From 25b66690d475876128391cedc1923b501dbee7bb Mon Sep 17 00:00:00 2001 From: Giovanni Ferri Date: Sun, 6 Sep 2026 15:25:45 +0100 Subject: [PATCH] bootstrap Cilium on Unraid --- clusters/unraid-lab/omni/inline-manifests.yaml | 2 ++ omni/scripts/generate-manifests.sh | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/clusters/unraid-lab/omni/inline-manifests.yaml b/clusters/unraid-lab/omni/inline-manifests.yaml index 05da8a6..55a592d 100644 --- a/clusters/unraid-lab/omni/inline-manifests.yaml +++ b/clusters/unraid-lab/omni/inline-manifests.yaml @@ -34387,3 +34387,5 @@ cluster: - kind: ServiceAccount name: argocd-manager namespace: kube-system + - name: cilium + contents: "---\n# Source: cilium/templates/cilium-secrets-namespace.yaml\napiVersion: v1\nkind: Namespace\nmetadata:\n name: \"cilium-secrets\"\n labels:\n app.kubernetes.io/part-of: cilium\n annotations:\n---\n# Source: cilium/templates/cilium-agent/serviceaccount.yaml\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n name: \"cilium\"\n namespace: kube-system\n---\n# Source: cilium/templates/cilium-envoy/serviceaccount.yaml\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n name: \"cilium-envoy\"\n namespace: kube-system\n---\n# Source: cilium/templates/cilium-operator/serviceaccount.yaml\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n name: \"cilium-operator\"\n namespace: kube-system\n---\n# Source: cilium/templates/hubble-relay/serviceaccount.yaml\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n name: \"hubble-relay\"\n namespace: kube-system\nautomountServiceAccountToken: false\n---\n# Source: cilium/templates/hubble-ui/serviceaccount.yaml\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n name: \"hubble-ui\"\n namespace: kube-system\n---\n# Source: cilium/templates/cilium-ca-secret.yaml\napiVersion: v1\nkind: Secret\nmetadata:\n name: cilium-ca\n namespace: kube-system\n labels:\n cilium.io/helm-template-non-idempotent: \"true\"\ndata:\n ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURGRENDQWZ5Z0F3SUJBZ0lSQUx1TnFxWUxpeTFSWVVQRnIvYzQrYUl3RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEkyTURrd05qRTBNVGsxTWxvWERUSTVNRGt3TlRFMApNVGsxTWxvd0ZERVNNQkFHQTFVRUF4TUpRMmxzYVhWdElFTkJNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DCkFROEFNSUlCQ2dLQ0FRRUFzVFZLM05ybW94K1g5aktjZ1dnUGRvdlVIL1ViMDc5NFNkNWNRWmFuaDMxTWVzQlIKR1hkY3B2ZmJqSW1LdlVJWmFQamNHQmpXbmJPR2x5andDeGFmMkFyTDNXY296LzlsMVV4eCtTdE1ZK2xJeUExYQoreGhrWkM1UDlqeDVpSExscCt3Mmkza0l5cDBHcTE5OTYvSHhlb0JNMEZCNjVHbTBIVzI0Mmh6bzZSWjVSanM5CmhUZ1lOaDlaRVFtSzIzM1pIMGthOEg0R25aazVwTktRWm11M1NpRDBXbDIvbFZaL0tlUEtCNjEzRUdDWHVjdjAKS3haREgyeDlzSTlMaVFycUl2NUlwejJuMGFQWWIyWUpRMUswcFJUTWlCSnBYdXRUcG1JeXpXRUYzeEl6RWEzYQpjY3phRWxPRkJ3V0VGY2FqMVllZFh2anZlVDhRQlVoaU90N0g3d0lEQVFBQm8yRXdYekFPQmdOVkhROEJBZjhFCkJBTUNBcVF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUYKTUFNQkFmOHdIUVlEVlIwT0JCWUVGSUtsM1BsT0t3UjVFeHAzcWh6R2d3SXhPNlZJTUEwR0NTcUdTSWIzRFFFQgpDd1VBQTRJQkFRQWVOYzNYMjlFL2liUGVBY1N3MXNnK3kzTlQ2MHNvY1RaNmJZSFp1OFRlU295dS9jZlF3Vk9sCm1Tam1rWk42Qjh5M0k4M3hmT0hlaURFTm93bHRYUDZMM3o3bURucHRYWEdYWmo0T0NiR0FMVlYvMS9GK3M0dnQKN3pyY0VmT0Y4MDRZWVV5OXlEZmsrbGFvQnlEOU9iMUtLWEE0QnNncnFCT2d4QkJJSmIyYUR2SDQvUGZvVXUxYwpBbWdPK1FaWDlZMGNjNEpSOFhFaGsxYkc0ZDhyZHE3TyswMTJVaE1iNEZpaDZBKy91UGpIUEczTzhsK3RuOGxZCkRKL2xTL2ZLSW5EWHg1RXBJVGR4RE5pdXFnOTBpQngvWDdFYTZpdE9tZHluWklrRnVvWUorbVZSMll1V29YQ0QKWUdabXkvTEZZOXU5TWk0YnFpNzZib2I5MW9QS1N2Wm0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=\n ca.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBc1RWSzNOcm1veCtYOWpLY2dXZ1Bkb3ZVSC9VYjA3OTRTZDVjUVphbmgzMU1lc0JSCkdYZGNwdmZiakltS3ZVSVphUGpjR0JqV25iT0dseWp3Q3hhZjJBckwzV2Nvei85bDFVeHgrU3RNWStsSXlBMWEKK3hoa1pDNVA5ang1aUhMbHArdzJpM2tJeXAwR3ExOTk2L0h4ZW9CTTBGQjY1R20wSFcyNDJoem82Ulo1UmpzOQpoVGdZTmg5WkVRbUsyMzNaSDBrYThINEduWms1cE5LUVptdTNTaUQwV2wyL2xWWi9LZVBLQjYxM0VHQ1h1Y3YwCkt4WkRIMng5c0k5TGlRcnFJdjVJcHoybjBhUFliMllKUTFLMHBSVE1pQkpwWHV0VHBtSXl6V0VGM3hJekVhM2EKY2N6YUVsT0ZCd1dFRmNhajFZZWRYdmp2ZVQ4UUJVaGlPdDdIN3dJREFRQUJBb0lCQUJoNGZZQUdFbmRRTTVIaAo1MDdQYWVNNjUrNEowTy9xcnRlMGh4VGZrdjdZeEtqbXljdzBlV3p0S1RvOC9CV3FmUXZMNGNqS0ZVanRzNVpJCkp1M0JFQTJyWC8rUThVZlh3dDR6a2tHUVF4cEE2cllGY2h6ZWYyNStIcmlvSFRoRWRZWTh6a053VVZCNVlxUmoKcVdYZG9UVURacGdWcFFMSnZmK2FXVDUxWTR4Y1BVY0IzOFZtc3ZpV3lYd05rNS9kVkprMUxxZjlSQk4wZVVVVgplTUJkbnY3NGhhTEpDeGc5d1F2Qlc4MXYrcFl0ak9BMSsxV2MzNzdJMEpkNXVFYklxdHJ5dG5ZZ0tTSkY4a1M0CmJKUmNWa2QrQ1RTRCtpdkUzam9kMnR3Vlp5SkFTTnNCR00vQzRCdHE0QkxLbUljUjZ5VlVzNmNOWDdSUFFFaHoKcnR3V2ttRUNnWUVBMm5YbVErRjh0SHIxSThlMnNLeUtibmxqK1N6aXd2N0NqbVQrd29LdmdKM3pxUGw4RkVZdApvbmE4dVBHdXZqeTV1d0VBT2NwRzlYSlBUdmtScVNUQWFkZDAwMlRZcnBOTTNLU3BkdkU4azlYN0c0RzJvTHZmCkloZ1JiKzVoMm1mbzdSd1daSmQybkRKY1NaaFgraWNUUXh4RE9iZ0lyc1JvNStyWnRVd0VUT2tDZ1lFQXo2aXkKZUk2UFRyU2I2OFd6ZmFTbjBlR2szZlJnUVVmUHNKUnhKSkVETzVQcmlhRk0vcHQwYU1yWWpjRDROeGpJTmgzUQpVczB6WnVzTUhWY1VMN05wZzZUUzZKZGFFMTVqRTBCa1pEOHFJekNnUTBFcG82VHhHQzdDT09NdEJIQlZCOXhOCjNLNWpKUGxJaTFNNFpHQllyc0xqbm5DbmlIT3hNbG9GNnpwbGh4Y0NnWUFhMzdJSjI2MDVqbjZsZmlYdEtleUYKbG8xRDA4KzVhUm1KNXNhb0t1ZG9EUVl5WFM1MFdBVzVISjR1cWh4eTdvbHloYmIvWlBEQnRPUW90TjhGVGE0VgoxeGxaLytmZjRlTHNxWnpuTXRuZTNjM2NIbUxXOXdXRjdpd0c5dTQycmQycmZXOEx4TTRrZk5WNWdESWlaYmdxCjQwa3B5b2ZXNS9aM3dSNHkvVHp5TVFLQmdRQ3l3Vlk0ZndlUHlkczZueW4rYXlIbmd1VG9CM2hnV1kvSVFsQVAKR1NGK1JMd0o4cWNUdVFBQlFUUWUrbER4Sk0wY0FKZ1czdnR6aWJ3WStaK3YzREpsRnhwVERBNkhBOFluaVZPaQpFOW1UQjBXOS96YjMzb0dIdnFDRVZkS25zb2NQeUMzaVhOK05zV1VvUWhBV0gvWFhJbjdNSWMrbG4ybVduWFhnCjRwa0pLd0tCZ0F1RzIvT3hySUVOVUZzVEVtUHpKZVBISXY2bnhpbnRmdUovMG5jSUxkZEpzUnJWbnhGbVYwZ1EKOUVzTElyZmprZ2lPWGhheUttblk4aGJqT0Q1eStOMndSODVteFJnVHc5Zkw2d043eUVsQzA5RUdJZlpvQVBxZQptZGhoaDJvb1k0NERUaVdwaFlpS0hTUHRGdmpEcmRNS1JxMUdTbVZhekxDOEgwSVd1M05kCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==\n---\n# Source: cilium/templates/hubble/tls-helm/relay-client-secret.yaml\napiVersion: v1\nkind: Secret\nmetadata:\n name: hubble-relay-client-certs\n namespace: kube-system\n labels:\n cilium.io/helm-template-non-idempotent: \"true\"\n\n annotations:\ntype: kubernetes.io/tls\ndata:\n ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURGRENDQWZ5Z0F3SUJBZ0lSQUx1TnFxWUxpeTFSWVVQRnIvYzQrYUl3RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEkyTURrd05qRTBNVGsxTWxvWERUSTVNRGt3TlRFMApNVGsxTWxvd0ZERVNNQkFHQTFVRUF4TUpRMmxzYVhWdElFTkJNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DCkFROEFNSUlCQ2dLQ0FRRUFzVFZLM05ybW94K1g5aktjZ1dnUGRvdlVIL1ViMDc5NFNkNWNRWmFuaDMxTWVzQlIKR1hkY3B2ZmJqSW1LdlVJWmFQamNHQmpXbmJPR2x5andDeGFmMkFyTDNXY296LzlsMVV4eCtTdE1ZK2xJeUExYQoreGhrWkM1UDlqeDVpSExscCt3Mmkza0l5cDBHcTE5OTYvSHhlb0JNMEZCNjVHbTBIVzI0Mmh6bzZSWjVSanM5CmhUZ1lOaDlaRVFtSzIzM1pIMGthOEg0R25aazVwTktRWm11M1NpRDBXbDIvbFZaL0tlUEtCNjEzRUdDWHVjdjAKS3haREgyeDlzSTlMaVFycUl2NUlwejJuMGFQWWIyWUpRMUswcFJUTWlCSnBYdXRUcG1JeXpXRUYzeEl6RWEzYQpjY3phRWxPRkJ3V0VGY2FqMVllZFh2anZlVDhRQlVoaU90N0g3d0lEQVFBQm8yRXdYekFPQmdOVkhROEJBZjhFCkJBTUNBcVF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUYKTUFNQkFmOHdIUVlEVlIwT0JCWUVGSUtsM1BsT0t3UjVFeHAzcWh6R2d3SXhPNlZJTUEwR0NTcUdTSWIzRFFFQgpDd1VBQTRJQkFRQWVOYzNYMjlFL2liUGVBY1N3MXNnK3kzTlQ2MHNvY1RaNmJZSFp1OFRlU295dS9jZlF3Vk9sCm1Tam1rWk42Qjh5M0k4M3hmT0hlaURFTm93bHRYUDZMM3o3bURucHRYWEdYWmo0T0NiR0FMVlYvMS9GK3M0dnQKN3pyY0VmT0Y4MDRZWVV5OXlEZmsrbGFvQnlEOU9iMUtLWEE0QnNncnFCT2d4QkJJSmIyYUR2SDQvUGZvVXUxYwpBbWdPK1FaWDlZMGNjNEpSOFhFaGsxYkc0ZDhyZHE3TyswMTJVaE1iNEZpaDZBKy91UGpIUEczTzhsK3RuOGxZCkRKL2xTL2ZLSW5EWHg1RXBJVGR4RE5pdXFnOTBpQngvWDdFYTZpdE9tZHluWklrRnVvWUorbVZSMll1V29YQ0QKWUdabXkvTEZZOXU5TWk0YnFpNzZib2I5MW9QS1N2Wm0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=\n tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURTVENDQWpHZ0F3SUJBZ0lSQUlxVXd6UmRrWml3OCtXUGg5ZVdkOVl3RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEkyTURrd05qRTBNVGsxTTFvWERUSTNNRGt3TmpFMApNVGsxTTFvd0l6RWhNQjhHQTFVRUF3d1lLaTVvZFdKaWJHVXRjbVZzWVhrdVkybHNhWFZ0TG1sdk1JSUJJakFOCkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXNjd3hKMUpDbUh5Ny9HeXREQ1pNV2F0U21hNDIKOGF0ZGlqSTk0SGJyQ2RKZGhHUWRubmNNZnF3c0ZMc1BnbnF2amVnUXVncjN4dGNmb2lCRVNFaTVMa21OS2VCUwpIWUN3VUFiejVRUGNBV1FwcG9CQWUrTGxRZjFLMWlSTzNxcVJNVHQydVIyTEFuMWNxM0FuNXluRUJGM28zTitaCitiblRkTU8rOS9weC9wMzF5TjdHQWJKUEVWaFh4ZzZkM0svYmVzdXlVUFJaSzVwNk5mb0lHU1NieEE0OGZHalMKNk0vb0p4UVNBaU85ZEFUenlWUVYybTJUNjJTdG9PdE1yYXNjVG1HOTRqbTZlTUowYnZtWGVQV20vKys2YzEwQgpGYnM5aDZPQkFiMVJzMTV4OXoveEdoQW5BNDdFM3R5eHBrMjNwVmo4dVFZaENmbEtRNUVwM0h2a2Z3SURBUUFCCm80R0dNSUdETUE0R0ExVWREd0VCL3dRRUF3SUZvREFkQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUIKQlFVSEF3SXdEQVlEVlIwVEFRSC9CQUl3QURBZkJnTlZIU01FR0RBV2dCU0NwZHo1VGlzRWVSTWFkNm9jeG9NQwpNVHVsU0RBakJnTlZIUkVFSERBYWdoZ3FMbWgxWW1Kc1pTMXlaV3hoZVM1amFXeHBkVzB1YVc4d0RRWUpLb1pJCmh2Y05BUUVMQlFBRGdnRUJBR01oK3J2Zkd5MFpiZEh2MWNWVllpT1V0N1Y1YTlObGZKc0E5amEybXZKUVdmUnYKRFEwaFk3ZFg5V1JrYWtiVkdyU2t1SkZWNUpsZm1wSWxXZXN1dTdaRUlpcHpqSmNSb01ySnZ0UU1uenZnZEZLcwpwR1JNNmlRU1dvVVVyRXl4eUJIem12TjFWdS84YVhHbmVrb2FEUGcyaUpSTmNTRjVqd1RsbFRkdEw3eHhlb2tGClJod1YyaXE1TGtvVVVyTWczRDJrT1NERHdDSUk0Y2QzQzllQUFQd1VpbldKejJyUmdEYnNUazRRT0pFejVhaHUKbE95T0xFSURSS1dvSEZRU3plazNWNjhHVWhESVAzbmwzRFZ4VzBnU0NNYWtYVlVaTXBDVnBHcCtrM1VMaXI2agp3UkkyVzExUnJpWi9DR3lOd1ZpVnVHdVdBQUtHY1FxVmd1Y2dzRkU9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K\n tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcFFJQkFBS0NBUUVBc2N3eEoxSkNtSHk3L0d5dERDWk1XYXRTbWE0MjhhdGRpakk5NEhickNkSmRoR1FkCm5uY01mcXdzRkxzUGducXZqZWdRdWdyM3h0Y2ZvaUJFU0VpNUxrbU5LZUJTSFlDd1VBYno1UVBjQVdRcHBvQkEKZStMbFFmMUsxaVJPM3FxUk1UdDJ1UjJMQW4xY3EzQW41eW5FQkYzbzNOK1orYm5UZE1PKzkvcHgvcDMxeU43RwpBYkpQRVZoWHhnNmQzSy9iZXN1eVVQUlpLNXA2TmZvSUdTU2J4QTQ4ZkdqUzZNL29KeFFTQWlPOWRBVHp5VlFWCjJtMlQ2MlN0b090TXJhc2NUbUc5NGptNmVNSjBidm1YZVBXbS8rKzZjMTBCRmJzOWg2T0JBYjFSczE1eDl6L3gKR2hBbkE0N0UzdHl4cGsyM3BWajh1UVloQ2ZsS1E1RXAzSHZrZndJREFRQUJBb0lCQUd3OW5XY000MUltRGVQYwozWFRhRS8wN0dheEpyVlZ2T0NFYitTT2dBZk1XeUt3Q3J5MTcySFY5cDlCdkdVQWNKS2hGc1hreG1DckxhSXl4CkRDRGRkUzlDdzlmTW92RW5HUzkvTEJndVEwL3RoSlhDMm44UllQVE5tVFBKSXVMWUFGQnluUktSYzhGdVJHNXkKZHpoNTZzV2x6bEE1S0dvcHdSd0MxMDNzZ0YyN0ZNMFd0Z1ZRTy9IVDBFV1BBNnlnZ0ViUnhRY3FnQ0NUTkdJdwp1bDZkU1ZuTDlRNjI5YkVJY1YyZVV6b2FxWDR5cUxnbno3bDhKclVJK3hFUjkvb1lwMndmc2lwTzRDYlZnSndBCjE1Mno4NTFlT0NrSGx6WkVsYnBnYnVvZ3hMK20vSVRBQ2txQkw4bmVzcVlvalJ5akFhckJmVlZBT2w4S29vS24KdHB0Rmk2RUNnWUVBMGpFYmxkNnBLczN6WGJobk9QdTBreGw1VkVGYUJKaXBINHozYzFQMEg5THUxTldWYVIvNQoxSjBNblRHUE1CTElrYUdER2dab3d5TE1hekJndzlXL3RZUGNxcEQyajR2Y1Q3UW9UYVZTU0lzWGplRW9lL09SCnNVREp4eFZEbHRuazlwdTZ2YWFmQmRhQUtPRDJvVFVDZWtZWFhPTjd3b0FFM1daYTVGTVZVdGNDZ1lFQTJJdkUKV1VQOUR0aFZJL3RiNTNEMnJzMXY2TW9kM3MwYTMrdElzZzhMUG1vME1EeFRzd2lqd2JSYWVvWEhiOFRyWStWRApMdEV1L3RodXJreGZORjE5eGxBWjd1WHNQR0UzanM3bmZjNysyRklCTU1XeEQyR2J6RGRQSEpxUTl0Mk9tbnFCCi9ISkhDVkF0VnlPRU8zTkJyV3FIWlRKWmZldHBzWXlsajg1amJwa0NnWUVBcVJESzZXOWhqb1o5bkFLNU5FSngKYW1oeENPNVA0NmFQVWt0bXRpTHZGN0hvWE5VM0NvbW52L1phc1EydDZMTVRGT0JldlU0dWNkYkpxZVlOenpkYwpyam5VQW5YN2ZGYTQ3SHN5ZDlIa0wybUJscU5tbHR6QmNWdDFjV2FQS1FVMmY0MmZWUEJ5dEpWbUhIdG1wU0FvClVBV1V3U2hRNFk5cldsSDhCZTgyRlowQ2dZRUFwSnhpenlUQ3lyVWl5NjU1SjQrVXhqNis4bXdxbHNLOXlqZ1cKVTl6aHhEbUJvS1ZMVHc2alJVMnZkZklhTUZtMlFvTDJOakdvRXV3OS90dHBoK29HQVduRXZQa2xRcVQ0VWVQdwp6NDg1NVFFNWpIVExheERkR1RsMk54MDhVNTBLbVYzRlVEMGl5TzZjK04rejFtbUFKSzZWYkJVQk9KcHJCeUFPCmZ5bjZKZ2tDZ1lFQW4vZGFCdlAxSmdyWHUyaGh6VmVRTW1UTjhWS0xWNEkrK3ZVcitGWDY5TnZKaThId2huQlgKcTZTQTUvRDdOQWV2QzVFZHFGdng4QlJZWTBaa1Z2YWJVU0xBVlByUEYyWjA2bnVGU0dlWTc2aGViUEt4S3VaWApHQStJL2VpMHZkVTcyYlJROTBoQ0lpWTdJeEJYZFNYSVVsK3lhSWNkTzZkc2FrUm1MUlMvNmEwPQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=\n---\n# Source: cilium/templates/hubble/tls-helm/server-secret.yaml\napiVersion: v1\nkind: Secret\nmetadata:\n name: hubble-server-certs\n namespace: kube-system\n labels:\n cilium.io/helm-template-non-idempotent: \"true\"\n\n annotations:\ntype: kubernetes.io/tls\ndata:\n ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURGRENDQWZ5Z0F3SUJBZ0lSQUx1TnFxWUxpeTFSWVVQRnIvYzQrYUl3RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEkyTURrd05qRTBNVGsxTWxvWERUSTVNRGt3TlRFMApNVGsxTWxvd0ZERVNNQkFHQTFVRUF4TUpRMmxzYVhWdElFTkJNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DCkFROEFNSUlCQ2dLQ0FRRUFzVFZLM05ybW94K1g5aktjZ1dnUGRvdlVIL1ViMDc5NFNkNWNRWmFuaDMxTWVzQlIKR1hkY3B2ZmJqSW1LdlVJWmFQamNHQmpXbmJPR2x5andDeGFmMkFyTDNXY296LzlsMVV4eCtTdE1ZK2xJeUExYQoreGhrWkM1UDlqeDVpSExscCt3Mmkza0l5cDBHcTE5OTYvSHhlb0JNMEZCNjVHbTBIVzI0Mmh6bzZSWjVSanM5CmhUZ1lOaDlaRVFtSzIzM1pIMGthOEg0R25aazVwTktRWm11M1NpRDBXbDIvbFZaL0tlUEtCNjEzRUdDWHVjdjAKS3haREgyeDlzSTlMaVFycUl2NUlwejJuMGFQWWIyWUpRMUswcFJUTWlCSnBYdXRUcG1JeXpXRUYzeEl6RWEzYQpjY3phRWxPRkJ3V0VGY2FqMVllZFh2anZlVDhRQlVoaU90N0g3d0lEQVFBQm8yRXdYekFPQmdOVkhROEJBZjhFCkJBTUNBcVF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUYKTUFNQkFmOHdIUVlEVlIwT0JCWUVGSUtsM1BsT0t3UjVFeHAzcWh6R2d3SXhPNlZJTUEwR0NTcUdTSWIzRFFFQgpDd1VBQTRJQkFRQWVOYzNYMjlFL2liUGVBY1N3MXNnK3kzTlQ2MHNvY1RaNmJZSFp1OFRlU295dS9jZlF3Vk9sCm1Tam1rWk42Qjh5M0k4M3hmT0hlaURFTm93bHRYUDZMM3o3bURucHRYWEdYWmo0T0NiR0FMVlYvMS9GK3M0dnQKN3pyY0VmT0Y4MDRZWVV5OXlEZmsrbGFvQnlEOU9iMUtLWEE0QnNncnFCT2d4QkJJSmIyYUR2SDQvUGZvVXUxYwpBbWdPK1FaWDlZMGNjNEpSOFhFaGsxYkc0ZDhyZHE3TyswMTJVaE1iNEZpaDZBKy91UGpIUEczTzhsK3RuOGxZCkRKL2xTL2ZLSW5EWHg1RXBJVGR4RE5pdXFnOTBpQngvWDdFYTZpdE9tZHluWklrRnVvWUorbVZSMll1V29YQ0QKWUdabXkvTEZZOXU5TWk0YnFpNzZib2I5MW9QS1N2Wm0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=\n tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURWakNDQWo2Z0F3SUJBZ0lRTFk5UWVGWjl4V0xiS0ltRVhVVGFtekFOQmdrcWhraUc5dzBCQVFzRkFEQVUKTVJJd0VBWURWUVFERXdsRGFXeHBkVzBnUTBFd0hoY05Nall3T1RBMk1UUXhPVFV5V2hjTk1qY3dPVEEyTVRReApPVFV5V2pBcU1TZ3dKZ1lEVlFRRERCOHFMbVJsWm1GMWJIUXVhSFZpWW14bExXZHljR011WTJsc2FYVnRMbWx2Ck1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBb1V1c2RwTUVVVit6UW9UdEZkU28KRlJaMGNJaTZBWlFqTjlrbnhmMTR5M3I1T1ZHQ3BiYWZzUTRjWXlFUWNXSCt5dUI0TXhMV3oyRU9kSXhUQWZDVwo1MmxqNTFiUGhqNmwwZStMcmNUalRyTk1reitQaU9Db3U3TzNEZWZRL1dXUFpEcTNPYTZDYXNyaG5IQ0M5R0g4CjZ5d3BKNytLTnowU2xHYlBJODVkNVcyTi9POTB0MjFaOFdidWdVZmt0N2hUalBuZkJCbHYrTnRnN3F0VklwYmwKL3dXeDBkN3pFQkF2Q3duTmRmU2pqcEpsMUVXRzN0b1dvTkhmYUM0MjNNYXVvOGpZY1VOQUwwQUxwWlJUZnFPRwplY2FwQlhSMC9xSVI1WnhCODhLelNQR1B0b3FiR3lYc3l3bXU1VXhLL240UDZlSkxoREhDWjVaNzVJTXFFWm9mCml3SURBUUFCbzRHTk1JR0tNQTRHQTFVZER3RUIvd1FFQXdJRm9EQWRCZ05WSFNVRUZqQVVCZ2dyQmdFRkJRY0QKQVFZSUt3WUJCUVVIQXdJd0RBWURWUjBUQVFIL0JBSXdBREFmQmdOVkhTTUVHREFXZ0JTQ3BkejVUaXNFZVJNYQpkNm9jeG9NQ01UdWxTREFxQmdOVkhSRUVJekFoZ2g4cUxtUmxabUYxYkhRdWFIVmlZbXhsTFdkeWNHTXVZMmxzCmFYVnRMbWx2TUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFDWTViOXFOOEM3RkRsdUlrb0d1dmoyUTZ3YXk3L1QKSzFsMVZ6a3ZHM2habWdUZXNtL09Uam9xalV5enJGWE9TZS9xTmt5MnhrSFM4ZHpRMVR5OVJtOXB0YXpVWUtDagpiMGJZNXZhWFFrdGRzbzF1SXpIN3pvWGkrNHphSll0WXFURjRiU3NCVnRKMmk1Y2w0UGhQcytYc3l5b2VQdlcxCnFoZzZTdUlRSUtZM0UrVlZVTUxaS0RYK1BjUnowTFhqUzNOWjNXQTcyanBvYUFHb3Exb1VwZjB1MFM5dHBscFgKbVVPc1E2a1YwV2hSZXFScjA4NXJZY3RlTzBsNEZ2TTN5T2ZySGJ4TUlMQ2lqUjVQTDQrZXY3bGhWMmFhYzBaNwp3STBBREtQb3BzeVN0WGhJNEhpSEo5N2tJUXpqdlRwUGZhSkJtaFZxcEdRbEcxM1ZBNWx0V21zaAotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==\n tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBb1V1c2RwTUVVVit6UW9UdEZkU29GUlowY0lpNkFaUWpOOWtueGYxNHkzcjVPVkdDCnBiYWZzUTRjWXlFUWNXSCt5dUI0TXhMV3oyRU9kSXhUQWZDVzUybGo1MWJQaGo2bDBlK0xyY1RqVHJOTWt6K1AKaU9Db3U3TzNEZWZRL1dXUFpEcTNPYTZDYXNyaG5IQ0M5R0g4Nnl3cEo3K0tOejBTbEdiUEk4NWQ1VzJOL085MAp0MjFaOFdidWdVZmt0N2hUalBuZkJCbHYrTnRnN3F0VklwYmwvd1d4MGQ3ekVCQXZDd25OZGZTampwSmwxRVdHCjN0b1dvTkhmYUM0MjNNYXVvOGpZY1VOQUwwQUxwWlJUZnFPR2VjYXBCWFIwL3FJUjVaeEI4OEt6U1BHUHRvcWIKR3lYc3l3bXU1VXhLL240UDZlSkxoREhDWjVaNzVJTXFFWm9maXdJREFRQUJBb0lCQUM1MnZTeS9OeXcxMUU3aQpPZVhqQjdSamJwR0lZWVRZNXJoTTN3OUM4RXcxbFp1MFpsMVVXWFpJcVZiSkRKS005emY4SjhRV3RqaXhMZGZYCklJWmJoeTBNaUJINVNQalVEVEtIdmdZRnhMRkVKMWYzcEdKNnpVQ2RDYXVBend4ZitFbVlQSFhxVm5sckRramgKaEdmZjNscmtzc3BYZS9wanBubUhrRDR4VVkwb1orWW5xOUtTVHIxMGxtd21HRW5jMUlibXZnTXdLbWJDVWU3dApzdEFNUnFPN1VWOGcrd2dhZnoxaXlZVFNOQ0djYzVEbmVzcUFzUjhaZTlFaSt2cFk3dUo3Q0FEOHpyUWJUb2c3CjAvS1Q3YkJ1MUkxdENoS0tXOSs1cW1SNk12QmRyRjBHQnNURkZibDl0bU5aQm45cGJWVzVBWlZUaERzQ0Y2QVcKbW56SU5GRUNnWUVBMDVtRXY5LzNvZEMwREtUdzBPY0NhZzZScmExZWdNWXRseTFDZk5ncG4wcjM2M0MwR3VTYgpicXBZb0Y0a1RYQ05qU1NjU3oya2ZJK2YyK0tRemF1VUZBYjlNMzY2dEJhK0ErYzdaV2JnUi9QclF4bE12c0VICkJFWHZpN3NlWS92TFlHVjhoM0VTRVVaSkxLUmtRYWVuUE9TaXZRZGQxREVjNE5DbmZvWTUzOWtDZ1lFQXd5UDUKcUJzQUtieXBjalg5KzJUcms5TTRyZlRkYjhueDVBdUlvaFRFd1prT2JLV1BOcklXSnVnaElRNll4SnRqSFFtYQpyRytacHlSU0JEN3FZOE9DLzQrMkVGREhPZGQ1VFc5UWlLOXliRHFYZlZuTEtHaUg2aFRyeHlmakhUNWNSQlRHCmU0enozTmJ5Y0VJd1lhTGloN0ZFTFNtbU10SEpqNHlSQTZjQWdBTUNnWUVBdktacEtSd0h6aGVnL29qclBvUkcKcmNHUmRkTlVwdUNJOHZoaUI2WTg3WXpNSGZkY1M0RzNaZUd2cEVKcWdUUXdyejZOcmJNbWUvc2NuZENRSXgydQpwbkJZdTlsbm9YbUpMVGV4eDhVQmZvVGtJZTFqYzhucWRJL1pjcTEvK2NvYVZ6WUQ0VWtZdjVmM1V6cTVPNk82ClFWcmlFRCtLRXMwNm51RElBOUN0dG5rQ2dZQkY0S0FKM29GVWNNYU1xMkRqb09QcTczd2dic3JNdVJmeGZWL1UKQ25QYWo2Qm1yM0oxTjVoUEhsaWVxY2R5ditIaUNBcG5MUjlzaHNrSDFDL0N3Y1FyRjU4dWdINlc2OTM0S0tCQwpFZkY3YUEvUFIxUkVpQW9EZkxKaGdwc0ZZY3RRWmRBZGRmL3RXTnMvNzdPN2dzUnpxcnFySVhydVA4bFpxaEJUCnFuMjNXUUtCZ0VxZlZEcld2dkZONGFGTnRhd25TeFhmYjd1QkIvcHFYZE05aGIwVEphL2tlbGNhaUIreUpQOXoKMFl2MzVoN05ISzZrMnZkUWtyeXY4eXlsSEFQaURjZXJPWkxzdC9DSm1ZbFpmMzNRZkd5VTlld1J6TWE5d09CRAp5MTF2WWl1YkdSWUNpYk13UzRsckxSNDlRUXFiVExuZWF4Tm5zMGIwdFdCM0VjZTNnMnNHCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==\n---\n# Source: cilium/templates/cilium-configmap.yaml\napiVersion: v1\nkind: ConfigMap\nmetadata:\n name: cilium-config\n namespace: kube-system\ndata:\n\n # Identity allocation mode selects how identities are shared between cilium\n # nodes by setting how they are stored. The options are \"crd\", \"kvstore\" or\n # \"doublewrite-readkvstore\" / \"doublewrite-readcrd\".\n # - \"crd\" stores identities in kubernetes as CRDs (custom resource definition).\n # These can be queried with:\n # kubectl get ciliumid\n # - \"kvstore\" stores identities in an etcd kvstore, that is\n # configured below. Cilium versions before 1.6 supported only the kvstore\n # backend. Upgrades from these older cilium versions should continue using\n # the kvstore by commenting out the identity-allocation-mode below, or\n # setting it to \"kvstore\".\n # - \"doublewrite\" modes store identities in both the kvstore and CRDs. This is useful\n # for seamless migrations from the kvstore mode to the crd mode. Consult the\n # documentation for more information on how to perform the migration.\n identity-allocation-mode: crd\n\n identity-heartbeat-timeout: \"30m0s\"\n identity-gc-interval: \"15m0s\"\n cilium-endpoint-gc-interval: \"5m0s\"\n nodes-gc-interval: \"5m0s\"\n\n # If you want to run cilium in debug mode change this value to true\n debug: \"false\"\n debug-verbose: \"\"\n metrics-sampling-interval: \"5m\"\n # The agent can be put into the following three policy enforcement modes\n # default, always and never.\n # https://docs.cilium.io/en/latest/security/policy/intro/#policy-enforcement-modes\n enable-policy: \"default\"\n policy-cidr-match-mode: \"\"\n # If you want metrics enabled in cilium-operator, set the port for\n # which the Cilium Operator will have their metrics exposed.