vrr/cozystack
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chore(cilium): bump to v1.19.3 (#2464)

Browse source 
## What this PR does

Refreshes the vendored Cilium chart in `packages/system/cilium` from
v1.19.1 to v1.19.3 via `make update`. Chart templates, values, CRDs and
the Cilium image reference are regenerated from upstream.

### Motivation

- **v1.19.2** ships a critical fix for cert-manager HTTP-01 Gateway API
challenges on hostnames that have both HTTP and HTTPS listeners
([cilium#44492](https://github.com/cilium/cilium/pull/44492), backport
[#44517](https://github.com/cilium/cilium/pull/44517)). Without this
fix, cert-manager cannot issue certificates via Gateway API when a
redirect HTTP listener and a TLS HTTPS listener share a hostname.
- **v1.19.3** is the latest stable patch release in the v1.19.x line (15
Apr 2026).
- This bump is a prerequisite for upcoming Gateway API work tracked
separately.

### Upstream changes pulled in

- Cilium Envoy bootstrap config, operator clusterrole, config template,
`values.schema.json` and the cilium-agent DaemonSet refreshed from
upstream.
- New `templates/ztunnel/` directory (DaemonSet, Secret, ServiceAccount)
added by upstream — not enabled by default in Cozystack values.

### Release note

```release-note
chore(cilium): bump to v1.19.3 (cert-manager HTTP-01 fix via cilium#44492)
```


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added ztunnel encryption support with configurable deployment settings
  * Added ConfigDriftDetection for monitoring ConfigMap changes
  * Added endpoint policy update timeout configuration
  * Added load balancer service topology support
* Extended Envoy circuit breaker configuration with connection and
request limits

* **Updates**
  * Upgraded Cilium to v1.19.3
  * Updated container images (Envoy, certgen, Hubble relay, clustermesh)
* Enhanced Cilium operator RBAC capabilities for managing ServiceImport
finalizers

* **Removals**
  * Removed BIG TCP tunnel configuration option

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This commit is contained in:
Aleksei Sviridkin 2026-04-24 06:42:47 +03:00 • committed by GitHub
commit ad7d25f486
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
14 changed files with 728 additions and 57 deletions
Download patch file Download diff file Expand all files Collapse all files

4
packages/system/cilium/charts/cilium/Chart.yaml
View file

@ -76,7 +76,7 @@ annotations:
Cilium Gateway Class Config\n description: |\n CiliumGatewayClassConfig defines
a configuration for Gateway API GatewayClass.\n"
apiVersion: v2
appVersion: 1.19.1
appVersion: 1.19.3
description: eBPF-based Networking, Security, and Observability
home: https://cilium.io/
icon: https://cdn.jsdelivr.net/gh/cilium/cilium@main/Documentation/images/logo-solo.svg
@ -92,4 +92,4 @@ kubeVersion: '>= 1.21.0-0'
name: cilium
sources:
- https://github.com/cilium/cilium
version: 1.19.1
version: 1.19.3

