries in the maps. The\n # default value below will minimize memory usage in the default installation;\n # users who are sensitive to latency may consider setting this to \"true\".\n #\n # This option was introduced in Cilium 1.4. Cilium 1.3 and earlier ignore\n # this option and behave as though it is set to \"true\".\n #\n # If this value is modified, then during the next Cilium startup the restore\n # of existing endpoints and tracking of ongoing connections may be disrupted.\n # As a result, reply packets may be dropped and the load-balancing decisions\n # for established connections may change.\n #\n # If this option is set to \"false\" during an upgrade from 1.3 or earlier to\n # 1.4 or later, then it may cause one-time disruptions during the upgrade.\n preallocate-bpf-maps: \"false\"\n\n # Name of the cluster. Only relevant when building a mesh of clusters.\n cluster-name: default\n # Unique ID of the cluster. Must be unique across all conneted clusters and\n # in the range of 1 and 255. Only relevant when building a mesh of clusters.\n cluster-id: \"0\"\n\n # Encapsulation mode for communication between nodes\n # Possible values:\n # - disabled\n # - vxlan (default)\n # - geneve\n\n routing-mode: \"tunnel\"\n tunnel-protocol: \"vxlan\"\n tunnel-source-port-range: \"0-0\"\n service-no-backend-response: \"reject\"\n\n\n # Enables L7 proxy for L7 policy enforcement and visibility\n enable-l7-proxy: \"true\"\n\n enable-ipv4-masquerade: \"true\"\n enable-ipv4-big-tcp: \"false\"\n enable-ipv6-big-tcp: \"false\"\n enable-ipv6-masquerade: \"true\"\n enable-tcx: \"true\"\n datapath-mode: \"veth\"\n enable-masquerade-to-route-source: \"false\"\n\n enable-xt-socket-fallback: \"true\"\n install-no-conntrack-iptables-rules: \"false\"\n iptables-random-fully: \"false\"\n\n auto-direct-node-routes: \"false\"\n direct-routing-skip-unreachable: \"false\"\n enable-local-redirect-policy: \"false\"\n enable-runtime-device-detection: \"true\"\n\n kube-proxy-replacement: \"true\"\n kube-proxy-replacement-healthz-bind-address: \"\"\n bpf-lb-sock: \"false\"\n enable-health-check-nodeport: \"true\"\n enable-health-check-loadbalancer-ip: \"false\"\n node-port-bind-protection: \"true\"\n enable-auto-protect-node-port-range: \"true\"\n bpf-lb-acceleration: \"disabled\"\n enable-experimental-lb: \"false\"\n enable-svc-source-range-check: \"true\"\n enable-l2-neigh-discovery: \"true\"\n arping-refresh-period: \"30s\"\n k8s-require-ipv4-pod-cidr: \"false\"\n k8s-require-ipv6-pod-cidr: \"false\"\n enable-k8s-networkpolicy: \"true\"\n enable-endpoint-lockdown-on-policy-overflow: \"false\"\n # Tell the agent to generate and write a CNI configuration file\n write-cni-conf-when-ready: /host/etc/cni/net.d/05-cilium.conflist\n cni-exclusive: \"true\"\n cni-log-file: \"/var/run/cilium/cilium-cni.log\"\n enable-endpoint-health-checking: \"true\"\n enable-health-checking: \"true\"\n health-check-icmp-failure-threshold: \"3\"\n enable-well-known-identities: \"false\"\n enable-node-selector-labels: \"false\"\n synchronize-k8s-nodes: \"true\"\n operator-api-serve-addr: \"127.0.0.1:9234\"\n\n enable-hubble: \"true\"\n # UNIX domain socket for Hubble server to listen to.\n hubble-socket-path: \"/var/run/cilium/hubble.sock\"\n hubble-export-file-max-size-mb: \"10\"\n hubble-export-file-max-backups: \"5\"\n # An additional address for Hubble server to listen to (e.g. \":4244\").\n hubble-listen-address: \":4244\"\n hubble-disable-tls: \"false\"\n hubble-tls-cert-file: /var/lib/cilium/tls/hubble/server.crt\n hubble-tls-key-file: /var/lib/cilium/tls/hubble/server.key\n hubble-tls-client-ca-files: /var/lib/cilium/tls/hubble/client-ca.crt\n ipam: \"kubernetes\"\n ipam-cilium-node-update-rate: \"15s\"\n\n default-lb-service-ipam: \"lbipam\"\n egress-gateway-reconciliation-trigger-interval: \"1s\"\n enable-vtep: \"false\"\n vtep-endpoint: \"\"\n vtep-cidr: \"\"\n vtep-mask: \"\"\n vtep-mac: \"\"\n procfs: \"/host/proc\"\n bpf-root: \"/sys/fs/bpf\"\n cgroup-root: \"/run/cilium/cgroupv2\"\n enable-k8s-terminating-endpoint: \"true\"\n enable-sctp: \"false\"\n remove-cilium-node-taints: \"true\"\n set-cilium-node-taints: \"true\"\n set-cilium-is-up-condition: \"true\"\n unmanaged-pod-watcher-interval: \"15\"\n # default DNS proxy to transparent mode in non-chaining modes\n dnsproxy-enable-transparent-mode: \"true\"\n dnsproxy-socket-linger-timeout: \"10\"\n tofqdns-dns-reject-response-code: \"refused\"\n tofqdns-enable-dns-compression: \"true\"\n tofqdns-endpoint-max-ip-per-hostname: \"1000\"\n tofqdns-idle-connection-grace-period: \"0s\"\n tofqdns-max-deferred-connection-deletes: \"10000\"\n tofqdns-proxy-response-max-delay: \"100ms\"\n agent-not-ready-taint-key: \"node.cilium.io/agent-not-ready\"\n\n mesh-auth-enabled: \"true\"\n mesh-auth-queue-size: \"1024\"\n mesh-auth-rotated-identities-queue-size: \"1024\"\n mesh-auth-gc-interval: \"5m0s\"\n\n proxy-xff-num-trusted-hops-ingress: \"0\"\n proxy-xff-num-trusted-hops-egress: \"0\"\n proxy-connect-timeout: \"2\"\n proxy-initial-fetch-timeout: \"30\"\n proxy-max-requests-per-connection: \"0\"\n proxy-max-connection-duration-seconds: \"0\"\n proxy-idle-timeout-seconds: \"60\"\n proxy-max-concurrent-retries: \"128\"\n http-retry-count: \"3\"\n\n external-envoy-proxy: \"true\"\n envoy-base-id: \"0\"\n envoy-access-log-buffer-size: \"4096\"\n envoy-keep-cap-netbindservice: \"false\"\n max-connected-clusters: \"255\"\n clustermesh-enable-endpoint-sync: \"false\"\n clustermesh-enable-mcs-api: \"false\"\n\n nat-map-stats-entries: \"32\"\n nat-map-stats-interval: \"30s\"\n enable-internal-traffic-policy: \"true\"\n enable-lb-ipam: \"true\"\n enable-non-default-deny-policies: \"true\"\n enable-source-ip-verification: \"true\"\n\n# Extra config allows adding arbitrary properties to the cilium config.\n# By putting it at the end of the ConfigMap, it's also possible to override existing properties.\n---\n# Source: cilium/templates/cilium-envoy/configmap.yaml\napiVersion: v1\nkind: ConfigMap\nmetadata:\n name: cilium-envoy-config\n namespace: kube-system\ndata:\n # Keep the key name as bootstrap-config.json to avoid breaking changes\n bootstrap-config.json: |\n {\"admin\":{\"address\":{\"pipe\":{\"path\":\"/var/run/cilium/envoy/sockets/admin.sock\"}}},\"applicationLogConfig\":{\"logFormat\":{\"textFormat\":\"[%Y-%m-%d %T.%e][%t][%l][%n] [%g:%#] %v\"}},\"bootstrapExtensions\":[{\"name\":\"envoy.bootstrap.internal_listener\",\"typedConfig\":{\"@type\":\"type.googleapis.com/envoy.extensions.bootstrap.internal_listener.v3.InternalListener\"}}],\"dynamicResources\":{\"cdsConfig\":{\"apiConfigSource\":{\"apiType\":\"GRPC\",\"grpcServices\":[{\"envoyGrpc\":{\"clusterName\":\"xds-grpc-cilium\"}}],\"setNodeOnFirstMessageOnly\":true,\"transportApiVersion\":\"V3\"},\"initialFetchTimeout\":\"30s\",\"resourceApiVersion\":\"V3\"},\"ldsConfig\":{\"apiConfigSource\":{\"apiType\":\"GRPC\",\"grpcServices\":[{\"envoyGrpc\":{\"clusterName\":\"xds-grpc-cilium\"}}],\"setNodeOnFirstMessageOnly\":true,\"transportApiVersion\":\"V3\"},\"initialFetchTimeout\":\"30s\",\"resourceApiVersion\":\"V3\"}},\"node\":{\"cluster\":\"ingress-cluster\",\"id\":\"host~127.0.0.1~no-id~localdomain\"},\"overloadManager\":{\"resourceMonitors\":[{\"name\":\"envoy.resource_monitors.global_downstream_max_connections\",\"typedConfig\":{\"@type\":\"type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig\",\"max_active_downstream_connections\":\"50000\"}}]},\"staticResources\":{\"clusters\":[{\