\n # NOTE that this will open the port on the nodes where Cilium operator pod\n # is scheduled.\n operator-prometheus-serve-addr: \":9963\"\n enable-metrics: \"true\"\n enable-policy-secrets-sync: \"true\"\n policy-secrets-only-from-secrets-namespace: \"true\"\n policy-secrets-namespace: \"cilium-secrets\"\n\n # Enable IPv4 addressing. If enabled, all endpoints are allocated an IPv4\n # address.\n enable-ipv4: \"true\"\n\n # Enable IPv6 addressing. If enabled, all endpoints are allocated an IPv6\n # address.\n enable-ipv6: \"false\"\n # Users who wish to specify their own custom CNI configuration file must set\n # custom-cni-conf to \"true\", otherwise Cilium may overwrite the configuration.\n custom-cni-conf: \"false\"\n enable-bpf-clock-probe: \"false\"\n # If you want cilium monitor to aggregate tracing for packets, set this level\n # to \"low\", \"medium\", or \"maximum\". The higher the level, the less packets\n # that will be seen in monitor output.\n monitor-aggregation: medium\n\n # The monitor aggregation interval governs the typical time between monitor\n # notification events for each allowed connection.\n #\n # Only effective when monitor aggregation is set to \"medium\" or higher.\n monitor-aggregation-interval: \"5s\"\n\n # The monitor aggregation flags determine which TCP flags which, upon the\n # first observation, cause monitor notifications to be generated.\n #\n # Only effective when monitor aggregation is set to \"medium\" or higher.\n monitor-aggregation-flags: all\n # Specifies the ratio (0.0-1.0] of total system memory to use for dynamic\n # sizing of the TCP CT, non-TCP CT, NAT and policy BPF maps.\n bpf-map-dynamic-size-ratio: \"0.0025\"\n # bpf-policy-map-max specifies the maximum number of entries in endpoint\n # policy map (per endpoint)\n bpf-policy-map-max: \"16384\"\n # bpf-policy-stats-map-max specifies the maximum number of entries in global\n # policy stats map\n bpf-policy-stats-map-max: \"65536\"\n # bpf-lb-map-max specifies the maximum number of entries in bpf lb service,\n # backend and affinity maps.\n bpf-lb-map-max: \"65536\"\n bpf-lb-external-clusterip: \"false\"\n bpf-lb-source-range-all-types: \"false\"\n bpf-lb-algorithm-annotation: \"false\"\n bpf-lb-mode-annotation: \"false\"\n\n bpf-distributed-lru: \"false\"\n bpf-events-drop-enabled: \"true\"\n bpf-events-policy-verdict-enabled: \"true\"\n bpf-events-trace-enabled: \"true\"\n\n # Pre-allocation of map entries allows per-packet latency to be reduced, at\n # the expense of up-front memory allocation for the entries in the maps. The\n # default value below will minimize memory usage in the default installation;\n # users who are sensitive to latency may consider setting this to \"true\".\n #\n # This option was introduced in Cilium 1.4. Cilium 1.3 and earlier ignore\n # this option and behave as though it is set to \"true\".\n #\n # If this value is modified, then during the next Cilium startup the restore\n # of existing endpoints and tracking of ongoing connections may be disrupted.\n # As a result, reply packets may be dropped and the load-balancing decisions\n # for established connections may change.\n #\n # If this option is set to \"false\" during an upgrade from 1.3 or earlier to\n # 1.4 or later, then it may cause one-time disruptions during the upgrade.\n preallocate-bpf-maps: \"false\"\n\n # Name of the cluster. Only relevant when building a mesh of clusters.\n cluster-name: \"default\"\n # Unique ID of the cluster. Must be unique across all connected clusters and\n # in the range of 1 and 255. Only relevant when building a mesh of clusters.\n cluster-id: \"0\"\n\n # Encapsulation mode for communication between nodes\n # Possible values:\n # - disabled\n # - vxlan (default)\n # - geneve\n\n routing-mode: \"tunnel\"\n tunnel-protocol: \"vxlan\"\n tunnel-source-port-range: \"0-0\"\n service-no-backend-response: \"reject\"\n policy-deny-response: \"none\"\n\n\n # Enables L7 proxy for L7 policy enforcement and visibility\n enable-l7-proxy: \"true\"\n enable-ipv4-masquerade: \"true\"\n enable-ipv4-big-tcp: \"false\"\n enable-ipv6-big-tcp: \"false\"\n enable-ipv6-masquerade: \"true\"\n enable-tcx: \"true\"\n datapath-mode: \"veth\"\n enable-masquerade-to-route-source: \"false\"\n\n enable-xt-socket-fallback: \"true\"\n install-no-conntrack-iptables-rules: \"false\"\n iptables-random-fully: \"false\"\n\n auto-direct-node-routes: \"false\"\n direct-routing-skip-unreachable: \"false\"\n\n\n\n enable-host-firewall: \"false\"\n\n kube-proxy-replacement: \"true\"\n kube-proxy-replacement-healthz-bind-address: \"\"\n enable-no-service-endpoints-routable: \"true\"\n bpf-lb-sock: \"false\"\n nodeport-addresses: \"\"\n enable-health-check-nodeport: \"true\"\n enable-health-check-loadbalancer-ip: \"false\"\n node-port-bind-protection: \"true\"\n enable-auto-protect-node-port-range: \"true\"\n bpf-lb-acceleration: \"disabled\"\n enable-service-topology: \"false\"\n enable-l2-neigh-discovery: \"false\"\n k8s-require-ipv4-pod-cidr: \"false\"\n k8s-require-ipv6-pod-cidr: \"false\"\n enable-k8s-networkpolicy: \"true\"\n enable-endpoint-lockdown-on-policy-overflow: \"false\"\n # Tell the agent to generate and write a CNI configuration file\n write-cni-conf-when-ready: /host/etc/cni/net.d/05-cilium.conflist\n cni-exclusive: \"true\"\n cni-log-file: \"/var/run/cilium/cilium-cni.log\"\n enable-endpoint-health-checking: \"true\"\n enable-health-checking: \"true\"\n health-check-icmp-failure-threshold: \"3\"\n enable-well-known-identities: \"false\"\n enable-node-selector-labels: \"false\"\n synchronize-k8s-nodes: \"true\"\n operator-api-serve-addr: \"127.0.0.1:9234\"\n\n enable-hubble: \"true\"\n # UNIX domain socket for Hubble server to listen to.\n hubble-socket-path: \"/var/run/cilium/hubble.sock\"\n hubble-network-policy-correlation-enabled: \"true\"\n # An additional address for Hubble server to listen to (e.g. \":4244\").\n hubble-listen-address: \":4244\"\n hubble-disable-tls: \"false\"\n hubble-tls-cert-file: /var/lib/cilium/tls/hubble/server.crt\n hubble-tls-key-file: /var/lib/cilium/tls/hubble/server.key\n hubble-tls-client-ca-files: /var/lib/cilium/tls/hubble/client-ca.crt\n ipam: \"kubernetes\"\n ipam-cilium-node-update-rate: \"15s\"\n\n default-lb-service-ipam: \"lbipam\"\n egress-gateway-reconciliation-trigger-interval: \"1s\"\n enable-vtep: \"false\"\n vtep-endpoint: \"\"\n vtep-cidr: \"\"\n vtep-mask: \"\"\n vtep-mac: \"\"\n\n packetization-layer-pmtud-mode: \"blackhole\"\n bpf-root: \"/sys/fs/bpf\"\n cgroup-root: \"/run/cilium/cgroupv2\"\n\n identity-management-mode: \"agent\"\n enable-sctp: \"false\"\n remove-cilium-node-taints: \"true\"\n set-cilium-node-taints: \"true\"\n set-cilium-is-up-condition: \"true\"\n unmanaged-pod-watcher-interval: \"15s\"\n # default DNS proxy to transparent mode in non-chaining modes\n dnsproxy-enable-transparent-mode: \"true\"\n dnsproxy-socket-linger-timeout: \"10\"\n tofqdns-dns-reject-response-code: \"refused\"\n tofqdns-enable-dns-compression: \"true\"\n tofqdns-endpoint-max-ip-per-hostname: \"1000\"\n tofqdns-idle-connection-grace-period: \"0s\"\n tofqdns-max-deferred-connection-deletes: \"10000\"\n tofqdns-proxy-response-max-delay: \"100ms\"\n tofqdns-preallocate-identities: \"true\"\n agent-not-ready-taint-key: \"node.cilium.io/agent-not-ready\"\n\n mesh-auth-enabled: \"false\"\n mesh-auth-queue-size: \"1024\"\n mesh-auth-rotated-identities-queue-size: \"1024\"\n mesh-auth-gc-interval: \"5m0s\"\n\n proxy-xff-num-trusted-hops-ingress: \"0\"\n proxy-xff-num-trusted-hops-egress: \"0\"\n proxy-connect-timeout: \"2\"\n proxy-initial-fetch-timeout: \"30\"\n proxy-max-active-downstream-connections: \"50000\"\n proxy-max-requests-per-connection: \"0\"\n proxy-max-connection-duration-seconds: \"0\"\n proxy-idle-timeout-seconds: \"60\"\n proxy-max-concurrent-retries: \"128\"\n proxy-use-original-source-address: \"true\"\n proxy-cluster-max-connections: \"1024\"\n proxy-cluster-max-requests: \"1024\"\n http-retry-count: \"3\"\n http-stream-idle-timeout: \"300\"\n\n external-envoy-proxy: \"true\"\n envoy-base-id: \"0\"\n envoy-access-log-buffer-size: \"4096\"\n envoy-keep-cap-netbindservice: \"false\"\n max-connected-clusters: \"255\"\n clustermesh-cache-ttl: \"0s\"\n clustermesh-enable-endpoint-sync: \"false\"\n clustermesh-enable-mcs-api: \"false\"\n clustermesh-mcs-api-install-crds: \"true\"\n policy-default-local-cluster: \"true\"\n\n nat-map-stats-entries: \"32\"\n nat-map-stats-interval: \"30s\"\n enable-lb-ipam: \"true\"\n enable-non-default-deny-policies: \"true\"\n enable-source-ip-verification: \"true\"\n enable-dynamic-config: \"true\"\n enable-drift-checker: \"true\"\n\n# Extra config allows adding arbitrary properties to the cilium config.\n# By putting it at the end of the ConfigMap, it's also possible to override existing properties.\n---\n# Source: cilium/templates/cilium-envoy/configmap.yaml\napiVersion: v1\nkind: ConfigMap\nmetadata:\n name: cilium-envoy-config\n namespace: kube-system\ndata:\n # Keep the key name as bootstrap-config.json to avoid breaking changes\n bootstrap-config.json: |\n {\"admin\":{\"address\":{\"pipe\":{\"mode\":432,\"path\":\"/var/run/cilium/envoy/sockets/admin.sock\"}}},\"applicationLogConfig\":{\"logFormat\":{\"textFormat\":\"[%Y-%m-%d %T.