50
packages/system/cilium/charts/cilium/README.md
View file

@ -1,6 +1,6 @@
# cilium
![Version: 1.19.1](https://img.shields.io/badge/Version-1.19.1-informational?style=flat-square) ![AppVersion: 1.19.1](https://img.shields.io/badge/AppVersion-1.19.1-informational?style=flat-square)
![Version: 1.19.3](https://img.shields.io/badge/Version-1.19.3-informational?style=flat-square) ![AppVersion: 1.19.3](https://img.shields.io/badge/AppVersion-1.19.3-informational?style=flat-square)
Cilium is open source software for providing and transparently securing
network connectivity and loadbalancing between application workloads such as
@ -89,7 +89,7 @@ contributors across the globe, there is almost always someone available to help.
| authentication.mutual.spire.install.agent.tolerations | list | `[{"effect":"NoSchedule","key":"node.kubernetes.io/not-ready"},{"effect":"NoSchedule","key":"node-role.kubernetes.io/master"},{"effect":"NoSchedule","key":"node-role.kubernetes.io/control-plane"},{"effect":"NoSchedule","key":"node.cloudprovider.kubernetes.io/uninitialized","value":"true"},{"key":"CriticalAddonsOnly","operator":"Exists"}]` | SPIRE agent tolerations configuration By default it follows the same tolerations as the agent itself to allow the Cilium agent on this node to connect to SPIRE. ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ |
| authentication.mutual.spire.install.enabled | bool | `true` | Enable SPIRE installation. This will only take effect only if authentication.mutual.spire.enabled is true |
| authentication.mutual.spire.install.existingNamespace | bool | `false` | SPIRE namespace already exists. Set to true if Helm should not create, manage, and import the SPIRE namespace. |
| authentication.mutual.spire.install.initImage | object | `{"digest":"sha256:b3255e7dfbcd10cb367af0d409747d511aeb66dfac98cf30e97e87e4207dd76f","override":null,"pullPolicy":"IfNotPresent","repository":"docker.io/library/busybox","tag":"1.37.0","useDigest":true}` | init container image of SPIRE agent and server |
| authentication.mutual.spire.install.initImage | object | `{"digest":"sha256:1487d0af5f52b4ba31c7e465126ee2123fe3f2305d638e7827681e7cf6c83d5e","override":null,"pullPolicy":"IfNotPresent","repository":"docker.io/library/busybox","tag":"1.37.0","useDigest":true}` | init container image of SPIRE agent and server |
| authentication.mutual.spire.install.namespace | string | `"cilium-spire"` | SPIRE namespace to install into |
| authentication.mutual.spire.install.server.affinity | object | `{}` | SPIRE server affinity configuration |
| authentication.mutual.spire.install.server.annotations | object | `{}` | SPIRE server annotations |
@ -175,7 +175,7 @@ contributors across the globe, there is almost always someone available to help.
| bpf.tproxy | bool | `false` | Configure the eBPF-based TPROXY (beta) to reduce reliance on iptables rules for implementing Layer 7 policy. Note this is incompatible with netkit (`bpf.datapathMode=netkit`, `bpf.datapathMode=netkit-l2`). |
| bpf.vlanBypass | list | `[]` | Configure explicitly allowed VLAN id's for bpf logic bypass. [0] will allow all VLAN id's without any filtering. |
| bpfClockProbe | bool | `false` | Enable BPF clock source probing for more efficient tick retrieval. |
| certgen | object | `{"affinity":{},"annotations":{"cronJob":{},"job":{}},"cronJob":{"failedJobsHistoryLimit":1,"successfulJobsHistoryLimit":3},"extraVolumeMounts":[],"extraVolumes":[],"generateCA":true,"image":{"digest":"sha256:19921f48ee7e2295ea4dca955878a6cd8d70e6d4219d08f688e866ece9d95d4d","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/certgen","tag":"v0.3.2","useDigest":true},"nodeSelector":{},"podLabels":{},"priorityClassName":"","resources":{},"tolerations":[],"ttlSecondsAfterFinished":null}` | Configure certificate generation for Hubble integration. If hubble.tls.auto.method=cronJob, these values are used for the Kubernetes CronJob which will be scheduled regularly to (re)generate any certificates not provided manually. |
| certgen | object | `{"affinity":{},"annotations":{"cronJob":{},"job":{}},"cronJob":{"failedJobsHistoryLimit":1,"successfulJobsHistoryLimit":3},"extraVolumeMounts":[],"extraVolumes":[],"generateCA":true,"image":{"digest":"sha256:f0c656830e856d26b24b0e144df1f8b327d3b46748d76a630514111fc365b697","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/certgen","tag":"v0.4.1","useDigest":true},"nodeSelector":{},"podLabels":{},"priorityClassName":"","resources":{},"tolerations":[],"ttlSecondsAfterFinished":null}` | Configure certificate generation for Hubble integration. If hubble.tls.auto.method=cronJob, these values are used for the Kubernetes CronJob which will be scheduled regularly to (re)generate any certificates not provided manually. |
| certgen.affinity | object | `{}` | Affinity for certgen |
| certgen.annotations | object | `{"cronJob":{},"job":{}}` | Annotations to be added to the hubble-certgen initial Job and CronJob |
| certgen.cronJob.failedJobsHistoryLimit | int | `1` | The number of failed finished jobs to keep |
@ -214,7 +214,7 @@ contributors across the globe, there is almost always someone available to help.
| clustermesh.apiserver.extraVolumeMounts | list | `[]` | Additional clustermesh-apiserver volumeMounts. |
| clustermesh.apiserver.extraVolumes | list | `[]` | Additional clustermesh-apiserver volumes. |
| clustermesh.apiserver.healthPort | int | `9880` | TCP port for the clustermesh-apiserver health API. |
| clustermesh.apiserver.image | object | `{"digest":"sha256:56d6c3dc13b50126b80ecb571707a0ea97f6db694182b9d61efd386d04e5bb28","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/clustermesh-apiserver","tag":"v1.19.1","useDigest":true}` | Clustermesh API server image. |
| clustermesh.apiserver.image | object | `{"digest":"sha256:a8136a7615d6c6041d3aa6f2674d17beaec238170d669507ccc05328a778e2b7","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/clustermesh-apiserver","tag":"v1.19.3","useDigest":true}` | Clustermesh API server image. |
| clustermesh.apiserver.kvstoremesh.enabled | bool | `true` | Enable KVStoreMesh. KVStoreMesh caches the information retrieved from the remote clusters in the local etcd instance (deprecated - KVStoreMesh will always be enabled once the option is removed). |
| clustermesh.apiserver.kvstoremesh.extraArgs | list | `[]` | Additional KVStoreMesh arguments. |
| clustermesh.apiserver.kvstoremesh.extraEnv | list | `[]` | Additional KVStoreMesh environment variables. |
@ -340,6 +340,10 @@ contributors across the globe, there is almost always someone available to help.
| cni.resources | object | `{"limits":{"cpu":1,"memory":"1Gi"},"requests":{"cpu":"100m","memory":"10Mi"}}` | Specifies the resources for the cni initContainer |
| cni.uninstall | bool | `false` | Remove the CNI configuration and binary files on agent shutdown. Enable this if you're removing Cilium from the cluster. Disable this to prevent the CNI configuration file from being removed during agent upgrade, which can cause nodes to go unmanageable. |
| commonLabels | object | `{}` | commonLabels allows users to add common labels for all Cilium resources. |
| configDriftDetection | object | `{"driftChecker":true,"enabled":true,"ignoredKeys":[]}` | Configuration for the ConfigMap drift detection feature. When enabled, the agent continuously watches the cilium-config ConfigMap and exposes a cilium_drift_checker_config_delta Prometheus metric reporting the number of keys that differ between the ConfigMap and the agent's active settings. A non-zero value indicates that the agent has not yet applied all current ConfigMap changes and needs to be restarted. |
| configDriftDetection.driftChecker | bool | `true` | Enable the drift checker which compares the DynamicConfig table against the agent's active settings and publishes the cilium_drift_checker_config_delta metric. |
| configDriftDetection.enabled | bool | `true` | Enable watching of the cilium-config ConfigMap and reflecting its contents into the agent's internal DynamicConfig table. |
| configDriftDetection.ignoredKeys | list | `[]` | List of config-map keys to ignore when computing the drift delta. |
| connectivityProbeFrequencyRatio | float64 | `0.5` | Ratio of the connectivity probe frequency vs resource usage, a float in [0, 1]. 0 will give more frequent probing, 1 will give less frequent probing. Probing frequency is dynamically adjusted based on the cluster size. |
| conntrackGCInterval | string | `"0s"` | Configure how frequently garbage collection should occur for the datapath connection tracking table. |
| conntrackGCMaxInterval | string | `""` | Configure the maximum frequency for the garbage collection of the connection tracking table. Only affects the automatic computation for the frequency and has no effect when 'conntrackGCInterval' is set. This can be set to more frequently clean up unused identities created from ToFQDN policies. |
@ -380,7 +384,6 @@ contributors across the globe, there is almost always someone available to help.
| enableMasqueradeRouteSource | bool | `false` | Enables masquerading to the source of the route for traffic leaving the node from endpoints. |