"circuitBreakers\":{\"thresholds\":[{\"maxRetries\":128}]},\"cleanupInterval\":\"2.500s\",\"connectTimeout\":\"2s\",\"lbPolicy\":\"CLUSTER_PROVIDED\",\"name\":\"ingress-cluster\",\"type\":\"ORIGINAL_DST\",\"typedExtensionProtocolOptions\":{\"envoy.extensions.upstreams.http.v3.HttpProtocolOptions\":{\"@type\":\"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\"commonHttpProtocolOptions\":{\"idleTimeout\":\"60s\",\"maxConnectionDuration\":\"0s\",\"maxRequestsPerConnection\":0},\"useDownstreamProtocolConfig\":{}}}},{\"circuitBreakers\":{\"thresholds\":[{\"maxRetries\":128}]},\"cleanupInterval\":\"2.500s\",\"connectTimeout\":\"2s\",\"lbPolicy\":\"CLUSTER_PROVIDED\",\"name\":\"egress-cluster-tls\",\"transportSocket\":{\"name\":\"cilium.tls_wrapper\",\"typedConfig\":{\"@type\":\"type.googleapis.com/cilium.UpstreamTlsWrapperContext\"}},\"type\":\"ORIGINAL_DST\",\"typedExtensionProtocolOptions\":{\"envoy.extensions.upstreams.http.v3.HttpProtocolOptions\":{\"@type\":\"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\"commonHttpProtocolOptions\":{\"idleTimeout\":\"60s\",\"maxConnectionDuration\":\"0s\",\"maxRequestsPerConnection\":0},\"upstreamHttpProtocolOptions\":{},\"useDownstreamProtocolConfig\":{}}}},{\"circuitBreakers\":{\"thresholds\":[{\"maxRetries\":128}]},\"cleanupInterval\":\"2.500s\",\"connectTimeout\":\"2s\",\"lbPolicy\":\"CLUSTER_PROVIDED\",\"name\":\"egress-cluster\",\"type\":\"ORIGINAL_DST\",\"typedExtensionProtocolOptions\":{\"envoy.extensions.upstreams.http.v3.HttpProtocolOptions\":{\"@type\":\"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\"commonHttpProtocolOptions\":{\"idleTimeout\":\"60s\",\"maxConnectionDuration\":\"0s\",\"maxRequestsPerConnection\":0},\"useDownstreamProtocolConfig\":{}}}},{\"circuitBreakers\":{\"thresholds\":[{\"maxRetries\":128}]},\"cleanupInterval\":\"2.500s\",\"connectTimeout\":\"2s\",\"lbPolicy\":\"CLUSTER_PROVIDED\",\"name\":\"ingress-cluster-tls\",\"transportSocket\":{\"name\":\"cilium.tls_wrapper\",\"typedConfig\":{\"@type\":\"type.googleapis.com/cilium.UpstreamTlsWrapperContext\"}},\"type\":\"ORIGINAL_DST\",\"typedExtensionProtocolOptions\":{\"envoy.extensions.upstreams.http.v3.HttpProtocolOptions\":{\"@type\":\"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\"commonHttpProtocolOptions\":{\"idleTimeout\":\"60s\",\"maxConnectionDuration\":\"0s\",\"maxRequestsPerConnection\":0},\"upstreamHttpProtocolOptions\":{},\"useDownstreamProtocolConfig\":{}}}},{\"connectTimeout\":\"2s\",\"loadAssignment\":{\"clusterName\":\"xds-grpc-cilium\",\"endpoints\":[{\"lbEndpoints\":[{\"endpoint\":{\"address\":{\"pipe\":{\"path\":\"/var/run/cilium/envoy/sockets/xds.sock\"}}}}]}]},\"name\":\"xds-grpc-cilium\",\"type\":\"STATIC\",\"typedExtensionProtocolOptions\":{\"envoy.extensions.upstreams.http.v3.HttpProtocolOptions\":{\"@type\":\"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\"explicitHttpConfig\":{\"http2ProtocolOptions\":{}}}}},{\"connectTimeout\":\"2s\",\"loadAssignment\":{\"clusterName\":\"/envoy-admin\",\"endpoints\":[{\"lbEndpoints\":[{\"endpoint\":{\"address\":{\"pipe\":{\"path\":\"/var/run/cilium/envoy/sockets/admin.sock\"}}}}]}]},\"name\":\"/envoy-admin\",\"type\":\"STATIC\"}],\"listeners\":[{\"address\":{\"socketAddress\":{\"address\":\"0.0.0.0\",\"portValue\":9964}},\"filterChains\":[{\"filters\":[{\"name\":\"envoy.filters.network.http_connection_manager\",\"typedConfig\":{\"@type\":\"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\",\"httpFilters\":[{\"name\":\"envoy.filters.http.router\",\"typedConfig\":{\"@type\":\"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\"}}],\"internalAddressConfig\":{\"cidrRanges\":[{\"addressPrefix\":\"10.0.0.0\",\"prefixLen\":8},{\"addressPrefix\":\"172.16.0.0\",\"prefixLen\":12},{\"addressPrefix\":\"192.168.0.0\",\"prefixLen\":16},{\"addressPrefix\":\"127.0.0.1\",\"prefixLen\":32}]},\"routeConfig\":{\"virtualHosts\":[{\"domains\":[\"*\"],\"name\":\"prometheus_metrics_route\",\"routes\":[{\"match\":{\"prefix\":\"/metrics\"},\"name\":\"prometheus_metrics_route\",\"route\":{\"cluster\":\"/envoy-admin\",\"prefixRewrite\":\"/stats/prometheus\"}}]}]},\"statPrefix\":\"envoy-prometheus-metrics-listener\",\"streamIdleTimeout\":\"0s\"}}]}],\"name\":\"envoy-prometheus-metrics-listener\"},{\"address\":{\"socketAddress\":{\"address\":\"127.0.0.1\",\"portValue\":9878}},\"filterChains\":[{\"filters\":[{\"name\":\"envoy.filters.network.http_connection_manager\",\"typedConfig\":{\"@type\":\"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\",\"httpFilters\":[{\"name\":\"envoy.filters.http.router\",\"typedConfig\":{\"@type\":\"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\"}}],\"internalAddressConfig\":{\"cidrRanges\":[{\"addressPrefix\":\"10.0.0.0\",\"prefixLen\":8},{\"addressPrefix\":\"172.16.0.0\",\"prefixLen\":12},{\"addressPrefix\":\"192.168.0.0\",\"prefixLen\":16},{\"addressPrefix\":\"127.0.0.1\",\"prefixLen\":32}]},\"routeConfig\":{\"virtual_hosts\":[{\"domains\":[\"*\"],\"name\":\"health\",\"routes\":[{\"match\":{\"prefix\":\"/healthz\"},\"name\":\"health\",\"route\":{\"cluster\":\"/envoy-admin\",\"prefixRewrite\":\"/ready\"}}]}]},\"statPrefix\":\"envoy-health-listener\",\"streamIdleTimeout\":\"0s\"}}]}],\"name\":\"envoy-health-listener\"}]}}\n\n---\n# Source: cilium/templates/hubble-relay/configmap.yaml\napiVersion: v1\nkind: ConfigMap\nmetadata:\n name: hubble-relay-config\n namespace: kube-system\ndata:\n config.yaml: |\n cluster-name: default\n peer-service: \"hubble-peer.kube-system.svc.cluster.local.:443\"\n listen-address: :4245\n gops: true\n gops-port: \"9893\"\n retry-timeout: \n sort-buffer-len-max: \n sort-buffer-drain-timeout: \n tls-hubble-client-cert-file: /var/lib/hubble-relay/tls/client.crt\n tls-hubble-client-key-file: /var/lib/hubble-relay/tls/client.key\n tls-hubble-server-ca-files: /var/lib/hubble-relay/tls/hubble-server-ca.crt\n \n disable-server-tls: true\n\n---\n# Source: cilium/templates/hubble-ui/configmap.yaml\napiVersion: v1\nkind: ConfigMap\nmetadata:\n name: hubble-ui-nginx\n namespace: kube-system\ndata:\n nginx.conf: \"server {\\n listen 8081;\\n listen [::]:8081;\\n server_name localhost;\\n root /app;\\n index index.html;\\n client_max_body_size 1G;\\n\\n location / {\\n proxy_set_header Host $host;\\n proxy_set_header X-Real-IP $remote_addr;\\n\\n location /api {\\n proxy_http_version 1.1;\\n proxy_pass_request_headers on;\\n proxy_pass http://127.0.0.1:8090;\\n }\\n location / {\\n # double `/index.html` is required here \\n try_files $uri $uri/ /index.html /index.html;\\n }\\n\\n # Liveness probe\\n location /healthz {\\n access_log off;\\n add_header Content-Type text/plain;\\n return 200 'ok';\\n }\\n }\\n}\"\n\n---\n# Source: cilium/templates/cilium-agent/clusterrole.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRole\nmetadata:\n name: cilium\n labels:\n app.kubernetes.io/part-of: cilium\nrules:\n- apiGroups:\n - networking.k8s.io\n resources:\n - networkpolicies\n verbs:\n - get\n - list\n - watch\n- apiGroups:\n - discovery.k8s.io\n resources:\n - endpointslices\n verbs:\n - get\n - list\n - watch\n- apiGroups:\n - \"\"\n resources:\n - namespaces\n - services\n - pods\n - endpoints\n - nodes\n verbs:\n - get\n - list\n - watch\n- apiGroups:\n - apiextensions.k8s.io\n resources:\n - customresourcedefinitions\n verbs:\n - list\n - watch\n # This is used when validating policies in preflight. This will need to stay\n # until we figure out how to avoid \"get\" inside the preflight, and then\n # should be removed ideally.