%e][%t][%l][%n] [%g:%#] %v\"}},\"bootstrapExtensions\":[{\"name\":\"envoy.bootstrap.internal_listener\",\"typedConfig\":{\"@type\":\"type.googleapis.com/envoy.extensions.bootstrap.internal_listener.v3.InternalListener\"}}],\"dynamicResources\":{\"cdsConfig\":{\"apiConfigSource\":{\"apiType\":\"GRPC\",\"grpcServices\":[{\"envoyGrpc\":{\"clusterName\":\"xds-grpc-cilium\"}}],\"setNodeOnFirstMessageOnly\":true,\"transportApiVersion\":\"V3\"},\"initialFetchTimeout\":\"30s\",\"resourceApiVersion\":\"V3\"},\"ldsConfig\":{\"apiConfigSource\":{\"apiType\":\"GRPC\",\"grpcServices\":[{\"envoyGrpc\":{\"clusterName\":\"xds-grpc-cilium\"}}],\"setNodeOnFirstMessageOnly\":true,\"transportApiVersion\":\"V3\"},\"initialFetchTimeout\":\"30s\",\"resourceApiVersion\":\"V3\"}},\"node\":{\"cluster\":\"ingress-cluster\",\"id\":\"host~127.0.0.1~no-id~localdomain\"},\"overloadManager\":{\"resourceMonitors\":[{\"name\":\"envoy.resource_monitors.global_downstream_max_connections\",\"typedConfig\":{\"@type\":\"type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig\",\"max_active_downstream_connections\":\"50000\"}}]},\"staticResources\":{\"clusters\":[{\"circuitBreakers\":{\"thresholds\":[{\"maxConnections\":1024,\"maxRequests\":1024,\"maxRetries\":128}]},\"cleanupInterval\":\"2.500s\",\"connectTimeout\":\"2s\",\"lbPolicy\":\"CLUSTER_PROVIDED\",\"name\":\"ingress-cluster\",\"type\":\"ORIGINAL_DST\",\"typedExtensionProtocolOptions\":{\"envoy.extensions.upstreams.http.v3.HttpProtocolOptions\":{\"@type\":\"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\"commonHttpProtocolOptions\":{\"idleTimeout\":\"60s\",\"maxConnectionDuration\":\"0s\",\"maxRequestsPerConnection\":0},\"useDownstreamProtocolConfig\":{}}}},{\"circuitBreakers\":{\"thresholds\":[{\"maxConnections\":1024,\"maxRequests\":1024,\"maxRetries\":128}]},\"cleanupInterval\":\"2.500s\",\"connectTimeout\":\"2s\",\"lbPolicy\":\"CLUSTER_PROVIDED\",\"name\":\"egress-cluster-tls\",\"transportSocket\":{\"name\":\"cilium.tls_wrapper\",\"typedConfig\":{\"@type\":\"type.googleapis.com/cilium.UpstreamTlsWrapperContext\"}},\"type\":\"ORIGINAL_DST\",\"typedExtensionProtocolOptions\":{\"envoy.extensions.upstreams.http.v3.HttpProtocolOptions\":{\"@type\":\"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\"commonHttpProtocolOptions\":{\"idleTimeout\":\"60s\",\"maxConnectionDuration\":\"0s\",\"maxRequestsPerConnection\":0},\"upstreamHttpProtocolOptions\":{},\"useDownstreamProtocolConfig\":{}}}},{\"circuitBreakers\":{\"thresholds\":[{\"maxConnections\":1024,\"maxRequests\":1024,\"maxRetries\":128}]},\"cleanupInterval\":\"2.500s\",\"connectTimeout\":\"2s\",\"lbPolicy\":\"CLUSTER_PROVIDED\",\"name\":\"egress-cluster\",\"type\":\"ORIGINAL_DST\",\"typedExtensionProtocolOptions\":{\"envoy.extensions.upstreams.http.v3.HttpProtocolOptions\":{\"@type\":\"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\"commonHttpProtocolOptions\":{\"idleTimeout\":\"60s\",\"maxConnectionDuration\":\"0s\",\"maxRequestsPerConnection\":0},\"useDownstreamProtocolConfig\":{}}}},{\"circuitBreakers\":{\"thresholds\":[{\"maxConnections\":1024,\"maxRequests\":1024,\"maxRetries\":128}]},\"cleanupInterval\":\"2.500s\",\"connectTimeout\":\"2s\",\"lbPolicy\":\"CLUSTER_PROVIDED\",\"name\":\"ingress-cluster-tls\",\"transportSocket\":{\"name\":\"cilium.tls_wrapper\",\"typedConfig\":{\"@type\":\"type.googleapis.com/cilium.UpstreamTlsWrapperContext\"}},\"type\":\"ORIGINAL_DST\",\"typedExtensionProtocolOptions\":{\"envoy.extensions.upstreams.http.v3.HttpProtocolOptions\":{\"@type\":\"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\"commonHttpProtocolOptions\":{\"idleTimeout\":\"60s\",\"maxConnectionDuration\":\"0s\",\"maxRequestsPerConnection\":0},\"upstreamHttpProtocolOptions\":{},\"useDownstreamProtocolConfig\":{}}}},{\"connectTimeout\":\"2s\",\"loadAssignment\":{\"clusterName\":\"xds-grpc-cilium\",\"endpoints\":[{\"lbEndpoints\":[{\"endpoint\":{\"address\":{\"pipe\":{\"path\":\"/var/run/cilium/envoy/sockets/xds.sock\"}}}}]}]},\"name\":\"xds-grpc-cilium\",\"type\":\"STATIC\",\"typedExtensionProtocolOptions\":{\"envoy.extensions.upstreams.http.v3.HttpProtocolOptions\":{\"@type\":\"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\"explicitHttpConfig\":{\"http2ProtocolOptions\":{}}}}},{\"connectTimeout\":\"2s\",\"loadAssignment\":{\"clusterName\":\"/envoy-admin\",\"endpoints\":[{\"lbEndpoints\":[{\"endpoint\":{\"address\":{\"pipe\":{\"path\":\"/var/run/cilium/envoy/sockets/admin.sock\"}}}}]}]},\"name\":\"/envoy-admin\",\"type\":\"STATIC\"}],\"listeners\":[{\"address\":{\"socketAddress\":{\"address\":\"0.0.0.0\",\"portValue\":9964}},\"filterChains\":[{\"filters\":[{\"name\":\"envoy.filters.network.http_connection_manager\",\"typedConfig\":{\"@type\":\"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\",\"httpFilters\":[{\"name\":\"envoy.filters.http.router\",\"typedConfig\":{\"@type\":\"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\"}}],\"internalAddressConfig\":{\"cidrRanges\":[{\"addressPrefix\":\"10.0.0.0\",\"prefixLen\":8},{\"addressPrefix\":\"172.16.0.0\",\"prefixLen\":12},{\"addressPrefix\":\"192.168.0.0\",\"prefixLen\":16},{\"addressPrefix\":\"127.0.0.1\",\"prefixLen\":32}]},\"routeConfig\":{\"virtualHosts\":[{\"domains\":[\"*\"],\"name\":\"prometheus_metrics_route\",\"routes\":[{\"match\":{\"prefix\":\"/metrics\"},\"name\":\"prometheus_metrics_route\",\"route\":{\"cluster\":\"/envoy-admin\",\"prefixRewrite\":\"/stats/prometheus\"}}]}]},\"statPrefix\":\"envoy-prometheus-metrics-listener\",\"streamIdleTimeout\":\"300s\"}}]}],\"name\":\"envoy-prometheus-metrics-listener\"},{\"address\":{\"socketAddress\":{\"address\":\"127.0.0.1\",\"portValue\":9878}},\"filterChains\":[{\"filters\":[{\"name\":\"envoy.filters.network.http_connection_manager\",\"typedConfig\":{\"@type\":\"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\",\"httpFilters\":[{\"name\":\"envoy.filters.http.router\",\"typedConfig\":{\"@type\":\"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\"}}],\"internalAddressConfig\":{\"cidrRanges\":[{\"addressPrefix\":\"10.0.0.0\",\"prefixLen\":8},{\"addressPrefix\":\"172.16.0.0\",\"prefixLen\":12},{\"addressPrefix\":\"192.168.0.0\",\"prefixLen\":16},{\"addressPrefix\":\"127.0.0.1\",\"prefixLen\":32}]},\"routeConfig\":{\"virtual_hosts\":[{\"domains\":[\"*\"],\"name\":\"health\",\"routes\":[{\"match\":{\"prefix\":\"/healthz\"},\"name\":\"health\",\"route\":{\"cluster\":\"/envoy-admin\",\"prefixRewrite\":\"/ready\"}}]}]},\"statPrefix\":\"envoy-health-listener\",\"streamIdleTimeout\":\"300s\"}}]}],\"name\":\"envoy-health-listener\"}]}}\n---\n# Source: cilium/templates/hubble-relay/configmap.yaml\napiVersion: v1\nkind: ConfigMap\nmetadata:\n name: hubble-relay-config\n namespace: kube-system\ndata:\n config.yaml: |\n cluster-name: default\n peer-service: \"hubble-peer.kube-system.svc.cluster.local.:443\"\n listen-address: :4245\n gops: true\n gops-port: \"9893\"\n retry-timeout: \n sort-buffer-len-max: \n sort-buffer-drain-timeout: \n tls-hubble-client-cert-file: /var/lib/hubble-relay/tls/client.crt\n tls-hubble-client-key-file: /var/lib/hubble-relay/tls/client.key\n tls-hubble-server-ca-files: /var/lib/hubble-relay/tls/hubble-server-ca.crt\n \n disable-server-tls: true\n---\n# Source: cilium/templates/hubble-ui/configmap.yaml\napiVersion: v1\nkind: ConfigMap\nmetadata:\n name: hubble-ui-nginx\n namespace: kube-system\ndata:\n nginx.conf: \"server {\\n listen 8081;\\n listen [::]:8081;\\n server_name localhost;\\n root /app;\\n index index.html;\\n client_max_body_size 1G;\\n\\n location / {\\n proxy_set_header Host $host;\\n proxy_set_header X-Real-IP $remote_addr;\\n\\n location /api {\\n proxy_http_version 1.1;\\n proxy_pass_request_headers on;\\n proxy_pass http://127.0.0.1:8090;\\n }\\n location / {\\n if ($http_user_agent ~* \\\"kube-probe\\\") { access_log off; }\\n # double `/index.html` is required here\\n try_files $uri $uri/ /index.html /index.html;\\n }\\n\\n # Liveness probe\\n location /healthz {\\n access_log off;\\n add_header Content-Type text/plain;\\n return 200 'ok';\\n }\\n }\\n}\"\n---\n# Source: cilium/templates/cilium-agent/clusterrole.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRole\nmetadata:\n name: cilium\n labels:\n app.kubernetes.io/part-of: cilium\nrules:\n- apiGroups:\n - networking.k8s.io\n resources:\n - networkpolicies\n verbs:\n - get\n - list\n - watch\n- apiGroups:\n - discovery.k8s.io\n resources:\n - endpointslices\n verbs:\n - get\n - list\n - watch\n- apiGroups:\n - \"\"\n resources:\n - namespaces\n - services\n - pods\n - endpoints\n - nodes\n verbs:\n - get\n - list\n - watch\n- apiGroups:\n - apiextensions.k8s.io\n resources:\n - customresourcedefinitions\n verbs:\n - list\n - watch\n # This is used when validating policies in preflight. This will need to stay\n # until we figure out how to avoid \"get\" inside the preflight, and then\n # should be removed ideally.