| enableNoServiceEndpointsRoutable | bool | `true` | Enable routing to a service that has zero endpoints |
| enableNonDefaultDenyPolicies | bool | `true` | Enable Non-Default-Deny policies |
| enableTunnelBIGTCP | bool | `false` | Enable BIG TCP in tunneling mode and increase maximum GRO/GSO limits for VXLAN/GENEVE tunnels |
| enableXTSocketFallback | bool | `true` | Enables the fallback compatibility solution for when the xt_socket kernel module is missing and it is needed for the datapath L7 redirection to work properly. See documentation for details on when this can be disabled: https://docs.cilium.io/en/stable/operations/system_requirements/#linux-kernel. |
| encryption.enabled | bool | `false` | Enable transparent network encryption. |
| encryption.ipsec.encryptedOverlay | bool | `false` | Enable IPsec encrypted overlay |
@ -401,8 +404,29 @@ contributors across the globe, there is almost always someone available to help.
| encryption.strictMode.ingress.enabled | bool | `false` | Enable strict ingress encryption. When enabled, all unencrypted overlay ingress traffic will be dropped. This option is only applicable when WireGuard and tunneling are enabled. |
| encryption.type | string | `"ipsec"` | Encryption method. Can be one of ipsec, wireguard or ztunnel. |
| encryption.wireguard.persistentKeepalive | string | `"0s"` | Controls WireGuard PersistentKeepalive option. Set 0s to disable. |
| encryption.ztunnel | object | `{"affinity":{},"annotations":{},"caAddress":"https://localhost:15012","extraEnv":[],"extraVolumeMounts":[],"extraVolumes":[],"healthPort":15021,"image":{"digest":null,"override":null,"pullPolicy":"IfNotPresent","repository":"docker.io/istio/ztunnel","tag":"1.28.0-distroless","useDigest":false},"nodeSelector":{"kubernetes.io/os":"linux"},"podAnnotations":{},"podLabels":{},"priorityClassName":null,"readinessProbe":{"failureThreshold":3,"initialDelaySeconds":0,"periodSeconds":10},"resources":{"requests":{"cpu":"200m","memory":"512Mi"}},"secrets":{"bootstrapRootCert":null},"terminationGracePeriodSeconds":30,"tolerations":[{"effect":"NoSchedule","operator":"Exists"},{"key":"CriticalAddonsOnly","operator":"Exists"},{"effect":"NoExecute","operator":"Exists"}],"updateStrategy":{"rollingUpdate":{"maxSurge":1,"maxUnavailable":0},"type":"RollingUpdate"}}` | ztunnel encryption configuration. ztunnel is Istio's purpose-built, per-node proxy for handling L4 traffic in ambient mesh mode. These settings only apply when encryption.type is set to "ztunnel". |
| encryption.ztunnel.affinity | object | `{}` | Affinity for ztunnel pods. |
| encryption.ztunnel.annotations | object | `{}` | Annotations to be added to all ztunnel resources. |
| encryption.ztunnel.caAddress | string | `"https://localhost:15012"` | CA server address for certificate requests. |
| encryption.ztunnel.extraEnv | list | `[]` | Additional ztunnel container environment variables. |
| encryption.ztunnel.extraVolumeMounts | list | `[]` | Additional ztunnel volumeMounts. |
| encryption.ztunnel.extraVolumes | list | `[]` | Additional ztunnel volumes. |
| encryption.ztunnel.healthPort | int | `15021` | TCP port for the health API. |
| encryption.ztunnel.image | object | `{"digest":null,"override":null,"pullPolicy":"IfNotPresent","repository":"docker.io/istio/ztunnel","tag":"1.28.0-distroless","useDigest":false}` | ztunnel container image. |
| encryption.ztunnel.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node selector for ztunnel pods. |
| encryption.ztunnel.podAnnotations | object | `{}` | Annotations to be added to ztunnel pods. |
| encryption.ztunnel.podLabels | object | `{}` | Labels to be added to ztunnel pods. |
| encryption.ztunnel.priorityClassName | string | `nil` | The priority class to use for ztunnel pods. |
| encryption.ztunnel.readinessProbe | object | `{"failureThreshold":3,"initialDelaySeconds":0,"periodSeconds":10}` | Readiness probe configuration. |
| encryption.ztunnel.resources | object | `{"requests":{"cpu":"200m","memory":"512Mi"}}` | ztunnel resource limits & requests. |
| encryption.ztunnel.secrets | object | `{"bootstrapRootCert":null}` | ztunnel secrets configuration. |
| encryption.ztunnel.secrets.bootstrapRootCert | string | `nil` | Base64-encoded bootstrap root certificate content. If not provided, the secret must be created manually before deploying. @schema type: [null, string] @schema |
| encryption.ztunnel.terminationGracePeriodSeconds | int | `30` | Configure termination grace period for ztunnel DaemonSet. |
| encryption.ztunnel.tolerations | list | `[{"effect":"NoSchedule","operator":"Exists"},{"key":"CriticalAddonsOnly","operator":"Exists"},{"effect":"NoExecute","operator":"Exists"}]` | Node tolerations for ztunnel scheduling. |
| encryption.ztunnel.updateStrategy | object | `{"rollingUpdate":{"maxSurge":1,"maxUnavailable":0},"type":"RollingUpdate"}` | ztunnel update strategy. |
| endpointHealthChecking.enabled | bool | `true` | Enable connectivity health checking between virtual endpoints. |
| endpointLockdownOnMapOverflow | bool | `false` | Enable endpoint lockdown on policy map overflow. |
| endpointPolicyUpdateTimeoutDuration | string | `nil` | Max duration to wait for envoy to respond to configuration changes. Default "10s". |
| endpointRoutes.enabled | bool | `false` | Enable use of per endpoint routes instead of routing via the cilium_host interface. |
| eni.awsEnablePrefixDelegation | bool | `false` | Enable ENI prefix delegation |
| eni.awsReleaseExcessIPs | bool | `false` | Release IPs not used from the ENI |
@ -446,7 +470,7 @@ contributors across the globe, there is almost always someone available to help.
| envoy.httpRetryCount | int | `3` | Maximum number of retries for each HTTP request |
| envoy.httpUpstreamLingerTimeout | string | `nil` | Time in seconds to block Envoy worker thread while an upstream HTTP connection is closing. If set to 0, the connection is closed immediately (with TCP RST). If set to -1, the connection is closed asynchronously in the background. |
| envoy.idleTimeoutDurationSeconds | int | `60` | Set Envoy upstream HTTP idle connection timeout seconds. Does not apply to connections with pending requests. Default 60s |
| envoy.image | object | `{"digest":"sha256:8188114a2768b5f49d6ce58e168b20d765e0fbc64eee0d83241aa2b150ccd788","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium-envoy","tag":"v1.35.9-1770979049-232ed4a26881e4ab4f766f251f258ed424fff663","useDigest":true}` | Envoy container image. |
| envoy.image | object | `{"digest":"sha256:ba0ab8adac082d50d525fd2c5ba096c8facea3a471561b7c61c7a5b9c2e0de0d","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium-envoy","tag":"v1.36.6-1776000132-2437d2edeaf4d9b56ef279bd0d71127440c067aa","useDigest":true}` | Envoy container image. |
| envoy.initContainers | list | `[]` | Init containers added to the cilium Envoy DaemonSet. |
| envoy.initialFetchTimeoutSeconds | int | `30` | Time in seconds after which the initial fetch on an xDS stream is considered timed out |
| envoy.livenessProbe.enabled | bool | `true` | Enable liveness probe for cilium-envoy |
@ -591,7 +615,7 @@ contributors across the globe, there is almost always someone available to help.
| hubble.relay.extraVolumes | list | `[]` | Additional hubble-relay volumes. |
| hubble.relay.gops.enabled | bool | `true` | Enable gops for hubble-relay |
| hubble.relay.gops.port | int | `9893` | Configure gops listen port for hubble-relay |
| hubble.relay.image | object | `{"digest":"sha256:d8c4e13bc36a56179292bb52bc6255379cb94cb873700d316ea3139b1bdb8165","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/hubble-relay","tag":"v1.19.1","useDigest":true}` | Hubble-relay container image. |
| hubble.relay.image | object | `{"digest":"sha256:5ee21d57b6ef2aa6db67e603a735fdceb162454b352b7335b651456e308f681b","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/hubble-relay","tag":"v1.19.3","useDigest":true}` | Hubble-relay container image. |
| hubble.relay.listenHost | string | `""` | Host to listen to. Specify an empty string to bind to all the interfaces. |
| hubble.relay.listenPort | string | `"4245"` | Port to listen to. |
| hubble.relay.logOptions | object | `{"format":null,"level":null}` | Logging configuration for hubble-relay. |
@ -709,7 +733,7 @@ contributors across the globe, there is almost always someone available to help.
| identityAllocationMode | string | `"crd"` | Method to use for identity allocation (`crd`, `kvstore` or `doublewrite-readkvstore` / `doublewrite-readcrd` for migrating between identity backends). |
| identityChangeGracePeriod | string | `"5s"` | Time to wait before using new identity on endpoint identity change. |
| identityManagementMode | string | `"agent"` | Control whether CiliumIdentities are created by the agent ("agent"), the operator ("operator") or both ("both"). "Both" should be used only to migrate between "agent" and "operator". Operator-managed identities is a beta feature. |
| image | object | `{"digest":"sha256:41f1f74a0000de8656f1de4088ea00c8f2d49d6edea579034c73c5fd5fe01792","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.19.1","useDigest":true}` | Agent container image. |