\n - get\n- apiGroups:\n - cilium.io\n resources:\n - ciliumloadbalancerippools\n - ciliumbgppeeringpolicies\n - ciliumbgpnodeconfigs\n - ciliumbgpadvertisements\n - ciliumbgppeerconfigs\n - ciliumclusterwideenvoyconfigs\n - ciliumclusterwidenetworkpolicies\n - ciliumegressgatewaypolicies\n - ciliumendpoints\n - ciliumendpointslices\n - ciliumenvoyconfigs\n - ciliumidentities\n - ciliumlocalredirectpolicies\n - ciliumnetworkpolicies\n - ciliumnodes\n - ciliumnodeconfigs\n - ciliumcidrgroups\n - ciliuml2announcementpolicies\n - ciliumpodippools\n verbs:\n - list\n - watch\n- apiGroups:\n - cilium.io\n resources:\n - ciliumidentities\n - ciliumendpoints\n - ciliumnodes\n verbs:\n - create\n- apiGroups:\n - cilium.io\n # To synchronize garbage collection of such resources\n resources:\n - ciliumidentities\n verbs:\n - update\n- apiGroups:\n - cilium.io\n resources:\n - ciliumendpoints\n verbs:\n - delete\n - get\n- apiGroups:\n - cilium.io\n resources:\n - ciliumnodes\n - ciliumnodes/status\n verbs:\n - get\n - update\n- apiGroups:\n - cilium.io\n resources:\n - ciliumendpoints/status\n - ciliumendpoints\n - ciliuml2announcementpolicies/status\n - ciliumbgpnodeconfigs/status\n verbs:\n - patch\n\n---\n# Source: cilium/templates/cilium-operator/clusterrole.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRole\nmetadata:\n name: cilium-operator\n labels:\n app.kubernetes.io/part-of: cilium\nrules:\n- apiGroups:\n - \"\"\n resources:\n - pods\n verbs:\n - get\n - list\n - watch\n # to automatically delete [core|kube]dns pods so that are starting to being\n # managed by Cilium\n - delete\n- apiGroups:\n - \"\"\n resources:\n - configmaps\n resourceNames:\n - cilium-config\n verbs:\n # allow patching of the configmap to set annotations\n - patch\n- apiGroups:\n - \"\"\n resources:\n - nodes\n verbs:\n - list\n - watch\n- apiGroups:\n - \"\"\n resources:\n # To remove node taints\n - nodes\n # To set NetworkUnavailable false on startup\n - nodes/status\n verbs:\n - patch\n- apiGroups:\n - discovery.k8s.io\n resources:\n - endpointslices\n verbs:\n - get\n - list\n - watch\n- apiGroups:\n - \"\"\n resources:\n # to perform LB IP allocation for BGP\n - services/status\n verbs:\n - update\n - patch\n- apiGroups:\n - \"\"\n resources:\n # to check apiserver connectivity\n - namespaces\n - secrets\n verbs:\n - get\n - list\n - watch\n- apiGroups:\n - \"\"\n resources:\n # to perform the translation of a CNP that contains `ToGroup` to its endpoints\n - services\n - endpoints\n verbs:\n - get\n - list\n - watch\n- apiGroups:\n - cilium.io\n resources:\n - ciliumnetworkpolicies\n - ciliumclusterwidenetworkpolicies\n verbs:\n # Create auto-generated CNPs and CCNPs from Policies that have 'toGroups'\n - create\n - update\n - deletecollection\n # To update the status of the CNPs and CCNPs\n - patch\n - get\n - list\n - watch\n- apiGroups:\n - cilium.io\n resources:\n - ciliumnetworkpolicies/status\n - ciliumclusterwidenetworkpolicies/status\n verbs:\n # Update the auto-generated CNPs and CCNPs status.\n - patch\n - update\n- apiGroups:\n - cilium.io\n resources:\n - ciliumendpoints\n - ciliumidentities\n verbs:\n # To perform garbage collection of such resources\n - delete\n - list\n - watch\n- apiGroups:\n - cilium.io\n resources:\n - ciliumidentities\n verbs:\n # To synchronize garbage collection of such resources\n - update\n- apiGroups:\n - cilium.io\n resources:\n - ciliumnodes\n verbs:\n - create\n - update\n - get\n - list\n - watch\n # To perform CiliumNode garbage collector\n - delete\n- apiGroups:\n - cilium.io\n resources:\n - ciliumnodes/status\n verbs:\n - update\n- apiGroups:\n - cilium.io\n resources:\n - ciliumendpointslices\n - ciliumenvoyconfigs\n - ciliumbgppeerconfigs\n - ciliumbgpadvertisements\n - ciliumbgpnodeconfigs\n verbs:\n - create\n - update\n - get\n - list\n - watch\n - delete\n - patch\n- apiGroups:\n - cilium.io\n resources:\n - ciliumbgpclusterconfigs/status\n - ciliumbgppeerconfigs/status\n verbs:\n - update\n- apiGroups:\n - apiextensions.k8s.io\n resources:\n - customresourcedefinitions\n verbs:\n - create\n - get\n - list\n - watch\n- apiGroups:\n - apiextensions.k8s.io\n resources:\n - customresourcedefinitions\n verbs:\n - update\n resourceNames:\n - ciliumloadbalancerippools.cilium.io\n - ciliumbgppeeringpolicies.cilium.io\n - ciliumbgpclusterconfigs.cilium.io\n - ciliumbgppeerconfigs.cilium.io\n - ciliumbgpadvertisements.cilium.io\n - ciliumbgpnodeconfigs.cilium.io\n - ciliumbgpnodeconfigoverrides.cilium.io\n - ciliumclusterwideenvoyconfigs.cilium.io\n - ciliumclusterwidenetworkpolicies.cilium.io\n - ciliumegressgatewaypolicies.cilium.io\n - ciliumendpoints.cilium.io\n - ciliumendpointslices.cilium.io\n - ciliumenvoyconfigs.cilium.io\n - ciliumexternalworkloads.cilium.io\n - ciliumidentities.cilium.io\n - ciliumlocalredirectpolicies.cilium.io\n - ciliumnetworkpolicies.cilium.io\n - ciliumnodes.cilium.io\n - ciliumnodeconfigs.cilium.io\n - ciliumcidrgroups.cilium.io\n - ciliuml2announcementpolicies.cilium.io\n - ciliumpodippools.cilium.io\n- apiGroups:\n - cilium.io\n resources:\n - ciliumloadbalancerippools\n - ciliumpodippools\n - ciliumbgppeeringpolicies\n - ciliumbgpclusterconfigs\n - ciliumbgpnodeconfigoverrides\n - ciliumbgppeerconfigs\n verbs:\n - get\n - list\n - watch\n- apiGroups:\n - cilium.io\n resources:\n - ciliumpodippools\n verbs:\n - create\n- apiGroups:\n - cilium.io\n resources:\n - ciliumloadbalancerippools/status\n verbs:\n - patch\n# For cilium-operator running in HA mode.\n#\n# Cilium operator running in HA mode requires the use of ResourceLock for Leader Election\n# between multiple running instances.\n# The preferred way of doing this is to use LeasesResourceLock as edits to Leases are less\n# common and fewer objects in the cluster watch \"all Leases\".\n- apiGroups:\n - coordination.k8s.io\n resources:\n - leases\n verbs:\n - create\n - get\n - update\n\n---\n# Source: cilium/templates/hubble-ui/clusterrole.yaml\nkind: ClusterRole\napiVersion: rbac.authorization.k8s.io/v1\nmetadata:\n name: hubble-ui\n labels:\n app.kubernetes.io/part-of: cilium\n\nrules:\n- apiGroups:\n - networking.k8s.io\n resources:\n - networkpolicies\n verbs:\n - get\n - list\n - watch\n- apiGroups:\n - \"\"\n resources:\n - componentstatuses\n - endpoints\n - namespaces\n - nodes\n - pods\n - services\n verbs:\n - get\n - list\n - watch\n- apiGroups:\n - apiextensions.k8s.io\n resources:\n - customresourcedefinitions\n verbs:\n - get\n - list\n - watch\n- apiGroups:\n - cilium.io\n resources:\n - \"*\"\n verbs:\n - get\n - list\n - watch\n\n---\n# Source: cilium/templates/cilium-agent/clusterrolebinding.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRoleBinding\nmetadata:\n name: cilium\n labels:\n app.kubernetes.io/part-of: cilium\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: ClusterRole\n name: cilium\nsubjects:\n- kind: ServiceAccount\n name: \"cilium\"\n namespace: kube-system\n\n---\n# Source: cilium/templates/cilium-operator/clusterrolebinding.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRoleBinding\nmetadata:\n name: cilium-operator\n labels:\n app.kubernetes.io/part-of: cilium\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: ClusterRole\n name: cilium-operator\nsubjects:\n- kind: ServiceAccount\n name: \"cilium-operator\"\n namespace: kube-system\n\n---\n# Source: cilium/templates/hubble-ui/clusterrolebinding.yaml\nkind: ClusterRoleBinding\napiVersion: rbac.authorization.k8s.io/v1\nmetadata:\n name: hubble-ui\n labels:\n app.kubernetes.io/part-of: cilium\n\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: ClusterRole\n name: hubble-ui\nsubjects:\n- kind: ServiceAccount\n name: \"hubble-ui\"\n namespace: kube-system\n\n---\n# Source: cilium/templates/cilium-agent/role.