\n - get\n- apiGroups:\n - cilium.io\n resources:\n - ciliumloadbalancerippools\n - ciliumbgppeeringpolicies\n - ciliumbgpnodeconfigs\n - ciliumbgpadvertisements\n - ciliumbgppeerconfigs\n - ciliumclusterwideenvoyconfigs\n - ciliumclusterwidenetworkpolicies\n - ciliumegressgatewaypolicies\n - ciliumendpoints\n - ciliumendpointslices\n - ciliumenvoyconfigs\n - ciliumidentities\n - ciliumlocalredirectpolicies\n - ciliumnetworkpolicies\n - ciliumnodes\n - ciliumnodeconfigs\n - ciliumcidrgroups\n - ciliuml2announcementpolicies\n - ciliumpodippools\n verbs:\n - list\n - watch\n- apiGroups:\n - cilium.io\n resources:\n - ciliumidentities\n - ciliumendpoints\n - ciliumnodes\n verbs:\n - create\n- apiGroups:\n - cilium.io\n # To synchronize garbage collection of such resources\n resources:\n - ciliumidentities\n verbs:\n - update\n- apiGroups:\n - cilium.io\n resources:\n - ciliumendpoints\n verbs:\n - delete\n - get\n- apiGroups:\n - cilium.io\n resources:\n - ciliumnodes\n - ciliumnodes/status\n verbs:\n - get\n - update\n- apiGroups:\n - cilium.io\n resources:\n - ciliumendpoints/status\n - ciliumendpoints\n - ciliuml2announcementpolicies/status\n - ciliumbgpnodeconfigs/status\n verbs:\n - patch\n---\n# Source: cilium/templates/cilium-operator/clusterrole.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRole\nmetadata:\n name: cilium-operator\n labels:\n app.kubernetes.io/part-of: cilium\nrules:\n- apiGroups:\n - \"\"\n resources:\n - pods\n verbs:\n - get\n - list\n - watch\n # to automatically delete [core|kube]dns pods so that are starting to being\n # managed by Cilium\n - delete\n- apiGroups:\n - \"\"\n resources:\n - configmaps\n resourceNames:\n - cilium-config\n verbs:\n # allow patching of the configmap to set annotations\n - patch\n- apiGroups:\n - \"\"\n resources:\n - nodes\n verbs:\n - list\n - watch\n- apiGroups:\n - \"\"\n resources:\n # To remove node taints\n - nodes\n # To set NetworkUnavailable false on startup\n - nodes/status\n verbs:\n - patch\n- apiGroups:\n - discovery.k8s.io\n resources:\n - endpointslices\n verbs:\n - get\n - list\n - watch\n- apiGroups:\n - \"\"\n resources:\n # to perform LB IP allocation for BGP\n - services/status\n verbs:\n - update\n - patch\n- apiGroups:\n - \"\"\n resources:\n # to check apiserver connectivity\n - namespaces\n - secrets\n verbs:\n - get\n - list\n - watch\n- apiGroups:\n - \"\"\n resources:\n # to perform the translation of a CNP that contains `ToGroup` to its endpoints\n - services\n - endpoints\n verbs:\n - get\n - list\n - watch\n- apiGroups:\n - cilium.io\n resources:\n - ciliumnetworkpolicies\n - ciliumclusterwidenetworkpolicies\n verbs:\n # Create auto-generated CNPs and CCNPs from Policies that have 'toGroups'\n - create\n - update\n - deletecollection\n # To update the status of the CNPs and CCNPs\n - patch\n - get\n - list\n - watch\n- apiGroups:\n - cilium.io\n resources:\n - ciliumnetworkpolicies/status\n - ciliumclusterwidenetworkpolicies/status\n verbs:\n # Update the auto-generated CNPs and CCNPs status.\n - patch\n - update\n- apiGroups:\n - cilium.io\n resources:\n - ciliumendpoints\n - ciliumidentities\n verbs:\n # To perform garbage collection of such resources\n - delete\n - list\n - watch\n- apiGroups:\n - cilium.io\n resources:\n - ciliumidentities\n verbs:\n # To synchronize garbage collection of such resources\n - update\n- apiGroups:\n - cilium.io\n resources:\n - ciliumnodes\n verbs:\n - create\n - update\n - get\n - list\n - watch\n # To perform CiliumNode garbage collector\n - delete\n- apiGroups:\n - cilium.io\n resources:\n - ciliumnodes/status\n verbs:\n - update\n- apiGroups:\n - cilium.io\n resources:\n - ciliumendpointslices\n - ciliumenvoyconfigs\n - ciliumbgppeerconfigs\n - ciliumbgpadvertisements\n - ciliumbgpnodeconfigs\n verbs:\n - create\n - update\n - get\n - list\n - watch\n - delete\n - patch\n- apiGroups:\n - cilium.io\n resources:\n - ciliumbgpclusterconfigs/status\n - ciliumbgppeerconfigs/status\n verbs:\n - update\n- apiGroups:\n - apiextensions.k8s.io\n resources:\n - customresourcedefinitions\n verbs:\n - create\n - get\n - list\n - watch\n- apiGroups:\n - apiextensions.k8s.io\n resources:\n - customresourcedefinitions\n verbs:\n - update\n resourceNames:\n - ciliumloadbalancerippools.cilium.io\n - ciliumbgpclusterconfigs.cilium.io\n - ciliumbgppeerconfigs.cilium.io\n - ciliumbgpadvertisements.cilium.io\n - ciliumbgpnodeconfigs.cilium.io\n - ciliumbgpnodeconfigoverrides.cilium.io\n - ciliumclusterwideenvoyconfigs.cilium.io\n - ciliumclusterwidenetworkpolicies.cilium.io\n - ciliumegressgatewaypolicies.cilium.io\n - ciliumendpoints.cilium.io\n - ciliumendpointslices.cilium.io\n - ciliumenvoyconfigs.cilium.io\n - ciliumidentities.cilium.io\n - ciliumlocalredirectpolicies.cilium.io\n - ciliumnetworkpolicies.cilium.io\n - ciliumnodes.cilium.io\n - ciliumnodeconfigs.cilium.io\n - ciliumcidrgroups.cilium.io\n - ciliuml2announcementpolicies.cilium.io\n - ciliumpodippools.cilium.io\n - ciliumgatewayclassconfigs.cilium.io\n- apiGroups:\n - cilium.io\n resources:\n - ciliumloadbalancerippools\n - ciliumpodippools\n - ciliumbgppeeringpolicies\n - ciliumbgpclusterconfigs\n - ciliumbgpnodeconfigoverrides\n - ciliumbgppeerconfigs\n verbs:\n - get\n - list\n - watch\n- apiGroups:\n - cilium.io\n resources:\n - ciliumpodippools\n verbs:\n - create\n- apiGroups:\n - cilium.io\n resources:\n - ciliumloadbalancerippools/status\n verbs:\n - patch\n# For cilium-operator running in HA mode.\n#\n# Cilium operator running in HA mode requires the use of ResourceLock for Leader Election\n# between multiple running instances.\n# The preferred way of doing this is to use LeasesResourceLock as edits to Leases are less\n# common and fewer objects in the cluster watch \"all Leases\".\n- apiGroups:\n - coordination.k8s.io\n resources:\n - leases\n verbs:\n - create\n - get\n - update\n- apiGroups:\n - cilium.io\n resources:\n - ciliumendpointslices\n verbs:\n - deletecollection\n---\n# Source: cilium/templates/hubble-ui/clusterrole.yaml\nkind: ClusterRole\napiVersion: rbac.authorization.k8s.io/v1\nmetadata:\n name: hubble-ui\n labels:\n app.kubernetes.io/part-of: cilium\n\nrules:\n- apiGroups:\n - \"\"\n resources:\n - componentstatuses\n - endpoints\n - namespaces\n - nodes\n - pods\n - services\n verbs:\n - get\n - list\n - watch\n- apiGroups:\n - apiextensions.k8s.io\n resources:\n - customresourcedefinitions\n verbs:\n - get\n - list\n - watch\n---\n# Source: cilium/templates/cilium-agent/clusterrolebinding.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRoleBinding\nmetadata:\n name: cilium\n labels:\n app.kubernetes.io/part-of: cilium\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: ClusterRole\n name: cilium\nsubjects:\n- kind: ServiceAccount\n name: \"cilium\"\n namespace: kube-system\n---\n# Source: cilium/templates/cilium-operator/clusterrolebinding.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRoleBinding\nmetadata:\n name: cilium-operator\n labels:\n app.kubernetes.io/part-of: cilium\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: ClusterRole\n name: cilium-operator\nsubjects:\n- kind: ServiceAccount\n name: \"cilium-operator\"\n namespace: kube-system\n---\n# Source: cilium/templates/hubble-ui/clusterrolebinding.yaml\nkind: ClusterRoleBinding\napiVersion: rbac.authorization.k8s.io/v1\nmetadata:\n name: hubble-ui\n labels:\n app.kubernetes.io/part-of: cilium\n\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: ClusterRole\n name: hubble-ui\nsubjects:\n- kind: ServiceAccount\n name: \"hubble-ui\"\n namespace: kube-system\n---\n# Source: cilium/templates/cilium-agent/role.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: Role\nmetadata:\n name: cilium-config-agent\n namespace: kube-system\n labels:\n app.kubernetes.io/part-of: cilium\nrules:\n- apiGroups:\n - \"\"\n resources:\n - configmaps\n verbs:\n - get\n - list\n - watch\n---\n# Source: cilium/templates/cilium-agent/role.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: Role\nmetadata:\n name: cilium-tlsinterception-secrets\n namespace: \"cilium-secrets\"\n labels:\n app.kubernetes.io/part-of: cilium\nrules:\n- apiGroups:\n - \"\"\n resources:\n - secrets\n verbs:\n - get\n - list\n - watch\n---\n# Source: cilium/templates/cilium-operator/role.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: Role\nmetadata:\n name: cilium-operator-tlsinterception-secrets\n namespace: \"cilium-secrets\"\n labels:\n app.kubernetes.io/part-of: cilium\nrules:\n- apiGroups:\n - \"\"\n resources:\n - secrets\n verbs:\n - create\n - delete\n - update\n - patch\n---\n# Source: cilium/templates/cilium-operator/role.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: Role\nmetadata:\n name: cilium-operator-ztunnel\n namespace: kube-system\n labels:\n app.kubernetes.io/part-of: cilium\nrules:\n# ZTunnel DaemonSet management permissions\n# Note: These permissions must always be granted (not conditional on encryption.type)\n# because the controller needs to clean up stale DaemonSets when ztunnel is disabled.\n- apiGroups:\n - apps\n resources:\n - daemonsets\n verbs:\n - create\n - delete\n - get\n - list\n - watch\n---\n# Source: cilium/templates/cilium-agent/rolebinding.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: RoleBinding\nmetadata:\n name: cilium-config-agent\n namespace: kube-system\n labels:\n app.kubernetes.io/part-of: cilium\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: Role\n name: cilium-config-agent\nsubjects:\n - kind: ServiceAccount\n name: \"cilium\"\n namespace: kube-system\n---\n# Source: cilium/templates/cilium-agent/rolebinding.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: RoleBinding\nmetadata:\n name: cilium-tlsinterception-secrets\n namespace: \"cilium-secrets\"\n labels:\n app.kubernetes.io/part-of: cilium\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: Role\n name: cilium-tlsinterception-secrets\nsubjects:\n- kind: ServiceAccount\n name: \"cilium\"\n namespace: kube-system\n---\n# Source: cilium/templates/cilium-operator/rolebinding.