| image | object | `{"digest":"sha256:2e61680593cddca8b6c055f6d4c849d87a26a1c91c7e3b8b56c7fb76ab7b7b10","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.19.3","useDigest":true}` | Agent container image. |
| imagePullSecrets | list | `[]` | Configure image pull secrets for pulling container images |
| ingressController.default | bool | `false` | Set cilium ingress controller to be the default ingress controller This will let cilium ingress controller route entries without ingress class set |
| ingressController.defaultSecretName | string | `nil` | Default secret name for ingresses without .spec.tls[].secretName set. |
@ -797,12 +821,13 @@ contributors across the globe, there is almost always someone available to help.
| livenessProbe.failureThreshold | int | `10` | failure threshold of liveness probe |
| livenessProbe.periodSeconds | int | `30` | interval between checks of the liveness probe |
| livenessProbe.requireK8sConnectivity | bool | `false` | whether to require k8s connectivity as part of the check. |
| loadBalancer | object | `{"acceleration":"disabled","l7":{"algorithm":"round_robin","backend":"disabled","ports":[]}}` | Configure service load balancing |
| loadBalancer | object | `{"acceleration":"disabled","l7":{"algorithm":"round_robin","backend":"disabled","ports":[]},"serviceTopology":false}` | Configure service load balancing |
| loadBalancer.acceleration | string | `"disabled"` | acceleration is the option to accelerate service handling via XDP Applicable values can be: disabled (do not use XDP), native (XDP BPF program is run directly out of the networking driver's early receive path), or best-effort (use native mode XDP acceleration on devices that support it). |
| loadBalancer.l7 | object | `{"algorithm":"round_robin","backend":"disabled","ports":[]}` | L7 LoadBalancer |
| loadBalancer.l7.algorithm | string | `"round_robin"` | Default LB algorithm The default LB algorithm to be used for services, which can be overridden by the service annotation (e.g. service.cilium.io/lb-l7-algorithm) Applicable values: round_robin, least_request, random |
| loadBalancer.l7.backend | string | `"disabled"` | Enable L7 service load balancing via envoy proxy. The request to a k8s service, which has specific annotation e.g. service.cilium.io/lb-l7, will be forwarded to the local backend proxy to be load balanced to the service endpoints. Please refer to docs for supported annotations for more configuration. Applicable values: - envoy: Enable L7 load balancing via envoy proxy. This will automatically set enable-envoy-config as well. - disabled: Disable L7 load balancing by way of service annotation. |
| loadBalancer.l7.ports | list | `[]` | List of ports from service to be automatically redirected to above backend. Any service exposing one of these ports will be automatically redirected. Fine-grained control can be achieved by using the service annotation. |
| loadBalancer.serviceTopology | bool | `false` | serviceTopology enables K8s Topology Aware Hints -based service endpoints filtering |
| localRedirectPolicies.addressMatcherCIDRs | string | `nil` | Limit the allowed addresses in Address Matcher rule of Local Redirect Policies to the given CIDRs. @schema@ type: [null, array] @schema@ |
| localRedirectPolicies.enabled | bool | `false` | Enable local redirect policies. |
| localRedirectPolicy | bool | `false` | Enable Local Redirect Policy (deprecated, please use 'localRedirectPolicies.enabled' instead) |
@ -860,7 +885,7 @@ contributors across the globe, there is almost always someone available to help.
| operator.hostNetwork | bool | `true` | HostNetwork setting |
| operator.identityGCInterval | string | `"15m0s"` | Interval for identity garbage collection. |
| operator.identityHeartbeatTimeout | string | `"30m0s"` | Timeout for identity heartbeats. |
| operator.image | object | `{"alibabacloudDigest":"sha256:837b12f4239e88ea5b4b5708ab982c319a94ee05edaecaafe5fd0e5b1962f554","awsDigest":"sha256:18913d05a6c4d205f0b7126c4723bb9ccbd4dc24403da46ed0f9f4bf2a142804","azureDigest":"sha256:82bce78603056e709d4c4e9f9ebb25c222c36d8a07f8c05381c2372d9078eca8","genericDigest":"sha256:e7278d763e448bf6c184b0682cf98cdca078d58a27e1b2f3c906792670aa211a","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/operator","suffix":"","tag":"v1.19.1","useDigest":true}` | cilium-operator image. |
| operator.image | object | `{"alibabacloudDigest":"sha256:176321a65123373ff8c7823b25183102cbad98375e8d6c80b96d68b6e8491103","awsDigest":"sha256:a53dcbfb77282bf2ddd3abbe60f6d49762e7c1389a36cb35b71d504644a56640","azureDigest":"sha256:699c1571a3df1a98882ee13610d47cffb7b34ee7e8d276096db798a5f6c7e4cb","genericDigest":"sha256:205b09b0ed6accbf9fe688d312a9f0fcfc6a316fc081c23fbffb472af5dd62cd","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/operator","suffix":"","tag":"v1.19.3","useDigest":true}` | cilium-operator image. |
| operator.nodeGCInterval | string | `"5m0s"` | Interval for cilium node garbage collection. |
| operator.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for cilium-operator pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |
| operator.podAnnotations | object | `{}` | Annotations to be added to cilium-operator pods |
@ -918,11 +943,11 @@ contributors across the globe, there is almost always someone available to help.
| preflight.affinity | object | `{"podAffinity":{"requiredDuringSchedulingIgnoredDuringExecution":[{"labelSelector":{"matchLabels":{"k8s-app":"cilium"}},"topologyKey":"kubernetes.io/hostname"}]}}` | Affinity for cilium-preflight |
| preflight.annotations | object | `{}` | Annotations to be added to all top-level preflight objects (resources under templates/cilium-preflight) |
| preflight.enabled | bool | `false` | Enable Cilium pre-flight resources (required for upgrade) |
| preflight.envoy.image | object | `{"digest":"sha256:8188114a2768b5f49d6ce58e168b20d765e0fbc64eee0d83241aa2b150ccd788","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium-envoy","tag":"v1.35.9-1770979049-232ed4a26881e4ab4f766f251f258ed424fff663","useDigest":true}` | Envoy pre-flight image. |
| preflight.envoy.image | object | `{"digest":"sha256:ba0ab8adac082d50d525fd2c5ba096c8facea3a471561b7c61c7a5b9c2e0de0d","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium-envoy","tag":"v1.36.6-1776000132-2437d2edeaf4d9b56ef279bd0d71127440c067aa","useDigest":true}` | Envoy pre-flight image. |
| preflight.extraEnv | list | `[]` | Additional preflight environment variables. |
| preflight.extraVolumeMounts | list | `[]` | Additional preflight volumeMounts. |
| preflight.extraVolumes | list | `[]` | Additional preflight volumes. |
| preflight.image | object | `{"digest":"sha256:41f1f74a0000de8656f1de4088ea00c8f2d49d6edea579034c73c5fd5fe01792","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.19.1","useDigest":true}` | Cilium pre-flight image. |
| preflight.image | object | `{"digest":"sha256:2e61680593cddca8b6c055f6d4c849d87a26a1c91c7e3b8b56c7fb76ab7b7b10","override":null,"pullPolicy":"IfNotPresent","repository":"quay.io/cilium/cilium","tag":"v1.19.3","useDigest":true}` | Cilium pre-flight image. |
| preflight.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for preflight pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |
| preflight.podAnnotations | object | `{}` | Annotations to be added to preflight pods |
| preflight.podDisruptionBudget.enabled | bool | `false` | enable PodDisruptionBudget ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ |
@ -979,6 +1004,7 @@ contributors across the globe, there is almost always someone available to help.
| serviceAccounts.corednsMCSAPI | object | `{"annotations":{},"automount":true,"create":true,"name":"cilium-coredns-mcsapi-autoconfig"}` | CorednsMCSAPI is used if clustermesh.mcsapi.corednsAutoConfigure.enabled=true |
| serviceAccounts.hubblecertgen | object | `{"annotations":{},"automount":true,"create":true,"name":"hubble-generate-certs"}` | Hubblecertgen is used if hubble.tls.auto.method=cronJob |
| serviceAccounts.nodeinit.enabled | bool | `false` | Enabled is temporary until https://github.com/cilium/cilium-cli/issues/1396 is implemented. Cilium CLI doesn't create the SAs for node-init, thus the workaround. Helm is not affected by this issue. Name and automount can be configured, if enabled is set to true. Otherwise, they are ignored. Enabled can be removed once the issue is fixed. Cilium-nodeinit DS must also be fixed. |
| serviceAccounts.ztunnel | object | `{"annotations":{},"automount":false,"create":true,"name":"ztunnel-cilium"}` | Ztunnel is used if encryption.type=ztunnel |
| serviceNoBackendResponse | string | `"reject"` | Configure what the response should be to traffic for a service without backends. Possible values: - reject (default) - drop |
| sleepAfterInit | bool | `false` | Do not run Cilium agent when running with clean mode. Useful to completely uninstall Cilium as it will stop Cilium from starting and create artifacts in the node. |
| socketLB | object | `{"enabled":false}` | Configure socket LB |