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: Role\nmetadata:\n name: cilium-config-agent\n namespace: kube-system\n labels:\n app.kubernetes.io/part-of: cilium\nrules:\n- apiGroups:\n - \"\"\n resources:\n - configmaps\n verbs:\n - get\n - list\n - watch\n---\n# Source: cilium/templates/cilium-agent/role.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: Role\nmetadata:\n name: cilium-tlsinterception-secrets\n namespace: \"cilium-secrets\" \n labels:\n app.kubernetes.io/part-of: cilium\nrules:\n- apiGroups:\n - \"\"\n resources:\n - secrets\n verbs:\n - get\n - list\n - watch\n\n---\n# Source: cilium/templates/cilium-operator/role.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: Role\nmetadata:\n name: cilium-operator-tlsinterception-secrets\n namespace: \"cilium-secrets\"\n labels:\n app.kubernetes.io/part-of: cilium\nrules:\n- apiGroups:\n - \"\"\n resources:\n - secrets\n verbs:\n - create\n - delete\n - update\n - patch\n\n---\n# Source: cilium/templates/cilium-agent/rolebinding.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: RoleBinding\nmetadata:\n name: cilium-config-agent\n namespace: kube-system\n labels:\n app.kubernetes.io/part-of: cilium\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: Role\n name: cilium-config-agent\nsubjects:\n - kind: ServiceAccount\n name: \"cilium\"\n namespace: kube-system\n---\n# Source: cilium/templates/cilium-agent/rolebinding.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: RoleBinding\nmetadata:\n name: cilium-tlsinterception-secrets\n namespace: \"cilium-secrets\"\n labels:\n app.kubernetes.io/part-of: cilium\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: Role\n name: cilium-tlsinterception-secrets\nsubjects:\n- kind: ServiceAccount\n name: \"cilium\"\n namespace: kube-system\n\n---\n# Source: cilium/templates/cilium-operator/rolebinding.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: RoleBinding\nmetadata:\n name: cilium-operator-tlsinterception-secrets\n namespace: \"cilium-secrets\"\n labels:\n app.kubernetes.io/part-of: cilium\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: Role\n name: cilium-operator-tlsinterception-secrets\nsubjects:\n- kind: ServiceAccount\n name: \"cilium-operator\"\n namespace: kube-system\n\n---\n# Source: cilium/templates/cilium-envoy/service.yaml\napiVersion: v1\nkind: Service\nmetadata:\n name: cilium-envoy\n namespace: kube-system\n annotations:\n prometheus.io/scrape: \"true\"\n prometheus.io/port: \"9964\"\n labels:\n k8s-app: cilium-envoy\n app.kubernetes.io/name: cilium-envoy\n app.kubernetes.io/part-of: cilium\n io.cilium/app: proxy\nspec:\n clusterIP: None\n type: ClusterIP\n selector:\n k8s-app: cilium-envoy\n ports:\n - name: envoy-metrics\n port: 9964\n protocol: TCP\n targetPort: envoy-metrics\n\n---\n# Source: cilium/templates/hubble-relay/service.yaml\nkind: Service\napiVersion: v1\nmetadata:\n name: hubble-relay\n namespace: kube-system\n annotations:\n labels:\n k8s-app: hubble-relay\n app.kubernetes.io/name: hubble-relay\n app.kubernetes.io/part-of: cilium\n\nspec:\n type: \"ClusterIP\"\n selector:\n k8s-app: hubble-relay\n ports:\n - protocol: TCP\n port: 80\n targetPort: grpc\n\n---\n# Source: cilium/templates/hubble-ui/service.yaml\nkind: Service\napiVersion: v1\nmetadata:\n name: hubble-ui\n namespace: kube-system\n labels:\n k8s-app: hubble-ui\n app.kubernetes.io/name: hubble-ui\n app.kubernetes.io/part-of: cilium\n\nspec:\n type: \"ClusterIP\"\n selector:\n k8s-app: hubble-ui\n ports:\n - name: http\n port: 80\n targetPort: 8081\n\n---\n# Source: cilium/templates/hubble/peer-service.yaml\napiVersion: v1\nkind: Service\nmetadata:\n name: hubble-peer\n namespace: kube-system\n labels:\n k8s-app: cilium\n app.kubernetes.io/part-of: cilium\n app.kubernetes.io/name: hubble-peer\n\nspec:\n selector:\n k8s-app: cilium\n ports:\n - name: peer-service\n port: 443\n protocol: TCP\n targetPort: 4244\n internalTrafficPolicy: Local\n\n---\n# Source: cilium/templates/cilium-agent/daemonset.yaml\napiVersion: apps/v1\nkind: DaemonSet\nmetadata:\n name: cilium\n namespace: kube-system\n labels:\n k8s-app: cilium\n app.kubernetes.io/part-of: cilium\n app.kubernetes.io/name: cilium-agent\nspec:\n selector:\n matchLabels:\n k8s-app: cilium\n updateStrategy:\n rollingUpdate:\n maxUnavailable: 2\n type: RollingUpdate\n template:\n metadata:\n annotations:\n labels:\n k8s-app: cilium\n app.kubernetes.io/name: cilium-agent\n app.kubernetes.io/part-of: cilium\n spec:\n securityContext:\n appArmorProfile:\n type: Unconfined\n containers:\n - name: cilium-agent\n image: \"quay.io/cilium/cilium:v1.17.2@sha256:3c4c9932b5d8368619cb922a497ff2ebc8def5f41c18e410bcc84025fcd385b1\"\n imagePullPolicy: IfNotPresent\n command:\n - cilium-agent\n args:\n - --config-dir=/tmp/cilium/config-map\n startupProbe:\n httpGet:\n host: \"127.0.0.1\"\n path: /healthz\n port: 9879\n scheme: HTTP\n httpHeaders:\n - name: \"brief\"\n value: \"true\"\n failureThreshold: 105\n periodSeconds: 2\n successThreshold: 1\n initialDelaySeconds: 5\n livenessProbe:\n httpGet:\n host: \"127.0.0.1\"\n path: /healthz\n port: 9879\n scheme: HTTP\n httpHeaders:\n - name: \"brief\"\n value: \"true\"\n periodSeconds: 30\n successThreshold: 1\n failureThreshold: 10\n timeoutSeconds: 5\n readinessProbe:\n httpGet:\n host: \"127.0.0.1\"\n path: /healthz\n port: 9879\n scheme: HTTP\n httpHeaders:\n - name: \"brief\"\n value: \"true\"\n periodSeconds: 30\n successThreshold: 1\n failureThreshold: 3\n timeoutSeconds: 5\n env:\n - name: K8S_NODE_NAME\n valueFrom:\n fieldRef:\n apiVersion: v1\n fieldPath: spec.nodeName\n - name: CILIUM_K8S_NAMESPACE\n valueFrom:\n fieldRef:\n apiVersion: v1\n fieldPath: metadata.namespace\n - name: CILIUM_CLUSTERMESH_CONFIG\n value: /var/lib/cilium/clustermesh/\n - name: GOMEMLIMIT\n valueFrom:\n resourceFieldRef:\n resource: limits.memory\n divisor: '1'\n - name: KUBERNETES_SERVICE_HOST\n value: \"localhost\"\n - name: KUBERNETES_SERVICE_PORT\n value: \"7445\"\n lifecycle:\n postStart:\n exec:\n command:\n - \"bash\"\n - \"-c\"\n - |\n set -o errexit\n set -o pipefail\n set -o nounset\n \n # When running in AWS ENI mode, it's likely that 'aws-node' has\n # had a chance to install SNAT iptables rules. These can result\n # in dropped traffic, so we should attempt to remove them.\n # We do it using a 'postStart' hook since this may need to run\n # for nodes which might have already been init'ed but may still\n # have dangling rules. This is safe because there are no\n # dependencies on anything that is part of the startup script\n # itself, and can be safely run multiple times per node (e.g. in\n # case of a restart).\n if [[ \"$(iptables-save | grep -E -c 'AWS-SNAT-CHAIN|AWS-CONNMARK-CHAIN')\" != \"0\" ]];\n then\n echo 'Deleting iptables rules created by the AWS CNI VPC plugin'\n iptables-save | grep -E -v 'AWS-SNAT-CHAIN|AWS-CONNMARK-CHAIN' | iptables-restore\n fi\n echo 'Done!'