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: RoleBinding\nmetadata:\n name: cilium-operator-tlsinterception-secrets\n namespace: \"cilium-secrets\"\n labels:\n app.kubernetes.io/part-of: cilium\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: Role\n name: cilium-operator-tlsinterception-secrets\nsubjects:\n- kind: ServiceAccount\n name: \"cilium-operator\"\n namespace: kube-system\n---\n# Source: cilium/templates/cilium-operator/rolebinding.yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: RoleBinding\nmetadata:\n name: cilium-operator-ztunnel\n namespace: kube-system\n labels:\n app.kubernetes.io/part-of: cilium\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: Role\n name: cilium-operator-ztunnel\nsubjects:\n- kind: ServiceAccount\n name: \"cilium-operator\"\n namespace: kube-system\n---\n# Source: cilium/templates/cilium-envoy/service.yaml\napiVersion: v1\nkind: Service\nmetadata:\n name: cilium-envoy\n namespace: kube-system\n annotations:\n prometheus.io/scrape: \"true\"\n prometheus.io/port: \"9964\"\n labels:\n k8s-app: cilium-envoy\n app.kubernetes.io/name: cilium-envoy\n app.kubernetes.io/part-of: cilium\n io.cilium/app: proxy\nspec:\n clusterIP: None\n type: ClusterIP\n selector:\n k8s-app: cilium-envoy\n ports:\n - name: envoy-metrics\n port: 9964\n protocol: TCP\n targetPort: 9964\n---\n# Source: cilium/templates/hubble-relay/service.yaml\nkind: Service\napiVersion: v1\nmetadata:\n name: hubble-relay\n namespace: kube-system\n annotations:\n labels:\n k8s-app: hubble-relay\n app.kubernetes.io/name: hubble-relay\n app.kubernetes.io/part-of: cilium\n\nspec:\n type: \"ClusterIP\"\n selector:\n k8s-app: hubble-relay\n ports:\n - protocol: TCP\n port: 80\n targetPort: grpc\n---\n# Source: cilium/templates/hubble-ui/service.yaml\nkind: Service\napiVersion: v1\nmetadata:\n name: hubble-ui\n namespace: kube-system\n labels:\n k8s-app: hubble-ui\n app.kubernetes.io/name: hubble-ui\n app.kubernetes.io/part-of: cilium\n\nspec:\n type: \"ClusterIP\"\n selector:\n k8s-app: hubble-ui\n ports:\n - name: http\n port: 80\n targetPort: 8081\n---\n# Source: cilium/templates/hubble/peer-service.yaml\napiVersion: v1\nkind: Service\nmetadata:\n name: hubble-peer\n namespace: kube-system\n labels:\n k8s-app: cilium\n app.kubernetes.io/part-of: cilium\n app.kubernetes.io/name: hubble-peer\n\nspec:\n selector:\n k8s-app: cilium\n ports:\n - name: peer-service\n port: 443\n protocol: TCP\n targetPort: 4244\n internalTrafficPolicy: Local\n---\n# Source: cilium/templates/cilium-agent/daemonset.yaml\napiVersion: apps/v1\nkind: DaemonSet\nmetadata:\n name: cilium\n namespace: kube-system\n labels:\n k8s-app: cilium\n app.kubernetes.io/part-of: cilium\n app.kubernetes.io/name: cilium-agent\nspec:\n selector:\n matchLabels:\n k8s-app: cilium\n updateStrategy:\n rollingUpdate:\n maxUnavailable: 2\n type: RollingUpdate\n template:\n metadata:\n annotations:\n kubectl.kubernetes.io/default-container: cilium-agent\n labels:\n k8s-app: cilium\n app.kubernetes.io/name: cilium-agent\n app.kubernetes.io/part-of: cilium\n spec:\n securityContext:\n seccompProfile:\n type: Unconfined\n containers:\n - name: cilium-agent\n image: \"quay.io/cilium/cilium:v1.19.6@sha256:0df5b2750b64c49843aba1d649e9eaf61467cb0645ad3171db6f6962c095ac92\"\n imagePullPolicy: IfNotPresent\n command:\n - cilium-agent\n args:\n - --config-dir=/tmp/cilium/config-map\n startupProbe:\n httpGet:\n host: \"127.0.0.1\"\n path: /healthz\n port: health\n scheme: HTTP\n httpHeaders:\n - name: \"brief\"\n value: \"true\"\n failureThreshold: 300\n periodSeconds: 2\n successThreshold: 1\n initialDelaySeconds: 5\n livenessProbe:\n httpGet:\n host: \"127.0.0.1\"\n path: /healthz\n port: health\n scheme: HTTP\n httpHeaders:\n - name: \"brief\"\n value: \"true\"\n - name: \"require-k8s-connectivity\"\n value: \"false\"\n periodSeconds: 30\n successThreshold: 1\n failureThreshold: 10\n timeoutSeconds: 5\n readinessProbe:\n httpGet:\n host: \"127.0.0.1\"\n path: /healthz\n port: health\n scheme: HTTP\n httpHeaders:\n - name: \"brief\"\n value: \"true\"\n periodSeconds: 30\n successThreshold: 1\n failureThreshold: 3\n timeoutSeconds: 5\n env:\n - name: K8S_NODE_NAME\n valueFrom:\n fieldRef:\n apiVersion: v1\n fieldPath: spec.nodeName\n - name: CILIUM_K8S_NAMESPACE\n valueFrom:\n fieldRef:\n apiVersion: v1\n fieldPath: metadata.namespace\n - name: CILIUM_CLUSTERMESH_CONFIG\n value: /var/lib/cilium/clustermesh/\n - name: GOMEMLIMIT\n valueFrom:\n resourceFieldRef:\n resource: limits.memory\n divisor: '1'\n - name: KUBERNETES_SERVICE_HOST\n value: \"localhost\"\n - name: KUBERNETES_SERVICE_PORT\n value: \"7445\"\n - name: KUBE_CLIENT_BACKOFF_BASE\n value: \"1\"\n - name: KUBE_CLIENT_BACKOFF_DURATION\n value: \"120\"\n lifecycle:\n postStart:\n exec:\n command:\n - \"bash\"\n - \"-c\"\n - |\n set -o errexit\n set -o pipefail\n set -o nounset\n \n # When running in AWS ENI mode, it's likely that 'aws-node' has\n # had a chance to install SNAT iptables rules. These can result\n # in dropped traffic, so we should attempt to remove them.\n # We do it using a 'postStart' hook since this may need to run\n # for nodes which might have already been init'ed but may still\n # have dangling rules. This is safe because there are no\n # dependencies on anything that is part of the startup script\n # itself, and can be safely run multiple times per node (e.g. in\n # case of a restart).\n if [[ \"$(iptables-save | grep -E -c 'AWS-SNAT-CHAIN|AWS-CONNMARK-CHAIN')\" != \"0\" ]];\n then\n echo 'Deleting iptables rules created by the AWS CNI VPC plugin'\n iptables-save | grep -E -v 'AWS-SNAT-CHAIN|AWS-CONNMARK-CHAIN' | iptables-restore\n fi\n echo 'Done!'\n \n preStop:\n exec:\n command:\n - /cni-uninstall.sh\n ports:\n - name: health\n containerPort: 9879\n hostPort: 9879\n protocol: TCP\n - name: peer-service\n containerPort: 4244\n hostPort: 4244\n protocol: TCP\n securityContext:\n privileged: true\n terminationMessagePolicy: FallbackToLogsOnError\n volumeMounts:\n - name: envoy-sockets\n mountPath: /var/run/cilium/envoy/sockets\n readOnly: false\n - name: bpf-maps\n mountPath: /sys/fs/bpf\n mountPropagation: Bidirectional\n - name: cilium-run\n mountPath: /var/run/cilium\n - name: cilium-netns\n mountPath: /var/run/cilium/netns\n mountPropagation: HostToContainer\n - name: etc-cni-netd\n mountPath: /host/etc/cni/net.d\n - name: clustermesh-secrets\n mountPath: /var/lib/cilium/clustermesh\n readOnly: true\n # Needed to be able to load kernel modules\n - name: lib-modules\n mountPath: /lib/modules\n readOnly: true\n - name: xtables-lock\n mountPath: /run/xtables.lock\n - name: hubble-tls\n mountPath: /var/lib/cilium/tls/hubble\n readOnly: true\n - name: tmp\n mountPath: /tmp\n \n initContainers:\n - name: config\n image: \"quay.io/cilium/cilium:v1.19.6@sha256:0df5b2750b64c49843aba1d649e9eaf61467cb0645ad3171db6f6962c095ac92\"\n imagePullPolicy: IfNotPresent\n command:\n - cilium-dbg\n - build-config\n env:\n - name: K8S_NODE_NAME\n valueFrom:\n fieldRef:\n apiVersion: v1\n fieldPath: spec.nodeName\n - name: CILIUM_K8S_NAMESPACE\n valueFrom:\n fieldRef:\n apiVersion: v1\n fieldPath: metadata.namespace\n - name: KUBERNETES_SERVICE_HOST\n value: \"localhost\"\n - name: KUBERNETES_SERVICE_PORT\n value: \"7445\"\n volumeMounts:\n - name: tmp\n mountPath: /tmp\n terminationMessagePolicy: FallbackToLogsOnError\n securityContext:\n privileged: true\n # Required to mount cgroup2 filesystem on the underlying Kubernetes node.\n # We use nsenter command with host's cgroup and mount namespaces enabled.\n - name: mount-cgroup\n image: \"quay.io/cilium/cilium:v1.19.6@sha256:0df5b2750b64c49843aba1d649e9eaf61467cb0645ad3171db6f6962c095ac92\"\n imagePullPolicy: IfNotPresent\n env:\n - name: CGROUP_ROOT\n value: /run/cilium/cgroupv2\n - name: BIN_PATH\n value: /opt/cni/bin\n command:\n - bash\n - -ec\n # The statically linked Go program binary is invoked to avoid any\n # dependency on utilities like sh and mount that can be missing on certain\n # distros installed on the underlying host. Copy the binary to the\n # same directory where we install cilium cni plugin so that exec permissions\n # are available.\n - |\n cp /usr/bin/cilium-mount /hostbin/cilium-mount;\n nsenter --cgroup=/hostproc/1/ns/cgroup --mount=/hostproc/1/ns/mnt \"${BIN_PATH}/cilium-mount\" $CGROUP_ROOT;\n rm /hostbin/cilium-mount\n volumeMounts:\n - name: hostproc\n mountPath: /hostproc\n - name: cni-path\n mountPath: /hostbin\n terminationMessagePolicy: FallbackToLogsOnError\n securityContext:\n privileged: true\n - name: apply-sysctl-overwrites\n image: \"quay.io/cilium/cilium:v1.19.6@sha256:0df5b2750b64c49843aba1d649e9eaf61467cb0645ad3171db6f6962c095ac92\"\n imagePullPolicy: IfNotPresent\n env:\n - name: BIN_PATH\n value: /opt/cni/bin\n command:\n - bash\n - -ec\n # The statically linked Go program binary is invoked to avoid any\n # dependency on utilities like sh that can be missing on certain\n # distros installed on the underlying host. Copy the binary to the\n # same directory where we install cilium cni plugin so that exec permissions\n # are available.