9
packages/system/cilium/charts/cilium/files/cilium-envoy/configmap/bootstrap-config.yaml
View file

@ -167,6 +167,8 @@ staticResources:
circuitBreakers:
thresholds:
- maxRetries: {{ .Values.envoy.maxConcurrentRetries }}
maxConnections: {{ .Values.envoy.clusterMaxConnections }}
maxRequests: {{ .Values.envoy.clusterMaxRequests }}
lbPolicy: "CLUSTER_PROVIDED"
typedExtensionProtocolOptions:
envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
@ -183,6 +185,8 @@ staticResources:
circuitBreakers:
thresholds:
- maxRetries: {{ .Values.envoy.maxConcurrentRetries }}
maxConnections: {{ .Values.envoy.clusterMaxConnections }}
maxRequests: {{ .Values.envoy.clusterMaxRequests }}
lbPolicy: "CLUSTER_PROVIDED"
typedExtensionProtocolOptions:
envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
@ -204,6 +208,8 @@ staticResources:
circuitBreakers:
thresholds:
- maxRetries: {{ .Values.envoy.maxConcurrentRetries }}
maxConnections: {{ .Values.envoy.clusterMaxConnections }}
maxRequests: {{ .Values.envoy.clusterMaxRequests }}
lbPolicy: "CLUSTER_PROVIDED"
typedExtensionProtocolOptions:
envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
@ -220,6 +226,8 @@ staticResources:
circuitBreakers:
thresholds:
- maxRetries: {{ .Values.envoy.maxConcurrentRetries }}
maxConnections: {{ .Values.envoy.clusterMaxConnections }}
maxRequests: {{ .Values.envoy.clusterMaxRequests }}
lbPolicy: "CLUSTER_PROVIDED"
typedExtensionProtocolOptions:
envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
@ -304,3 +312,4 @@ admin:
address:
pipe:
path: "/var/run/cilium/envoy/sockets/admin.sock"
mode: 0660

6
packages/system/cilium/charts/cilium/templates/cilium-agent/daemonset.yaml
View file

@ -546,7 +546,7 @@ spec:
{{- toYaml .Values.initResources | trim | nindent 10 }}
{{- end }}
command:
- sh
- bash
- -ec
# The statically linked Go program binary is invoked to avoid any
# dependency on utilities like sh and mount that can be missing on certain
@ -592,7 +592,7 @@ spec:
- name: BIN_PATH
value: {{ .Values.cni.binPath }}
command:
- sh
- bash
- -ec
# The statically linked Go program binary is invoked to avoid any
# dependency on utilities like sh that can be missing on certain
@ -660,7 +660,7 @@ spec:
{{- toYaml . | trim | nindent 10 }}
{{- end }}
command:
- sh
- bash
- -c
- |
until test -s {{ (print "/tmp/cilium-bootstrap.d/" (.Values.nodeinit.bootstrapFile | base)) | quote }}; do

20
packages/system/cilium/charts/cilium/templates/cilium-configmap.yaml
View file

@ -464,6 +464,9 @@ data:
{{- if has (kindOf .Values.bpf.policyMapPressureMetricsThreshold) (list "int64" "float64") }}
bpf-policy-map-pressure-metrics-threshold: {{ .Values.bpf.policyMapPressureMetricsThreshold | quote }}
{{- end }}
{{- if .Values.endpointPolicyUpdateTimeoutDuration }}
endpoint-policy-update-timeout: {{ .Values.endpointPolicyUpdateTimeoutDuration | quote }}
{{- end }}
{{- if hasKey .Values.bpf "policyStatsMapMax" }}
# bpf-policy-stats-map-max specifies the maximum number of entries in global
# policy stats map
@ -706,7 +709,6 @@ data:
enable-ipv4-big-tcp: {{ .Values.enableIPv4BIGTCP | quote }}
enable-ipv6-big-tcp: {{ .Values.enableIPv6BIGTCP | quote }}
enable-ipv6-masquerade: {{ .Values.enableIPv6Masquerade | quote }}
enable-tunnel-big-tcp: {{ .Values.enableTunnelBIGTCP | quote }}
{{- if hasKey .Values.bpf "enableTCX" }}
enable-tcx: {{ .Values.bpf.enableTCX | quote }}
@ -906,9 +908,9 @@ data:
{{- end }}
{{- if hasKey .Values.loadBalancer "serviceTopology" }}
enable-service-topology: {{ .Values.loadBalancer.serviceTopology | quote }}
# {{- end }}
{{- end }}
{{- end }}
{{- if hasKey .Values.maglev "tableSize" }}
bpf-lb-maglev-table-size: {{ .Values.maglev.tableSize | quote}}
{{- end }}
@ -1380,11 +1382,7 @@ data:
{{- if .Values.operator.unmanagedPodWatcher.restart }}
{{- $interval := .Values.operator.unmanagedPodWatcher.intervalSeconds }}
{{- if kindIs "float64" $interval }}
unmanaged-pod-watcher-interval: {{ printf "%ds" (int $interval) | quote }}
{{- else }}
unmanaged-pod-watcher-interval: {{ $interval | quote }}
{{- end }}
{{- else }}
unmanaged-pod-watcher-interval: "0"
{{- end }}
@ -1517,6 +1515,14 @@ data:
connectivity-probe-frequency-ratio: {{ .Values.connectivityProbeFrequencyRatio | quote }}
{{- end }}
{{- if hasKey .Values "configDriftDetection" }}
enable-dynamic-config: {{ .Values.configDriftDetection.enabled | quote }}
enable-drift-checker: {{ .Values.configDriftDetection.driftChecker | quote }}
{{- if .Values.configDriftDetection.ignoredKeys }}
ignore-flags-drift-checker: {{ join "," .Values.configDriftDetection.ignoredKeys | quote }}
{{- end }}
{{- end }}
# Extra config allows adding arbitrary properties to the cilium config.
# By putting it at the end of the ConfigMap, it's also possible to override existing properties.
{{- if .Values.extraConfig }}

9
packages/system/cilium/charts/cilium/templates/cilium-operator/clusterrole.yaml
View file

@ -407,6 +407,15 @@ rules:
verbs:
- update
- patch
- apiGroups:
- multicluster.x-k8s.io
resources:
# The controller needs to be able to set serviceimport finalizers to be able to create a derived Service
# resource that is owned by the ServiceImport and sets blockOwnerDeletion=true in its ownerRef.
# This is required when the admission plugin OwnerReferencesPermissionEnforcement is activated.
- serviceimports/finalizers
verbs:
- update
- apiGroups:
- multicluster.x-k8s.io
resources:

165
packages/system/cilium/charts/cilium/templates/ztunnel/daemonset.yaml Normal file
View file