\n \n preStop:\n exec:\n command:\n - /cni-uninstall.sh\n securityContext:\n seLinuxOptions:\n level: s0\n type: spc_t\n capabilities:\n add:\n - CHOWN\n - KILL\n - NET_ADMIN\n - NET_RAW\n - IPC_LOCK\n - SYS_MODULE\n - SYS_ADMIN\n - SYS_RESOURCE\n - DAC_OVERRIDE\n - FOWNER\n - SETGID\n - SETUID\n drop:\n - ALL\n terminationMessagePolicy: FallbackToLogsOnError\n volumeMounts:\n - name: envoy-sockets\n mountPath: /var/run/cilium/envoy/sockets\n readOnly: false\n # Unprivileged containers need to mount /proc/sys/net from the host\n # to have write access\n - mountPath: /host/proc/sys/net\n name: host-proc-sys-net\n # Unprivileged containers need to mount /proc/sys/kernel from the host\n # to have write access\n - mountPath: /host/proc/sys/kernel\n name: host-proc-sys-kernel\n - name: bpf-maps\n mountPath: /sys/fs/bpf\n # Unprivileged containers can't set mount propagation to bidirectional\n # in this case we will mount the bpf fs from an init container that\n # is privileged and set the mount propagation from host to container\n # in Cilium.\n mountPropagation: HostToContainer\n - name: cilium-run\n mountPath: /var/run/cilium\n - name: cilium-netns\n mountPath: /var/run/cilium/netns\n mountPropagation: HostToContainer\n - name: etc-cni-netd\n mountPath: /host/etc/cni/net.d\n - name: clustermesh-secrets\n mountPath: /var/lib/cilium/clustermesh\n readOnly: true\n # Needed to be able to load kernel modules\n - name: lib-modules\n mountPath: /lib/modules\n readOnly: true\n - name: xtables-lock\n mountPath: /run/xtables.lock\n - name: hubble-tls\n mountPath: /var/lib/cilium/tls/hubble\n readOnly: true\n - name: tmp\n mountPath: /tmp\n initContainers:\n - name: config\n image: \"quay.io/cilium/cilium:v1.17.2@sha256:3c4c9932b5d8368619cb922a497ff2ebc8def5f41c18e410bcc84025fcd385b1\"\n imagePullPolicy: IfNotPresent\n command:\n - cilium-dbg\n - build-config\n env:\n - name: K8S_NODE_NAME\n valueFrom:\n fieldRef:\n apiVersion: v1\n fieldPath: spec.nodeName\n - name: CILIUM_K8S_NAMESPACE\n valueFrom:\n fieldRef:\n apiVersion: v1\n fieldPath: metadata.namespace\n - name: KUBERNETES_SERVICE_HOST\n value: \"localhost\"\n - name: KUBERNETES_SERVICE_PORT\n value: \"7445\"\n volumeMounts:\n - name: tmp\n mountPath: /tmp\n terminationMessagePolicy: FallbackToLogsOnError\n # Required to mount cgroup2 filesystem on the underlying Kubernetes node.\n # We use nsenter command with host's cgroup and mount namespaces enabled.\n - name: mount-cgroup\n image: \"quay.io/cilium/cilium:v1.17.2@sha256:3c4c9932b5d8368619cb922a497ff2ebc8def5f41c18e410bcc84025fcd385b1\"\n imagePullPolicy: IfNotPresent\n env:\n - name: CGROUP_ROOT\n value: /run/cilium/cgroupv2\n - name: BIN_PATH\n value: /opt/cni/bin\n command:\n - sh\n - -ec\n # The statically linked Go program binary is invoked to avoid any\n # dependency on utilities like sh and mount that can be missing on certain\n # distros installed on the underlying host. Copy the binary to the\n # same directory where we install cilium cni plugin so that exec permissions\n # are available.\n - |\n cp /usr/bin/cilium-mount /hostbin/cilium-mount;\n nsenter --cgroup=/hostproc/1/ns/cgroup --mount=/hostproc/1/ns/mnt \"${BIN_PATH}/cilium-mount\" $CGROUP_ROOT;\n rm /hostbin/cilium-mount\n volumeMounts:\n - name: hostproc\n mountPath: /hostproc\n - name: cni-path\n mountPath: /hostbin\n terminationMessagePolicy: FallbackToLogsOnError\n securityContext:\n seLinuxOptions:\n level: s0\n type: spc_t\n capabilities:\n add:\n - SYS_ADMIN\n - SYS_CHROOT\n - SYS_PTRACE\n drop:\n - ALL\n - name: apply-sysctl-overwrites\n image: \"quay.io/cilium/cilium:v1.17.2@sha256:3c4c9932b5d8368619cb922a497ff2ebc8def5f41c18e410bcc84025fcd385b1\"\n imagePullPolicy: IfNotPresent\n env:\n - name: BIN_PATH\n value: /opt/cni/bin\n command:\n - sh\n - -ec\n # The statically linked Go program binary is invoked to avoid any\n # dependency on utilities like sh that can be missing on certain\n # distros installed on the underlying host. Copy the binary to the\n # same directory where we install cilium cni plugin so that exec permissions\n # are available.\n - |\n cp /usr/bin/cilium-sysctlfix /hostbin/cilium-sysctlfix;\n nsenter --mount=/hostproc/1/ns/mnt \"${BIN_PATH}/cilium-sysctlfix\";\n rm /hostbin/cilium-sysctlfix\n volumeMounts:\n - name: hostproc\n mountPath: /hostproc\n - name: cni-path\n mountPath: /hostbin\n terminationMessagePolicy: FallbackToLogsOnError\n securityContext:\n seLinuxOptions:\n level: s0\n type: spc_t\n capabilities:\n add:\n - SYS_ADMIN\n - SYS_CHROOT\n - SYS_PTRACE\n drop:\n - ALL\n # Mount the bpf fs if it is not mounted. We will perform this task\n # from a privileged container because the mount propagation bidirectional\n # only works from privileged containers.\n - name: mount-bpf-fs\n image: \"quay.io/cilium/cilium:v1.17.2@sha256:3c4c9932b5d8368619cb922a497ff2ebc8def5f41c18e410bcc84025fcd385b1\"\n imagePullPolicy: IfNotPresent\n args:\n - 'mount | grep \"/sys/fs/bpf type bpf\" || mount -t bpf bpf /sys/fs/bpf'\n command:\n - /bin/bash\n - -c\n - --\n terminationMessagePolicy: FallbackToLogsOnError\n securityContext:\n privileged: true\n volumeMounts:\n - name: bpf-maps\n mountPath: /sys/fs/bpf\n mountPropagation: Bidirectional\n - name: clean-cilium-state\n image: \"quay.io/cilium/cilium:v1.17.2@sha256:3c4c9932b5d8368619cb922a497ff2ebc8def5f41c18e410bcc84025fcd385b1\"\n imagePullPolicy: IfNotPresent\n command:\n - /init-container.sh\n env:\n - name: CILIUM_ALL_STATE\n valueFrom:\n configMapKeyRef:\n name: cilium-config\n key: clean-cilium-state\n optional: true\n - name: CILIUM_BPF_STATE\n valueFrom:\n configMapKeyRef:\n name: cilium-config\n key: clean-cilium-bpf-state\n optional: true\n - name: WRITE_CNI_CONF_WHEN_READY\n valueFrom:\n configMapKeyRef:\n name: cilium-config\n key: write-cni-conf-when-ready\n optional: true\n - name: KUBERNETES_SERVICE_HOST\n value: \"localhost\"\n - name: KUBERNETES_SERVICE_PORT\n value: \"7445\"\n terminationMessagePolicy: FallbackToLogsOnError\n securityContext:\n seLinuxOptions:\n level: s0\n type: spc_t\n capabilities:\n add:\n - NET_ADMIN\n - SYS_MODULE\n - SYS_ADMIN\n - SYS_RESOURCE\n drop:\n - ALL\n volumeMounts:\n - name: bpf-maps\n mountPath: /sys/fs/bpf\n # Required to mount cgroup filesystem from the host to cilium agent pod\n - name: cilium-cgroup\n mountPath: /run/cilium/cgroupv2\n mountPropagation: HostToContainer\n - name: cilium-run\n mountPath: /var/run/cilium # wait-for-kube-proxy\n # Install the CNI binaries in an InitContainer so we don't have a writable host mount in the agent\n - name: install-cni-binaries\n image: \"quay.io/cilium/cilium:v1.17.2@sha256:3c4c9932b5d8368619cb922a497ff2ebc8def5f41c18e410bcc84025fcd385b1\"\n imagePullPolicy: IfNotPresent\n command:\n - \"/install-plugin.sh\"\n resources:\n requests:\n cpu: 100m\n memory: 10Mi\n securityContext:\n seLinuxOptions:\n level: s0\n type: spc_t\n capabilities:\n drop:\n - ALL\n terminationMessagePolicy: FallbackToLogsOnError\n volumeMounts:\n - name: cni-path\n mountPath: /host/opt/cni/bin # .Values.cni.install\n restartPolicy: Always\n priorityClassName: system-node-critical\n serviceAccountName: \"cilium\"\n automountServiceAccountToken: true\n terminationGracePeriodSeconds: 1\n hostNetwork: true\n affinity:\n podAntiAffinity:\n requiredDuringSchedulingIgnoredDuringExecution:\n - labelSelector:\n matchLabels:\n k8s-app: cilium\n topologyKey: kubernetes.io/hostname\n nodeSelector:\n kubernetes.io/os: linux\n tolerations:\n - operator: Exists\n volumes:\n # For sharing configuration between the \"config\" initContainer and the agent\n - name: tmp\n emptyDir: {}\n # To keep state between restarts / upgrades\n - name: cilium-run\n hostPath:\n path: /var/run/cilium\n type: DirectoryOrCreate\n # To exec into pod network namespaces\n - name: cilium-netns\n hostPath:\n path: /var/run/netns\n type: DirectoryOrCreate\n # To keep state between restarts / upgrades for bpf maps\n - name: bpf-maps\n hostPath:\n path: /sys/fs/bpf\n type: DirectoryOrCreate\n # To mount cgroup2 filesystem on the host or apply sysctlfix\n - name: hostproc\n hostPath:\n path: /proc\n type: Directory\n # To keep state between restarts / upgrades for cgroup2 filesystem\n - name: cilium-cgroup\n hostPath:\n path: /run/cilium/cgroupv2\n type: DirectoryOrCreate\n # To install cilium cni plugin in the host\n - name: cni-path\n hostPath:\n path: /opt/cni/bin\n type: DirectoryOrCreate\n # To install cilium cni configuration in the host\n - name: etc-cni-netd\n hostPath:\n path: /etc/cni/net.d\n type: DirectoryOrCreate\n # To be able to load kernel modules\n - name: lib-modules\n hostPath:\n path: /lib/modules\n # To access iptables concurrently with other processes (e.g. kube-proxy)\n - name: xtables-lock\n hostPath:\n path: /run/xtables.lock\n type: FileOrCreate\n # Sharing socket with Cilium Envoy on the same node by using a host path\n - name: envoy-sockets\n hostPath:\n path: \"/var/run/cilium/envoy/sockets\"\n type: DirectoryOrCreate\n # To read the clustermesh configuration\n - name: clustermesh-secrets\n projected:\n # note: the leading zero means this number is in octal representation: do not remove it\n defaultMode: 0400\n sources:\n - secret:\n name: cilium-clustermesh\n optional: true\n # note: items are not explicitly listed here, since the entries of this secret\n # depend on the peers configured, and that would cause a restart of all agents\n # at every addition/removal. Leaving the field empty makes each secret entry\n # to be automatically projected into the volume as a file whose name is the key.\n - secret:\n name: clustermesh-apiserver-remote-cert\n optional: true\n items:\n - key: tls.key\n path: common-etcd-client.key\n - key: tls.crt\n path: common-etcd-client.crt\n - key: ca.crt\n path: common-etcd-client-ca.crt\n # note: we configure the volume for the kvstoremesh-specific certificate\n # regardless of whether KVStoreMesh is enabled or not, so that it can be\n # automatically mounted in case KVStoreMesh gets subsequently enabled,\n # without requiring an agent restart.\n - secret:\n name: clustermesh-apiserver-local-cert\n optional: true\n items:\n - key: tls.key\n path: local-etcd-client.key\n - key: tls.crt\n path: local-etcd-client.crt\n - key: ca.crt\n path: local-etcd-client-ca.crt\n - name: host-proc-sys-net\n hostPath:\n path: /proc/sys/net\n type: Directory\n - name: host-proc-sys-kernel\n hostPath:\n path: /proc/sys/kernel\n type: Directory\n - name: hubble-tls\n projected:\n # note: the leading zero means this number is in octal representation: do not remove it\n defaultMode: 0400\n sources:\n - secret:\n name: hubble-server-certs\n optional: true\n items:\n - key: tls.crt\n path: server.crt\n - key: tls.key\n path: server.key\n - key: ca.crt\n path: client-ca.crt\n\n---\n# Source: cilium/templates/cilium-envoy/daemonset.yaml\napiVersion: apps/v1\nkind: DaemonSet\nmetadata:\n name: cilium-envoy\n namespace: kube-system\n labels:\n k8s-app: cilium-envoy\n app.kubernetes.io/part-of: cilium\n app.kubernetes.io/name: cilium-envoy\n name: cilium-envoy\nspec:\n selector:\n matchLabels:\n k8s-app: cilium-envoy\n updateStrategy:\n rollingUpdate:\n maxUnavailable: 2\n type: RollingUpdate\n template:\n metadata:\n annotations:\n labels:\n k8s-app: cilium-envoy\n name: cilium-envoy\n app.kubernetes.io/name: cilium-envoy\n app.kubernetes.io/part-of: cilium\n spec:\n securityContext:\n appArmorProfile:\n type: Unconfined\n containers:\n - name: cilium-envoy\n image: \"quay.io/cilium/cilium-envoy:v1.31.5-1741765102-efed3defcc70ab5b263a0fc44c93d316b846a211@sha256:377c78c13d2731f3720f931721ee309159e782d882251709cb0fac3b42c03f4b\"\n imagePullPolicy: IfNotPresent\n command:\n - /usr/bin/cilium-envoy-starter\n args:\n - '--'\n - '-c /var/run/cilium/envoy/bootstrap-config.json'\n - '--base-id 0'\n - '--log-level info'\n startupProbe:\n httpGet:\n host: \"127.0.0.1\"\n path: /healthz\n port: 9878\n scheme: HTTP\n failureThreshold: 105\n periodSeconds: 2\n successThreshold: 1\n initialDelaySeconds: 5\n livenessProbe:\n httpGet:\n host: \"127.0.0.1\"\n path: /healthz\n port: 9878\n scheme: HTTP\n periodSeconds: 30\n successThreshold: 1\n failureThreshold: 10\n timeoutSeconds: 5\n readinessProbe:\n httpGet:\n host: \"127.0.0.1\"\n path: /healthz\n port: 9878\n scheme: HTTP\n periodSeconds: 30\n successThreshold: 1\n failureThreshold: 3\n timeoutSeconds: 5\n env:\n - name: K8S_NODE_NAME\n valueFrom:\n fieldRef:\n apiVersion: v1\n fieldPath: spec.nodeName\n - name: CILIUM_K8S_NAMESPACE\n valueFrom:\n fieldRef:\n apiVersion: v1\n fieldPath: metadata.namespace\n - name: KUBERNETES_SERVICE_HOST\n value: \"localhost\"\n - name: KUBERNETES_SERVICE_PORT\n value: \"7445\"\n ports:\n - name: envoy-metrics\n containerPort: 9964\n hostPort: 9964\n protocol: TCP\n securityContext:\n seLinuxOptions:\n level: s0\n type: spc_t\n capabilities:\n add:\n - NET_ADMIN\n - SYS_ADMIN\n drop:\n - ALL\n terminationMessagePolicy: FallbackToLogsOnError\n volumeMounts:\n - name: envoy-sockets\n mountPath: /var/run/cilium/envoy/sockets\n readOnly: false\n - name: envoy-artifacts\n mountPath: /var/run/cilium/envoy/artifacts\n readOnly: true\n - name: envoy-config\n mountPath: /var/run/cilium/envoy/\n readOnly: true\n - name: bpf-maps\n mountPath: /sys/fs/bpf\n mountPropagation: HostToContainer\n restartPolicy: Always\n priorityClassName: system-node-critical\n serviceAccountName: \"cilium-envoy\"\n automountServiceAccountToken: true\n terminationGracePeriodSeconds: 1\n hostNetwork: true\n affinity:\n nodeAffinity:\n requiredDuringSchedulingIgnoredDuringExecution:\n nodeSelectorTerms:\n - matchExpressions:\n - key: cilium.io/no-schedule\n operator: NotIn\n values:\n - \"true\"\n podAffinity:\n requiredDuringSchedulingIgnoredDuringExecution:\n - labelSelector:\n matchLabels:\n k8s-app: cilium\n topologyKey: kubernetes.io/hostname\n podAntiAffinity:\n requiredDuringSchedulingIgnoredDuringExecution:\n - labelSelector:\n matchLabels:\n k8s-app: cilium-envoy\n topologyKey: kubernetes.io/hostname\n nodeSelector:\n kubernetes.io/os: linux\n tolerations:\n - operator: Exists\n volumes:\n - name: envoy-sockets\n hostPath:\n path: \"/var/run/cilium/envoy/sockets\"\n type: DirectoryOrCreate\n - name: envoy-artifacts\n hostPath:\n path: \"/var/run/cilium/envoy/artifacts\"\n type: DirectoryOrCreate\n - name: envoy-config\n configMap:\n name: \"cilium-envoy-config\"\n # note: the leading zero means this number is in octal representation: do not remove it\n defaultMode: 0400\n items:\n - key: bootstrap-config.json\n path: bootstrap-config.json\n # To keep state between restarts / upgrades\n # To keep state between restarts / upgrades for bpf maps\n - name: bpf-maps\n hostPath:\n path: /sys/fs/bpf\n type: DirectoryOrCreate\n\n---\n# Source: cilium/templates/cilium-operator/deployment.yaml\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: cilium-operator\n namespace: kube-system\n labels:\n io.cilium/app: operator\n name: cilium-operator\n app.kubernetes.io/part-of: cilium\n app.kubernetes.io/name: cilium-operator\nspec:\n # See docs on ServerCapabilities.LeasesResourceLock in file pkg/k8s/version/version.go\n # for more details.