\n - |\n cp /usr/bin/cilium-sysctlfix /hostbin/cilium-sysctlfix;\n nsenter --mount=/hostproc/1/ns/mnt \"${BIN_PATH}/cilium-sysctlfix\";\n rm /hostbin/cilium-sysctlfix\n volumeMounts:\n - name: hostproc\n mountPath: /hostproc\n - name: cni-path\n mountPath: /hostbin\n terminationMessagePolicy: FallbackToLogsOnError\n securityContext:\n privileged: true\n - name: clean-cilium-state\n image: \"quay.io/cilium/cilium:v1.19.6@sha256:0df5b2750b64c49843aba1d649e9eaf61467cb0645ad3171db6f6962c095ac92\"\n imagePullPolicy: IfNotPresent\n command:\n - /init-container.sh\n env:\n - name: CILIUM_ALL_STATE\n valueFrom:\n configMapKeyRef:\n name: cilium-config\n key: clean-cilium-state\n optional: true\n - name: CILIUM_BPF_STATE\n valueFrom:\n configMapKeyRef:\n name: cilium-config\n key: clean-cilium-bpf-state\n optional: true\n - name: WRITE_CNI_CONF_WHEN_READY\n valueFrom:\n configMapKeyRef:\n name: cilium-config\n key: write-cni-conf-when-ready\n optional: true\n - name: KUBERNETES_SERVICE_HOST\n value: \"localhost\"\n - name: KUBERNETES_SERVICE_PORT\n value: \"7445\"\n terminationMessagePolicy: FallbackToLogsOnError\n securityContext:\n privileged: true\n volumeMounts:\n - name: bpf-maps\n mountPath: /sys/fs/bpf\n # Required to mount cgroup filesystem from the host to cilium agent pod\n - name: cilium-cgroup\n mountPath: /run/cilium/cgroupv2\n mountPropagation: HostToContainer\n - name: cilium-run\n mountPath: /var/run/cilium # wait-for-kube-proxy\n # Install the CNI binaries in an InitContainer so we don't have a writable host mount in the agent\n - name: install-cni-binaries\n image: \"quay.io/cilium/cilium:v1.19.6@sha256:0df5b2750b64c49843aba1d649e9eaf61467cb0645ad3171db6f6962c095ac92\"\n imagePullPolicy: IfNotPresent\n command:\n - \"/install-plugin.sh\"\n resources:\n limits:\n cpu: 1\n memory: 1Gi\n requests:\n cpu: 100m\n memory: 10Mi\n securityContext:\n privileged: true\n capabilities:\n drop:\n - ALL\n terminationMessagePolicy: FallbackToLogsOnError\n volumeMounts:\n - name: cni-path\n mountPath: /host/opt/cni/bin # .Values.cni.install\n restartPolicy: Always\n priorityClassName: system-node-critical\n serviceAccountName: \"cilium\"\n automountServiceAccountToken: true\n terminationGracePeriodSeconds: 1\n hostNetwork: true\n \n affinity:\n podAntiAffinity:\n requiredDuringSchedulingIgnoredDuringExecution:\n - labelSelector:\n matchLabels:\n k8s-app: cilium\n topologyKey: kubernetes.io/hostname\n nodeSelector:\n kubernetes.io/os: linux\n tolerations:\n - operator: Exists\n volumes:\n # For sharing configuration between the \"config\" initContainer and the agent\n - name: tmp\n emptyDir: {}\n # To keep state between restarts / upgrades\n - name: cilium-run\n hostPath:\n path: /var/run/cilium\n type: DirectoryOrCreate\n # To exec into pod network namespaces\n - name: cilium-netns\n hostPath:\n path: /var/run/netns\n type: DirectoryOrCreate\n # To keep state between restarts / upgrades for bpf maps\n - name: bpf-maps\n hostPath:\n path: /sys/fs/bpf\n type: DirectoryOrCreate\n # To mount cgroup2 filesystem on the host or apply sysctlfix\n - name: hostproc\n hostPath:\n path: /proc\n type: Directory\n # To keep state between restarts / upgrades for cgroup2 filesystem\n - name: cilium-cgroup\n hostPath:\n path: /run/cilium/cgroupv2\n type: DirectoryOrCreate\n # To install cilium cni plugin in the host\n - name: cni-path\n hostPath:\n path: /opt/cni/bin\n type: DirectoryOrCreate\n # To install cilium cni configuration in the host\n - name: etc-cni-netd\n hostPath:\n path: /etc/cni/net.d\n type: DirectoryOrCreate\n # To be able to load kernel modules\n - name: lib-modules\n hostPath:\n path: /lib/modules\n # To access iptables concurrently with other processes (e.g. kube-proxy)\n - name: xtables-lock\n hostPath:\n path: /run/xtables.lock\n type: FileOrCreate\n # Sharing socket with Cilium Envoy on the same node by using a host path\n - name: envoy-sockets\n hostPath:\n path: \"/var/run/cilium/envoy/sockets\"\n type: DirectoryOrCreate\n # To read the clustermesh configuration\n - name: clustermesh-secrets\n projected:\n # note: the leading zero means this number is in octal representation: do not remove it\n defaultMode: 0400\n sources:\n - secret:\n name: cilium-clustermesh\n optional: true\n # note: items are not explicitly listed here, since the entries of this secret\n # depend on the peers configured, and that would cause a restart of all agents\n # at every addition/removal. Leaving the field empty makes each secret entry\n # to be automatically projected into the volume as a file whose name is the key.\n - secret:\n name: clustermesh-apiserver-remote-cert\n optional: true\n items:\n - key: tls.key\n path: common-etcd-client.key\n - key: tls.crt\n path: common-etcd-client.crt\n - key: ca.crt\n path: common-etcd-client-ca.crt\n # note: we configure the volume for the kvstoremesh-specific certificate\n # regardless of whether KVStoreMesh is enabled or not, so that it can be\n # automatically mounted in case KVStoreMesh gets subsequently enabled,\n # without requiring an agent restart.\n - secret:\n name: clustermesh-apiserver-local-cert\n optional: true\n items:\n - key: tls.key\n path: local-etcd-client.key\n - key: tls.crt\n path: local-etcd-client.crt\n - key: ca.crt\n path: local-etcd-client-ca.crt\n - name: hubble-tls\n projected:\n # note: the leading zero means this number is in octal representation: do not remove it\n defaultMode: 0400\n sources:\n - secret:\n name: hubble-server-certs\n optional: true\n items:\n - key: tls.crt\n path: server.crt\n - key: tls.key\n path: server.key\n - key: ca.crt\n path: client-ca.crt\n---\n# Source: cilium/templates/cilium-envoy/daemonset.yaml\napiVersion: apps/v1\nkind: DaemonSet\nmetadata:\n name: cilium-envoy\n namespace: kube-system\n labels:\n k8s-app: cilium-envoy\n app.kubernetes.io/part-of: cilium\n app.kubernetes.io/name: cilium-envoy\n name: cilium-envoy\nspec:\n selector:\n matchLabels:\n k8s-app: cilium-envoy\n \n updateStrategy:\n rollingUpdate:\n maxUnavailable: 2\n type: RollingUpdate\n template:\n metadata:\n annotations:\n # Set app AppArmor's profile to \"unconfined\". The value of this annotation\n # can be modified as long users know which profiles they have available\n # in AppArmor.\n container.apparmor.security.beta.kubernetes.io/cilium-envoy: \"unconfined\"\n labels:\n k8s-app: cilium-envoy\n name: cilium-envoy\n app.kubernetes.io/name: cilium-envoy\n app.kubernetes.io/part-of: cilium\n spec:\n \n containers:\n - name: cilium-envoy\n image: \"quay.io/cilium/cilium-envoy:v1.36.9-1782267392-edeb3f2af56c37c407efa1f63f0b32f595399bbc@sha256:767101fb8a5e38f055778cb43b7aa8eed80450b37f8121effac3d9de9e06dc99\"\n imagePullPolicy: IfNotPresent\n command:\n - /usr/bin/cilium-envoy-starter\n args:\n - '--'\n - '-c /var/run/cilium/envoy/bootstrap-config.json'\n - '--base-id 0'\n - '--log-level info'\n \n startupProbe:\n httpGet:\n host: \"127.0.0.1\"\n path: /healthz\n port: 9878\n scheme: HTTP\n failureThreshold: 105\n periodSeconds: 2\n successThreshold: 1\n initialDelaySeconds: 5\n livenessProbe:\n httpGet:\n host: \"127.0.0.1\"\n path: /healthz\n port: 9878\n scheme: HTTP\n periodSeconds: 30\n successThreshold: 1\n failureThreshold: 10\n timeoutSeconds: 5\n readinessProbe:\n httpGet:\n host: \"127.0.0.1\"\n path: /healthz\n port: 9878\n scheme: HTTP\n periodSeconds: 30\n successThreshold: 1\n failureThreshold: 3\n timeoutSeconds: 5\n env:\n - name: K8S_NODE_NAME\n valueFrom:\n fieldRef:\n apiVersion: v1\n fieldPath: spec.nodeName\n - name: CILIUM_K8S_NAMESPACE\n valueFrom:\n fieldRef:\n apiVersion: v1\n fieldPath: metadata.namespace\n - name: KUBERNETES_SERVICE_HOST\n value: \"localhost\"\n - name: KUBERNETES_SERVICE_PORT\n value: \"7445\"\n \n ports:\n - name: envoy-metrics\n containerPort: 9964\n hostPort: 9964\n protocol: TCP\n securityContext:\n seLinuxOptions:\n level: s0\n type: spc_t\n capabilities:\n add:\n - NET_ADMIN\n - SYS_ADMIN\n drop:\n - ALL\n terminationMessagePolicy: FallbackToLogsOnError\n volumeMounts:\n - name: envoy-sockets\n mountPath: /var/run/cilium/envoy/sockets\n readOnly: false\n - name: envoy-artifacts\n mountPath: /var/run/cilium/envoy/artifacts\n readOnly: true\n - name: envoy-config\n mountPath: /var/run/cilium/envoy/\n readOnly: true\n - name: bpf-maps\n mountPath: /sys/fs/bpf\n mountPropagation: HostToContainer\n \n restartPolicy: Always\n priorityClassName: system-node-critical\n serviceAccountName: \"cilium-envoy\"\n automountServiceAccountToken: true\n terminationGracePeriodSeconds: 1\n hostNetwork: true\n \n affinity:\n nodeAffinity:\n requiredDuringSchedulingIgnoredDuringExecution:\n nodeSelectorTerms:\n - matchExpressions:\n - key: cilium.io/no-schedule\n operator: NotIn\n values:\n - \"true\"\n podAffinity:\n requiredDuringSchedulingIgnoredDuringExecution:\n - labelSelector:\n matchLabels:\n k8s-app: cilium\n topologyKey: kubernetes.io/hostname\n podAntiAffinity:\n requiredDuringSchedulingIgnoredDuringExecution:\n - labelSelector:\n matchLabels:\n k8s-app: cilium-envoy\n topologyKey: kubernetes.io/hostname\n nodeSelector:\n kubernetes.io/os: linux\n tolerations:\n - operator: Exists\n volumes:\n - name: envoy-sockets\n hostPath:\n path: \"/var/run/cilium/envoy/sockets\"\n type: DirectoryOrCreate\n - name: envoy-artifacts\n hostPath:\n path: \"/var/run/cilium/envoy/artifacts\"\n type: DirectoryOrCreate\n - name: envoy-config\n configMap:\n name: \"cilium-envoy-config\"\n # note: the leading zero means this number is in octal representation: do not remove it\n defaultMode: 0400\n items:\n - key: bootstrap-config.json\n path: bootstrap-config.json\n # To keep state between restarts / upgrades\n # To keep state between restarts / upgrades for bpf maps\n - name: bpf-maps\n hostPath:\n path: /sys/fs/bpf\n type: DirectoryOrCreate\n---\n# Source: cilium/templates/cilium-operator/deployment.yaml\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: cilium-operator\n namespace: kube-system\n labels:\n io.cilium/app: operator\n name: cilium-operator\n app.kubernetes.io/part-of: cilium\n app.kubernetes.io/name: cilium-operator\nspec:\n # See docs on ServerCapabilities.LeasesResourceLock in file pkg/k8s/version/version.go\n # for more details.