@ -0,0 +1,165 @@
{{- if and .Values.encryption.enabled (eq .Values.encryption.type "ztunnel") }}
---
kind: DaemonSet
apiVersion: apps/v1
metadata:
name: ztunnel-cilium
namespace: {{ include "cilium.namespace" . }}
{{- with .Values.encryption.ztunnel.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
labels:
app: ztunnel-cilium
app.kubernetes.io/part-of: cilium
app.kubernetes.io/name: ztunnel-cilium
{{- with .Values.commonLabels }}
{{- toYaml . | nindent 4 }}
{{- end }}
spec:
revisionHistoryLimit: 10
selector:
matchLabels:
app: ztunnel-cilium
{{- with .Values.encryption.ztunnel.updateStrategy }}
updateStrategy:
{{- toYaml . | trim | nindent 4 }}
{{- end }}
template:
metadata:
annotations:
sidecar.istio.io/inject: "false"
{{- with .Values.encryption.ztunnel.podAnnotations }}
{{- toYaml . | nindent 8 }}
{{- end }}
labels:
app: ztunnel-cilium
app.kubernetes.io/part-of: cilium
app.kubernetes.io/name: ztunnel-cilium
{{- with .Values.commonLabels }}
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.encryption.ztunnel.podLabels }}
{{- toYaml . | nindent 8 }}
{{- end }}
spec:
{{- with .Values.imagePullSecrets }}
imagePullSecrets:
{{- toYaml . | nindent 8 }}
{{- end }}
hostNetwork: true
dnsPolicy: ClusterFirst
containers:
- name: istio-proxy
image: {{ include "cilium.image" .Values.encryption.ztunnel.image | quote }}
imagePullPolicy: {{ .Values.encryption.ztunnel.image.pullPolicy }}
args:
- proxy
- ztunnel
env:
- name: XDS_ADDRESS
value: "https://localhost:15012"
- name: XDS_ROOT_CA
value: "/etc/ztunnel/bootstrap-root.crt"
- name: CA_ROOT_CA
value: "/etc/ztunnel/bootstrap-root.crt"
- name: CA_ADDRESS
value: {{ .Values.encryption.ztunnel.caAddress | quote }}
- name: ISTIO_META_DNS_CAPTURE
value: "false"
- name: INPOD_UDS
value: "/var/run/cilium/ztunnel.sock"
- name: NODE_NAME
valueFrom:
fieldRef:
apiVersion: v1
fieldPath: status.hostIP
- name: INSTANCE_IP
valueFrom:
fieldRef:
apiVersion: v1
fieldPath: status.podIP
- name: ISTIO_META_ENABLE_HBONE
value: "true"
{{- with .Values.encryption.ztunnel.extraEnv }}
{{- toYaml . | trim | nindent 12 }}
{{- end }}
readinessProbe:
httpGet:
path: /healthz/ready
port: {{ .Values.encryption.ztunnel.healthPort }}
host: "127.0.0.1"
scheme: HTTP
initialDelaySeconds: {{ .Values.encryption.ztunnel.readinessProbe.initialDelaySeconds }}
periodSeconds: {{ .Values.encryption.ztunnel.readinessProbe.periodSeconds }}
failureThreshold: {{ .Values.encryption.ztunnel.readinessProbe.failureThreshold }}
successThreshold: 1
timeoutSeconds: 1
{{- with .Values.encryption.ztunnel.resources }}
resources:
{{- toYaml . | trim | nindent 12 }}
{{- end }}
securityContext:
allowPrivilegeEscalation: true
capabilities:
add:
- NET_ADMIN
- SYS_ADMIN
- NET_RAW
drop:
- ALL
privileged: false
readOnlyRootFilesystem: true
runAsGroup: 1337
runAsNonRoot: false
runAsUser: 0
terminationMessagePath: /dev/termination-log
terminationMessagePolicy: File
volumeMounts:
- mountPath: /var/run/cilium
name: cilium-dir
readOnly: false
- mountPath: /etc/ztunnel
name: cilium-ztunnel-secrets
readOnly: true
{{- with .Values.encryption.ztunnel.extraVolumeMounts }}
{{- toYaml . | nindent 12 }}
{{- end }}
{{- with .Values.encryption.ztunnel.affinity }}
affinity:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.encryption.ztunnel.nodeSelector }}
nodeSelector:
{{- toYaml . | trim | nindent 8 }}
{{- end }}
{{- with .Values.encryption.ztunnel.tolerations }}
tolerations:
{{- toYaml . | trim | nindent 8 }}
{{- end }}
priorityClassName: {{ include "cilium.priorityClass" (list $ .Values.encryption.ztunnel.priorityClassName "system-node-critical") }}
restartPolicy: Always
terminationGracePeriodSeconds: {{ .Values.encryption.ztunnel.terminationGracePeriodSeconds }}
{{- if .Values.serviceAccounts.ztunnel.create }}
serviceAccountName: {{ .Values.serviceAccounts.ztunnel.name | quote }}
automountServiceAccountToken: {{ .Values.serviceAccounts.ztunnel.automount }}
{{- else }}
automountServiceAccountToken: false
{{- end }}
volumes:
- name: cilium-dir
hostPath:
path: /var/run/cilium
type: DirectoryOrCreate
- name: cilium-ztunnel-secrets
secret:
secretName: cilium-ztunnel-secrets
defaultMode: 420
items:
- key: bootstrap-root.crt
path: bootstrap-root.crt
mode: 420
{{- with .Values.encryption.ztunnel.extraVolumes }}
{{- toYaml . | nindent 8 }}
{{- end }}
{{- end }}

23
packages/system/cilium/charts/cilium/templates/ztunnel/secret.yaml Normal file
View file

@ -0,0 +1,23 @@
{{- if and .Values.encryption.enabled (eq .Values.encryption.type "ztunnel") }}
{{- if .Values.encryption.ztunnel.secrets.bootstrapRootCert }}
---
apiVersion: v1
kind: Secret
metadata:
name: cilium-ztunnel-secrets
namespace: {{ include "cilium.namespace" . }}
{{- with .Values.encryption.ztunnel.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
labels:
app.kubernetes.io/part-of: cilium
app.kubernetes.io/name: ztunnel-cilium
{{- with .Values.commonLabels }}
{{- toYaml . | nindent 4 }}
{{- end }}
type: Opaque
data:
bootstrap-root.crt: {{ .Values.encryption.ztunnel.secrets.bootstrapRootCert | b64enc }}
{{- end }}
{{- end }}

21
packages/system/cilium/charts/cilium/templates/ztunnel/serviceaccount.yaml Normal file
View file

@ -0,0 +1,21 @@
{{- if and .Values.encryption.enabled (eq .Values.encryption.type "ztunnel") .Values.serviceAccounts.ztunnel.create }}
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ .Values.serviceAccounts.ztunnel.name | quote }}
namespace: {{ include "cilium.namespace" . }}
{{- with .Values.commonLabels }}
labels:
{{- toYaml . | nindent 4 }}
{{- end }}
{{- if or .Values.serviceAccounts.ztunnel.annotations .Values.encryption.ztunnel.annotations }}
annotations:
{{- with .Values.encryption.ztunnel.annotations }}
{{- toYaml . | nindent 4 }}
{{- end }}
{{- with .Values.serviceAccounts.ztunnel.annotations }}
{{- toYaml . | nindent 4 }}
{{- end }}
{{- end }}
{{- end }}