\n replicas: 2\n selector:\n matchLabels:\n io.cilium/app: operator\n name: cilium-operator\n # ensure operator update on single node k8s clusters, by using rolling update with maxUnavailable=100% in case\n # of one replica and no user configured Recreate strategy.\n # otherwise an update might get stuck due to the default maxUnavailable=50% in combination with the\n # podAntiAffinity which prevents deployments of multiple operator replicas on the same node.\n strategy:\n rollingUpdate:\n maxSurge: 25%\n maxUnavailable: 50%\n type: RollingUpdate\n template:\n metadata:\n annotations:\n prometheus.io/port: \"9963\"\n prometheus.io/scrape: \"true\"\n labels:\n io.cilium/app: operator\n name: cilium-operator\n app.kubernetes.io/part-of: cilium\n app.kubernetes.io/name: cilium-operator\n spec:\n containers:\n - name: cilium-operator\n image: \"quay.io/cilium/operator-generic:v1.17.2@sha256:81f2d7198366e8dec2903a3a8361e4c68d47d19c68a0d42f0b7b6e3f0523f249\"\n imagePullPolicy: IfNotPresent\n command:\n - cilium-operator-generic\n args:\n - --config-dir=/tmp/cilium/config-map\n - --debug=$(CILIUM_DEBUG)\n env:\n - name: K8S_NODE_NAME\n valueFrom:\n fieldRef:\n apiVersion: v1\n fieldPath: spec.nodeName\n - name: CILIUM_K8S_NAMESPACE\n valueFrom:\n fieldRef:\n apiVersion: v1\n fieldPath: metadata.namespace\n - name: CILIUM_DEBUG\n valueFrom:\n configMapKeyRef:\n key: debug\n name: cilium-config\n optional: true\n - name: KUBERNETES_SERVICE_HOST\n value: \"localhost\"\n - name: KUBERNETES_SERVICE_PORT\n value: \"7445\"\n ports:\n - name: prometheus\n containerPort: 9963\n hostPort: 9963\n protocol: TCP\n livenessProbe:\n httpGet:\n host: \"127.0.0.1\"\n path: /healthz\n port: 9234\n scheme: HTTP\n initialDelaySeconds: 60\n periodSeconds: 10\n timeoutSeconds: 3\n readinessProbe:\n httpGet:\n host: \"127.0.0.1\"\n path: /healthz\n port: 9234\n scheme: HTTP\n initialDelaySeconds: 0\n periodSeconds: 5\n timeoutSeconds: 3\n failureThreshold: 5\n volumeMounts:\n - name: cilium-config-path\n mountPath: /tmp/cilium/config-map\n readOnly: true\n terminationMessagePolicy: FallbackToLogsOnError\n hostNetwork: true\n restartPolicy: Always\n priorityClassName: system-cluster-critical\n serviceAccountName: \"cilium-operator\"\n automountServiceAccountToken: true\n # In HA mode, cilium-operator pods must not be scheduled on the same\n # node as they will clash with each other.\n affinity:\n podAntiAffinity:\n requiredDuringSchedulingIgnoredDuringExecution:\n - labelSelector:\n matchLabels:\n io.cilium/app: operator\n topologyKey: kubernetes.io/hostname\n nodeSelector:\n kubernetes.io/os: linux\n tolerations:\n - operator: Exists\n volumes:\n # To read the configuration from the config map\n - name: cilium-config-path\n configMap:\n name: cilium-config\n\n---\n# Source: cilium/templates/hubble-relay/deployment.yaml\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: hubble-relay\n namespace: kube-system\n labels:\n k8s-app: hubble-relay\n app.kubernetes.io/name: hubble-relay\n app.kubernetes.io/part-of: cilium\n\nspec:\n replicas: 1\n selector:\n matchLabels:\n k8s-app: hubble-relay\n strategy:\n rollingUpdate:\n maxUnavailable: 1\n type: RollingUpdate\n template:\n metadata:\n annotations:\n labels:\n k8s-app: hubble-relay\n app.kubernetes.io/name: hubble-relay\n app.kubernetes.io/part-of: cilium\n spec:\n securityContext:\n fsGroup: 65532\n containers:\n - name: hubble-relay\n securityContext:\n capabilities:\n drop:\n - ALL\n runAsGroup: 65532\n runAsNonRoot: true\n runAsUser: 65532\n image: \"quay.io/cilium/hubble-relay:v1.17.2@sha256:42a8db5c256c516cacb5b8937c321b2373ad7a6b0a1e5a5120d5028433d586cc\"\n imagePullPolicy: IfNotPresent\n command:\n - hubble-relay\n args:\n - serve\n ports:\n - name: grpc\n containerPort: 4245\n readinessProbe:\n grpc:\n port: 4222\n timeoutSeconds: 3\n # livenessProbe will kill the pod, we should be very conservative\n # here on failures since killing the pod should be a last resort, and\n # we should provide enough time for relay to retry before killing it.\n livenessProbe:\n grpc:\n port: 4222\n timeoutSeconds: 10\n # Give relay time to establish connections and make a few retries\n # before starting livenessProbes.\n initialDelaySeconds: 10\n # 10 second * 12 failures = 2 minutes of failure.\n # If relay cannot become healthy after 2 minutes, then killing it\n # might resolve whatever issue is occurring.\n #\n # 10 seconds is a reasonable retry period so we can see if it's\n # failing regularly or only sporadically.\n periodSeconds: 10\n failureThreshold: 12\n startupProbe:\n grpc:\n port: 4222\n # Give relay time to get it's certs and establish connections and\n # make a few retries before starting startupProbes.\n initialDelaySeconds: 10\n # 20 * 3 seconds = 1 minute of failure before we consider startup as failed.\n failureThreshold: 20\n # Retry more frequently at startup so that it can be considered started more quickly.\n periodSeconds: 3\n volumeMounts:\n - name: config\n mountPath: /etc/hubble-relay\n readOnly: true\n - name: tls\n mountPath: /var/lib/hubble-relay/tls\n readOnly: true\n terminationMessagePolicy: FallbackToLogsOnError\n \n restartPolicy: Always\n priorityClassName: \n serviceAccountName: \"hubble-relay\"\n automountServiceAccountToken: false\n terminationGracePeriodSeconds: 1\n affinity:\n podAffinity:\n requiredDuringSchedulingIgnoredDuringExecution:\n - labelSelector:\n matchLabels:\n k8s-app: cilium\n topologyKey: kubernetes.io/hostname\n nodeSelector:\n kubernetes.io/os: linux\n volumes:\n - name: config\n configMap:\n name: hubble-relay-config\n items:\n - key: config.yaml\n path: config.yaml\n - name: tls\n projected:\n # note: the leading zero means this number is in octal representation: do not remove it\n defaultMode: 0400\n sources:\n - secret:\n name: hubble-relay-client-certs\n items:\n - key: tls.crt\n path: client.crt\n - key: tls.key\n path: client.key\n - key: ca.crt\n path: hubble-server-ca.crt\n \n\n---\n# Source: cilium/templates/hubble-ui/deployment.yaml\nkind: Deployment\napiVersion: apps/v1\nmetadata:\n name: hubble-ui\n namespace: kube-system\n labels:\n k8s-app: hubble-ui\n app.kubernetes.io/name: hubble-ui\n app.kubernetes.io/part-of: cilium\nspec:\n replicas: 1\n selector:\n matchLabels:\n k8s-app: hubble-ui\n strategy:\n rollingUpdate:\n maxUnavailable: 1\n type: RollingUpdate\n template:\n metadata:\n annotations:\n labels:\n k8s-app: hubble-ui\n app.kubernetes.io/name: hubble-ui\n app.kubernetes.io/part-of: cilium\n spec:\n securityContext:\n fsGroup: 1001\n runAsGroup: 1001\n runAsUser: 1001\n priorityClassName: \n serviceAccountName: \"hubble-ui\"\n automountServiceAccountToken: true\n containers:\n - name: frontend\n image: \"quay.io/cilium/hubble-ui:v0.13.2@sha256:9e37c1296b802830834cc87342a9182ccbb71ffebb711971e849221bd9d59392\"\n imagePullPolicy: IfNotPresent\n ports:\n - name: http\n containerPort: 8081\n livenessProbe:\n httpGet:\n path: /healthz\n port: 8081\n readinessProbe:\n httpGet:\n path: /\n port: 8081\n volumeMounts:\n - name: hubble-ui-nginx-conf\n mountPath: /etc/nginx/conf.d/default.conf\n subPath: nginx.conf\n - name: tmp-dir\n mountPath: /tmp\n terminationMessagePolicy: FallbackToLogsOnError\n - name: backend\n image: \"quay.io/cilium/hubble-ui-backend:v0.13.2@sha256:a034b7e98e6ea796ed26df8f4e71f83fc16465a19d166eff67a03b822c0bfa15\"\n imagePullPolicy: IfNotPresent\n env:\n - name: EVENTS_SERVER_PORT\n value: \"8090\"\n - name: FLOWS_API_ADDR\n value: \"hubble-relay:80\"\n