\n replicas: 2\n selector:\n matchLabels:\n io.cilium/app: operator\n name: cilium-operator\n # ensure operator update on single node k8s clusters, by using rolling update with maxUnavailable=100% in case\n # of one replica and no user configured Recreate strategy.\n # otherwise an update might get stuck due to the default maxUnavailable=50% in combination with the\n # podAntiAffinity which prevents deployments of multiple operator replicas on the same node.\n strategy:\n rollingUpdate:\n maxSurge: 25%\n maxUnavailable: 50%\n type: RollingUpdate\n template:\n metadata:\n annotations:\n prometheus.io/port: \"9963\"\n prometheus.io/scrape: \"true\"\n labels:\n io.cilium/app: operator\n name: cilium-operator\n app.kubernetes.io/part-of: cilium\n app.kubernetes.io/name: cilium-operator\n spec:\n securityContext:\n seccompProfile:\n type: RuntimeDefault\n containers:\n - name: cilium-operator\n image: \"quay.io/cilium/operator-generic:v1.19.6@sha256:0db4ca4e06969d8904ee036617795d0e9c3228cf7b8d902ba74fc2bb98d2d665\"\n imagePullPolicy: IfNotPresent\n command:\n - cilium-operator-generic\n args:\n - --config-dir=/tmp/cilium/config-map\n - --debug=$(CILIUM_DEBUG)\n env:\n - name: K8S_NODE_NAME\n valueFrom:\n fieldRef:\n apiVersion: v1\n fieldPath: spec.nodeName\n - name: CILIUM_K8S_NAMESPACE\n valueFrom:\n fieldRef:\n apiVersion: v1\n fieldPath: metadata.namespace\n - name: CILIUM_DEBUG\n valueFrom:\n configMapKeyRef:\n key: debug\n name: cilium-config\n optional: true\n - name: KUBERNETES_SERVICE_HOST\n value: \"localhost\"\n - name: KUBERNETES_SERVICE_PORT\n value: \"7445\"\n ports:\n - name: health\n containerPort: 9234\n hostPort: 9234\n - name: prometheus\n containerPort: 9963\n hostPort: 9963\n protocol: TCP\n livenessProbe:\n httpGet:\n host: \"127.0.0.1\"\n path: /healthz\n port: health\n scheme: HTTP\n initialDelaySeconds: 60\n periodSeconds: 10\n timeoutSeconds: 3\n readinessProbe:\n httpGet:\n host: \"127.0.0.1\"\n path: /healthz\n port: health\n scheme: HTTP\n initialDelaySeconds: 0\n periodSeconds: 5\n timeoutSeconds: 3\n failureThreshold: 5\n volumeMounts:\n - name: cilium-config-path\n mountPath: /tmp/cilium/config-map\n readOnly: true\n \n securityContext:\n allowPrivilegeEscalation: false\n capabilities:\n drop:\n - ALL\n terminationMessagePolicy: FallbackToLogsOnError\n hostNetwork: true\n restartPolicy: Always\n priorityClassName: system-cluster-critical\n serviceAccountName: \"cilium-operator\"\n automountServiceAccountToken: true\n # In HA mode, cilium-operator pods must not be scheduled on the same\n # node as they will clash with each other.\n affinity:\n podAntiAffinity:\n requiredDuringSchedulingIgnoredDuringExecution:\n - labelSelector:\n matchLabels:\n io.cilium/app: operator\n topologyKey: kubernetes.io/hostname\n nodeSelector:\n kubernetes.io/os: linux\n tolerations:\n - key: node-role.kubernetes.io/control-plane\n operator: Exists\n - key: node-role.kubernetes.io/master\n operator: Exists\n - key: node.kubernetes.io/not-ready\n operator: Exists\n - key: node.cloudprovider.kubernetes.io/uninitialized\n operator: Exists\n - key: node.cilium.io/agent-not-ready\n operator: Exists\n \n volumes:\n # To read the configuration from the config map\n - name: cilium-config-path\n configMap:\n name: cilium-config\n---\n# Source: cilium/templates/hubble-relay/deployment.yaml\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: hubble-relay\n namespace: kube-system\n labels:\n k8s-app: hubble-relay\n app.kubernetes.io/name: hubble-relay\n app.kubernetes.io/part-of: cilium\n\nspec:\n replicas: 1\n selector:\n matchLabels:\n k8s-app: hubble-relay\n strategy:\n rollingUpdate:\n maxUnavailable: 1\n type: RollingUpdate\n template:\n metadata:\n annotations:\n labels:\n k8s-app: hubble-relay\n app.kubernetes.io/name: hubble-relay\n app.kubernetes.io/part-of: cilium\n spec:\n securityContext:\n fsGroup: 65532\n seccompProfile:\n type: RuntimeDefault\n containers:\n - name: hubble-relay\n securityContext:\n allowPrivilegeEscalation: false\n capabilities:\n drop:\n - ALL\n runAsGroup: 65532\n runAsNonRoot: true\n runAsUser: 65532\n seccompProfile:\n type: RuntimeDefault\n image: \"quay.io/cilium/hubble-relay:v1.19.6@sha256:6782a49e3f28eba015701c4410a5ec7fa096fe9a562f879b4372dbecd827ea44\"\n imagePullPolicy: IfNotPresent\n command:\n - hubble-relay\n args:\n - serve\n ports:\n - name: grpc\n containerPort: 4245\n readinessProbe:\n grpc:\n port: 4222\n timeoutSeconds: 3\n # livenessProbe will kill the pod, we should be very conservative\n # here on failures since killing the pod should be a last resort, and\n # we should provide enough time for relay to retry before killing it.\n livenessProbe:\n grpc:\n port: 4222\n timeoutSeconds: 10\n # Give relay time to establish connections and make a few retries\n # before starting livenessProbes.\n initialDelaySeconds: 10\n # 10 second * 12 failures = 2 minutes of failure.\n # If relay cannot become healthy after 2 minutes, then killing it\n # might resolve whatever issue is occurring.\n #\n # 10 seconds is a reasonable retry period so we can see if it's\n # failing regularly or only sporadically.\n periodSeconds: 10\n failureThreshold: 12\n startupProbe:\n grpc:\n port: 4222\n # Give relay time to get it's certs and establish connections and\n # make a few retries before starting startupProbes.\n initialDelaySeconds: 10\n # 20 * 3 seconds = 1 minute of failure before we consider startup as failed.\n failureThreshold: 20\n # Retry more frequently at startup so that it can be considered started more quickly.\n periodSeconds: 3\n volumeMounts:\n - name: config\n mountPath: /etc/hubble-relay\n readOnly: true\n - name: tls\n mountPath: /var/lib/hubble-relay/tls\n readOnly: true\n terminationMessagePolicy: FallbackToLogsOnError\n \n restartPolicy: Always\n priorityClassName: \n serviceAccountName: \"hubble-relay\"\n automountServiceAccountToken: false\n terminationGracePeriodSeconds: 1\n affinity:\n podAffinity:\n requiredDuringSchedulingIgnoredDuringExecution:\n - labelSelector:\n matchLabels:\n k8s-app: cilium\n topologyKey: kubernetes.io/hostname\n nodeSelector:\n kubernetes.io/os: linux\n volumes:\n - name: config\n configMap:\n name: hubble-relay-config\n items:\n - key: config.yaml\n path: config.yaml\n - name: tls\n projected:\n # note: the leading zero means this number is in octal representation: do not remove it\n defaultMode: 0400\n sources:\n - secret:\n name: hubble-relay-client-certs\n items:\n - key: tls.crt\n path: client.crt\n - key: tls.key\n path: client.key\n - key: ca.crt\n path: hubble-server-ca.crt\n---\n# Source: cilium/templates/hubble-ui/deployment.yaml\nkind: Deployment\napiVersion: apps/v1\nmetadata:\n name: hubble-ui\n namespace: kube-system\n labels:\n k8s-app: hubble-ui\n app.kubernetes.io/name: hubble-ui\n app.kubernetes.io/part-of: cilium\nspec:\n replicas: 1\n selector:\n matchLabels:\n k8s-app: hubble-ui\n strategy:\n rollingUpdate:\n maxUnavailable: 1\n type: RollingUpdate\n template:\n metadata:\n annotations:\n labels:\n k8s-app: hubble-ui\n app.kubernetes.io/name: hubble-ui\n app.kubernetes.io/part-of: cilium\n spec:\n securityContext:\n fsGroup: 1001\n runAsGroup: 1001\n runAsUser: 1001\n priorityClassName: \n serviceAccountName: \"hubble-ui\"\n automountServiceAccountToken: true\n containers:\n - name: frontend\n image: \"quay.io/cilium/hubble-ui:v0.13.5@sha256:f7d514fc54d784ed6df9d58cf0e97648b143f92b766dd1780ed3fc845bd4c516\"\n imagePullPolicy: IfNotPresent\n ports:\n - name: http\n containerPort: 8081\n livenessProbe:\n httpGet:\n path: /healthz\n port: http\n readinessProbe:\n httpGet:\n path: /\n port: http\n volumeMounts:\n - name: hubble-ui-nginx-conf\n mountPath: /etc/nginx/conf.d/default.conf\n subPath: nginx.conf\n - name: tmp-dir\n mountPath: /tmp\n terminationMessagePolicy: FallbackToLogsOnError\n securityContext:\n allowPrivilegeEscalation: false\n - name: backend\n image: \"quay.io/cilium/hubble-ui-backend:v0.13.5@sha256:fac0c300ae119274edca11fd89b1ad23c788792d8bc4ea2ba631c709e8d3c688\"\n imagePullPolicy: IfNotPresent\n env:\n - name: EVENTS_SERVER_PORT\n value: \"8090\"\n - name: FLOWS_API_ADDR\n value: \"hubble-relay:80\"\n ports:\n - name: grpc\n containerPort: 8090\n volumeMounts:\n terminationMessagePolicy: FallbackToLogsOnError\n securityContext:\n allowPrivilegeEscalation: false\n nodeSelector:\n kubernetes.io/os: linux\n volumes:\n - configMap:\n defaultMode: 420\n name: hubble-ui-nginx\n name: hubble-ui-nginx-conf\n - name: tmp-dir\n emptyDir: {}\n" diff --git a/omni/scripts/generate-manifests.sh b/omni/scripts/generate-manifests.sh index ef5d689..4cf3133 100755 --- a/omni/scripts/generate-manifests.sh +++ b/omni/scripts/generate-manifests.sh @@ -32,7 +32,7 @@ case "$CLUSTER" in unraid-lab) FILE="clusters/unraid-lab/omni/inline-manifests.yaml" WITH_ARGOCD=1 - WITH_CILIUM=0 + WITH_CILIUM=1 ARGOCD_VERSION="${ARGOCD_VERSION:-v3.5.2}" ;; *)