219
packages/system/cilium/charts/cilium/values.schema.json
View file

@ -1714,6 +1714,21 @@
"object"
]
},
"configDriftDetection": {
"properties": {
"driftChecker": {
"type": "boolean"
},
"enabled": {
"type": "boolean"
},
"ignoredKeys": {
"items": {},
"type": "array"
}
},
"type": "object"
},
"connectivityProbeFrequencyRatio": {
"type": [
"null",
@ -1898,9 +1913,6 @@
"enableNonDefaultDenyPolicies": {
"type": "boolean"
},
"enableTunnelBIGTCP": {
"type": "boolean"
},
"enableXTSocketFallback": {
"type": "boolean"
},
@ -1984,6 +1996,184 @@
}
},
"type": "object"
},
"ztunnel": {
"properties": {
"affinity": {
"type": "object"
},
"annotations": {
"type": "object"
},
"caAddress": {
"type": "string"
},
"extraEnv": {
"items": {},
"type": "array"
},
"extraVolumeMounts": {
"items": {},
"type": "array"
},
"extraVolumes": {
"items": {},
"type": "array"
},
"healthPort": {
"type": "integer"
},
"image": {
"properties": {
"digest": {
"type": [
"null",
"string"
]
},
"override": {
"type": [
"null",
"string"
]
},
"pullPolicy": {
"type": "string"
},
"repository": {
"type": "string"
},
"tag": {
"type": "string"
},
"useDigest": {
"type": "boolean"
}
},
"type": "object"
},
"nodeSelector": {
"properties": {
"kubernetes.io/os": {
"type": "string"
}
},
"type": "object"
},
"podAnnotations": {
"type": "object"
},
"podLabels": {
"type": "object"
},
"priorityClassName": {
"type": [
"null",
"string"
]
},
"readinessProbe": {
"properties": {
"failureThreshold": {
"type": "integer"
},
"initialDelaySeconds": {
"type": "integer"
},
"periodSeconds": {
"type": "integer"
}
},
"type": "object"
},
"resources": {
"properties": {
"requests": {
"properties": {
"cpu": {
"type": "string"
},
"memory": {
"type": "string"
}
},
"type": "object"
}
},
"type": "object"
},
"secrets": {
"properties": {
"bootstrapRootCert": {
"type": [
"null",
"string"
]
}
},
"type": "object"
},
"terminationGracePeriodSeconds": {
"type": "integer"
},
"tolerations": {
"items": {
"anyOf": [
{
"properties": {
"effect": {
"type": "string"
},
"operator": {
"type": "string"
}
}
},
{
"properties": {
"key": {
"type": "string"
},
"operator": {
"type": "string"
}
}
},
{
"properties": {
"effect": {
"type": "string"
},
"operator": {
"type": "string"
}
}
}
]
},
"type": "array"
},
"updateStrategy": {
"properties": {
"rollingUpdate": {
"properties": {
"maxSurge": {
"type": "integer"
},
"maxUnavailable": {
"type": "integer"
}
},
"type": "object"
},
"type": {
"type": "string"
}
},
"type": "object"
}
},
"type": "object"
}
},
"type": "object"
@ -1999,6 +2189,9 @@
"endpointLockdownOnMapOverflow": {
"type": "boolean"
},
"endpointPolicyUpdateTimeoutDuration": {
"type": "null"
},
"endpointRoutes": {
"properties": {
"enabled": {
@ -4484,6 +4677,9 @@
}
},
"type": "object"
},
"serviceTopology": {
"type": "boolean"
}
},
"type": "object"
@ -6029,6 +6225,23 @@
}
},
"type": "object"
},
"ztunnel": {
"properties": {
"annotations": {
"type": "object"
},
"automount": {
"type": "boolean"
},
"create": {
"type": "boolean"
},
"name": {
"type": "string"
}
},
"type": "object"
}
},
"type": "object"