ports:\n - name: grpc\n containerPort: 8090\n volumeMounts:\n terminationMessagePolicy: FallbackToLogsOnError\n nodeSelector:\n kubernetes.io/os: linux\n volumes:\n - configMap:\n defaultMode: 420\n name: hubble-ui-nginx\n name: hubble-ui-nginx-conf\n - emptyDir: {}\n name: tmp-dir\n" - name: argocd contents: | apiVersion: v1 @@ -24226,6 +24226,8 @@ cluster: namespace: argocd --- apiVersion: v1 + data: + application.resourceTrackingMethod: label kind: ConfigMap metadata: labels: @@ -24669,6 +24671,13 @@ cluster: name: webhook - containerPort: 8080 name: metrics + resources: + limits: + cpu: 200m + memory: 256Mi + requests: + cpu: 20m + memory: 64Mi securityContext: allowPrivilegeEscalation: false capabilities: @@ -24777,6 +24786,13 @@ cluster: - containerPort: 5556 - containerPort: 5557 - containerPort: 5558 + resources: + limits: + cpu: 100m + memory: 128Mi + requests: + cpu: 20m + memory: 32Mi securityContext: allowPrivilegeEscalation: false capabilities: @@ -24896,6 +24912,13 @@ cluster: tcpSocket: port: 9001 name: argocd-notifications-controller + resources: + limits: + cpu: 100m + memory: 128Mi + requests: + cpu: 20m + memory: 32Mi securityContext: allowPrivilegeEscalation: false capabilities: @@ -24982,6 +25005,13 @@ cluster: name: redis ports: - containerPort: 6379 + resources: + limits: + cpu: 200m + memory: 128Mi + requests: + cpu: 50m + memory: 32Mi securityContext: allowPrivilegeEscalation: false capabilities: @@ -25275,6 +25305,13 @@ cluster: port: 8084 initialDelaySeconds: 5 periodSeconds: 10 + resources: + limits: + cpu: 500m + memory: 512Mi + requests: + cpu: 100m + memory: 128Mi securityContext: allowPrivilegeEscalation: false capabilities: @@ -25688,6 +25725,13 @@ cluster: port: 8080 initialDelaySeconds: 3 periodSeconds: 30 + resources: + limits: + cpu: 300m + memory: 256Mi + requests: + cpu: 50m + memory: 64Mi securityContext: allowPrivilegeEscalation: false capabilities: @@ -26035,6 +26079,13 @@ cluster: port: 8082 initialDelaySeconds: 5 periodSeconds: 10 + resources: + limits: + cpu: "1" + memory: 768Mi + requests: + cpu: 250m + memory: 256Mi securityContext: allowPrivilegeEscalation: false capabilities: @@ -26319,28 +26370,15 @@ cluster: destination: server: https://kubernetes.default.svc namespace: "{{.namespace}}" - # Harbor chart 1.15.1 renders empty subPath and annotations keys for its - # internal StatefulSets; Kubernetes omits both fields when persisting them. - ignoreDifferences: - - group: apps - kind: StatefulSet - name: harbor-database - jqPathExpressions: - - .spec.template.spec.containers[]?.volumeMounts[]?.subPath - - .spec.template.spec.initContainers[]?.volumeMounts[]?.subPath - - .spec.volumeClaimTemplates[]?.metadata.annotations - - group: apps - kind: StatefulSet - name: harbor-redis - jqPathExpressions: - - .spec.template.spec.containers[]?.volumeMounts[]?.subPath - - .spec.volumeClaimTemplates[]?.metadata.annotations syncPolicy: automated: prune: true selfHeal: true syncOptions: - CreateNamespace=true + # Allow a CRD-owning chart to establish its custom resource type when + # API discovery lags a cold-cluster bootstrap. + - SkipDryRunOnMissingResource=true - name: argocd-bootstrap contents: | # Raw-manifest lane: syncs bootstrap/ (shared non-chart manifests, e.g. diff --git a/omni/cluster-templates/patches/talos-1.14-compat.yaml b/omni/cluster-templates/patches/talos-1.14-compat.yaml new file mode 100644 index 0000000..b3ccf5e --- /dev/null +++ b/omni/cluster-templates/patches/talos-1.14-compat.yaml @@ -0,0 +1,11 @@ +apiVersion: v1alpha1 +kind: SecurityProfileConfig +workloadIsolation: false +--- +apiVersion: v1alpha1 +kind: CRICustomizationConfig +name: disable-nri +content: | + [plugins] + [plugins."io.containerd.nri.v1.nri"] + disable = true diff --git a/omni/machine-classes/control-plane.yaml b/omni/machine-classes/control-plane.yaml index 240e30a..d7b8f35 100644 --- a/omni/machine-classes/control-plane.yaml +++ b/omni/machine-classes/control-plane.yaml @@ -4,7 +4,7 @@ metadata: type: MachineClasses.omni.sidero.dev id: oci-cp spec: - installImage: ghcr.io/syscode-labs/talos-images/installer:v1.14.0-beta.1 + installImage: ghcr.io/syscode-labs/talos-images/installer:v1.14.0-rc.1 # Omni's MachineClass spec takes `matchlabels` (lowercase) as a LIST of # label selector strings. It was written as a camelCase map, which Omni # rejects with "machine class should either have auto provision or match diff --git a/omni/machine-classes/worker.yaml b/omni/machine-classes/worker.yaml index d909a4c..adcf38b 100644 --- a/omni/machine-classes/worker.yaml +++ b/omni/machine-classes/worker.yaml @@ -4,7 +4,7 @@ metadata: type: MachineClasses.omni.sidero.dev id: oci-worker spec: - installImage: ghcr.io/syscode-labs/talos-images/installer:v1.14.0-beta.1 + installImage: ghcr.io/syscode-labs/talos-images/installer:v1.14.0-rc.1 # Omni's MachineClass spec takes `matchlabels` (lowercase) as a LIST of # label selector strings. It was written as a camelCase map, which Omni # rejects with "machine class should either have auto provision or match diff --git a/omni/scripts/generate-manifests.sh b/omni/scripts/generate-manifests.sh index 78d5469..b3a5f98 100755 --- a/omni/scripts/generate-manifests.sh +++ b/omni/scripts/generate-manifests.sh @@ -74,9 +74,12 @@ patches: kind: ConfigMap name: argocd-cm patch: |- - - op: add - path: /data/application.resourceTrackingMethod - value: label + apiVersion: v1 + kind: ConfigMap + metadata: + name: argocd-cm + data: + application.resourceTrackingMethod: label # argocd-server serves TLS on its own port by default and 307-redirects # any plain-HTTP request to https — including requests our own tailscale # Ingress forwards as plain HTTP after terminating TLS at the tailnet diff --git a/omni/versions.yaml b/omni/versions.yaml index e8d8d9c..d042867 100644 --- a/omni/versions.yaml +++ b/omni/versions.yaml @@ -12,7 +12,7 @@ # overrides `talos` without `kubernetes` derives its Kubernetes version from # the supported versions of its own Talos target, not from the global pin. -talos: v1.14.0-beta.1 +talos: v1.14.0-rc.1 kubernetes: v1.36.3 clusters: @@ -21,7 +21,7 @@ clusters: # explicit override, not removed, so this stays true even if the global # pin moves again independently. unraid-lab: - talos: v1.14.0-beta.1 + talos: v1.14.0-rc.1 kubernetes: v1.36.3 # Never successfully bootstrapped — no live state to protect, no backup diff --git a/values/base/grafana-k8s-monitoring.yaml b/values/base/grafana-k8s-monitoring.yaml index 22b89d9..56af733 100644 --- a/values/base/grafana-k8s-monitoring.yaml +++ b/values/base/grafana-k8s-monitoring.yaml @@ -78,9 +78,9 @@ collectors: prometheus.scrape "talos_etcd" { targets = [ - { "__address__" = "192.168.122.109:2381", "instance" = "unraid-lab-control-planes-gwvq7k", "job" = "integrations/etcd" }, - { "__address__" = "192.168.122.190:2381", "instance" = "unraid-lab-control-planes-hqf6vh", "job" = "integrations/etcd" }, - { "__address__" = "192.168.122.214:2381", "instance" = "unraid-lab-control-planes-htvzs7", "job" = "integrations/etcd" }, + { "__address__" = "192.168.122.109:2383", "instance" = "unraid-lab-control-planes-gwvq7k", "job" = "integrations/etcd" }, + { "__address__" = "192.168.122.190:2383", "instance" = "unraid-lab-control-planes-hqf6vh", "job" = "integrations/etcd" }, + { "__address__" = "192.168.122.214:2383", "instance" = "unraid-lab-control-planes-htvzs7", "job" = "integrations/etcd" }, ] scrape_interval = "60s" scrape_timeout = "10s"