147
packages/system/cilium/charts/cilium/values.yaml
View file

@ -210,6 +210,12 @@ serviceAccounts:
name: cilium-coredns-mcsapi-autoconfig
automount: true
annotations: {}
# -- Ztunnel is used if encryption.type=ztunnel
ztunnel:
create: true
name: ztunnel-cilium
automount: false
annotations: {}
# -- Configure termination grace period for cilium-agent DaemonSet.
terminationGracePeriodSeconds: 1
# -- Install the cilium agent resources.
@ -218,6 +224,22 @@ agent: true
name: cilium
# -- Roll out cilium agent pods automatically when configmap is updated.
rollOutCiliumPods: false
# -- Configuration for the ConfigMap drift detection feature.
# When enabled, the agent continuously watches the cilium-config ConfigMap
# and exposes a cilium_drift_checker_config_delta Prometheus metric reporting
# the number of keys that differ between the ConfigMap and the agent's active
# settings. A non-zero value indicates that the agent has not yet applied all
# current ConfigMap changes and needs to be restarted.
configDriftDetection:
# -- Enable watching of the cilium-config ConfigMap and reflecting its
# contents into the agent's internal DynamicConfig table.
enabled: true
# -- Enable the drift checker which compares the DynamicConfig table against
# the agent's active settings and publishes the
# cilium_drift_checker_config_delta metric.
driftChecker: true
# -- List of config-map keys to ignore when computing the drift delta.
ignoredKeys: []
# -- Agent container image.
image:
# @schema
@ -225,10 +247,10 @@ image:
# @schema
override: ~
repository: "quay.io/cilium/cilium"
tag: "v1.19.1"
tag: "v1.19.3"
pullPolicy: "IfNotPresent"
# cilium-digest
digest: sha256:41f1f74a0000de8656f1de4088ea00c8f2d49d6edea579034c73c5fd5fe01792
digest: sha256:2e61680593cddca8b6c055f6d4c849d87a26a1c91c7e3b8b56c7fb76ab7b7b10
useDigest: true
# -- Scheduling configurations for cilium pods
scheduling:
@ -1133,9 +1155,89 @@ encryption:
wireguard:
# -- Controls WireGuard PersistentKeepalive option. Set 0s to disable.
persistentKeepalive: 0s
# -- ztunnel encryption configuration.
# ztunnel is Istio's purpose-built, per-node proxy for handling L4 traffic in ambient mesh mode.
# These settings only apply when encryption.type is set to "ztunnel".
ztunnel:
# -- ztunnel container image.
image:
# @schema
# type: [null, string]
# @schema
override: ~
repository: "docker.io/istio/ztunnel"
tag: "1.28.0-distroless"
pullPolicy: "IfNotPresent"
# @schema
# type: [null, string]
# @schema
digest: ~
useDigest: false
# -- CA server address for certificate requests.
caAddress: "https://localhost:15012"
# -- TCP port for the health API.
healthPort: 15021
# -- ztunnel resource limits & requests.
resources:
requests:
cpu: 200m
memory: 512Mi
# -- ztunnel update strategy.
updateStrategy:
type: RollingUpdate
rollingUpdate:
maxSurge: 1
maxUnavailable: 0
# -- Configure termination grace period for ztunnel DaemonSet.
terminationGracePeriodSeconds: 30
# -- Readiness probe configuration.
readinessProbe:
initialDelaySeconds: 0
periodSeconds: 10
failureThreshold: 3
# -- Node selector for ztunnel pods.
nodeSelector:
kubernetes.io/os: linux
# -- Node tolerations for ztunnel scheduling.
tolerations:
- effect: NoSchedule
operator: Exists
- key: CriticalAddonsOnly
operator: Exists
- effect: NoExecute
operator: Exists
# -- Affinity for ztunnel pods.
affinity: {}
# @schema
# type: [null, string]
# @schema
# -- The priority class to use for ztunnel pods.
priorityClassName: ~
# -- Annotations to be added to all ztunnel resources.
annotations: {}
# -- Annotations to be added to ztunnel pods.
podAnnotations: {}
# -- Labels to be added to ztunnel pods.
podLabels: {}
# -- Additional ztunnel container environment variables.
extraEnv: []
# -- Additional ztunnel volumes.
extraVolumes: []
# -- Additional ztunnel volumeMounts.
extraVolumeMounts: []
# -- ztunnel secrets configuration.
secrets:
# -- Base64-encoded bootstrap root certificate content.
# If not provided, the secret must be created manually before deploying.
# @schema
# type: [null, string]
# @schema
bootstrapRootCert: ~
endpointHealthChecking:
# -- Enable connectivity health checking between virtual endpoints.
enabled: true
# -- Max duration to wait for envoy to respond to configuration changes. Default "10s".
endpointPolicyUpdateTimeoutDuration: null
endpointRoutes:
# @schema
# type: [boolean, string]
@ -1250,8 +1352,8 @@ certgen:
# @schema
override: ~
repository: "quay.io/cilium/certgen"
tag: "v0.3.2"
digest: "sha256:19921f48ee7e2295ea4dca955878a6cd8d70e6d4219d08f688e866ece9d95d4d"
tag: "v0.4.1"
digest: "sha256:f0c656830e856d26b24b0e144df1f8b327d3b46748d76a630514111fc365b697"
useDigest: true
pullPolicy: "IfNotPresent"
# @schema
@ -1599,9 +1701,9 @@ hubble:
# @schema
override: ~
repository: "quay.io/cilium/hubble-relay"
tag: "v1.19.1"
tag: "v1.19.3"
# hubble-relay-digest
digest: sha256:d8c4e13bc36a56179292bb52bc6255379cb94cb873700d316ea3139b1bdb8165
digest: sha256:5ee21d57b6ef2aa6db67e603a735fdceb162454b352b7335b651456e308f681b
useDigest: true
pullPolicy: "IfNotPresent"
# -- Specifies the resources for the hubble-relay pods
@ -2313,8 +2415,6 @@ enableMasqueradeRouteSource: false
enableIPv4BIGTCP: false
# -- Enables IPv6 BIG TCP support which increases maximum IPv6 GSO/GRO limits for nodes and pods
enableIPv6BIGTCP: false
# -- Enable BIG TCP in tunneling mode and increase maximum GRO/GSO limits for VXLAN/GENEVE tunnels
enableTunnelBIGTCP: false
nat:
# -- Number of the top-k SNAT map connections to track in Cilium statedb.
mapStatsEntries: 32
@ -2392,8 +2492,7 @@ loadBalancer:
# -- serviceTopology enables K8s Topology Aware Hints -based service
# endpoints filtering
# serviceTopology: false
serviceTopology: false
# -- L7 LoadBalancer
l7:
# -- Enable L7 service load balancing via envoy proxy.
@ -2626,9 +2725,9 @@ envoy:
# @schema
override: ~
repository: "quay.io/cilium/cilium-envoy"
tag: "v1.35.9-1770979049-232ed4a26881e4ab4f766f251f258ed424fff663"
tag: "v1.36.6-1776000132-2437d2edeaf4d9b56ef279bd0d71127440c067aa"
pullPolicy: "IfNotPresent"
digest: "sha256:8188114a2768b5f49d6ce58e168b20d765e0fbc64eee0d83241aa2b150ccd788"
digest: "sha256:ba0ab8adac082d50d525fd2c5ba096c8facea3a471561b7c61c7a5b9c2e0de0d"
useDigest: true
# -- Init containers added to the cilium Envoy DaemonSet.
initContainers: []
@ -3011,15 +3110,15 @@ operator:
# @schema
override: ~
repository: "quay.io/cilium/operator"
tag: "v1.19.1"
tag: "v1.19.3"
# operator-generic-digest
genericDigest: sha256:e7278d763e448bf6c184b0682cf98cdca078d58a27e1b2f3c906792670aa211a
genericDigest: sha256:205b09b0ed6accbf9fe688d312a9f0fcfc6a316fc081c23fbffb472af5dd62cd
# operator-azure-digest
azureDigest: sha256:82bce78603056e709d4c4e9f9ebb25c222c36d8a07f8c05381c2372d9078eca8
azureDigest: sha256:699c1571a3df1a98882ee13610d47cffb7b34ee7e8d276096db798a5f6c7e4cb
# operator-aws-digest
awsDigest: sha256:18913d05a6c4d205f0b7126c4723bb9ccbd4dc24403da46ed0f9f4bf2a142804
awsDigest: sha256:a53dcbfb77282bf2ddd3abbe60f6d49762e7c1389a36cb35b71d504644a56640
# operator-alibabacloud-digest
alibabacloudDigest: sha256:837b12f4239e88ea5b4b5708ab982c319a94ee05edaecaafe5fd0e5b1962f554
alibabacloudDigest: sha256:176321a65123373ff8c7823b25183102cbad98375e8d6c80b96d68b6e8491103
useDigest: true
pullPolicy: "IfNotPresent"
suffix: ""
@ -3344,9 +3443,9 @@ preflight:
# @schema
override: ~
repository: "quay.io/cilium/cilium"
tag: "v1.19.1"
tag: "v1.19.3"
# cilium-digest
digest: sha256:41f1f74a0000de8656f1de4088ea00c8f2d49d6edea579034c73c5fd5fe01792
digest: sha256:2e61680593cddca8b6c055f6d4c849d87a26a1c91c7e3b8b56c7fb76ab7b7b10
useDigest: true
pullPolicy: "IfNotPresent"
envoy:
@ -3357,9 +3456,9 @@ preflight:
# @schema
override: ~
repository: "quay.io/cilium/cilium-envoy"
tag: "v1.35.9-1770979049-232ed4a26881e4ab4f766f251f258ed424fff663"
tag: "v1.36.6-1776000132-2437d2edeaf4d9b56ef279bd0d71127440c067aa"
pullPolicy: "IfNotPresent"
digest: "sha256:8188114a2768b5f49d6ce58e168b20d765e0fbc64eee0d83241aa2b150ccd788"
digest: "sha256:ba0ab8adac082d50d525fd2c5ba096c8facea3a471561b7c61c7a5b9c2e0de0d"
useDigest: true
# -- The priority class to use for the preflight pod.
priorityClassName: ""
@ -3603,9 +3702,9 @@ clustermesh:
# @schema
override: ~
repository: "quay.io/cilium/clustermesh-apiserver"
tag: "v1.19.1"
tag: "v1.19.3"
# clustermesh-apiserver-digest
digest: sha256:56d6c3dc13b50126b80ecb571707a0ea97f6db694182b9d61efd386d04e5bb28
digest: sha256:a8136a7615d6c6041d3aa6f2674d17beaec238170d669507ccc05328a778e2b7
useDigest: true
pullPolicy: "IfNotPresent"
# -- TCP port for the clustermesh-apiserver health API.
@ -4140,7 +4239,7 @@ authentication:
override: ~
repository: "docker.io/library/busybox"
tag: "1.37.0"
digest: "sha256:b3255e7dfbcd10cb367af0d409747d511aeb66dfac98cf30e97e87e4207dd76f"
digest: "sha256:1487d0af5f52b4ba31c7e465126ee2123fe3f2305d638e7827681e7cf6c83d5e"
useDigest: true
pullPolicy: "IfNotPresent"
# SPIRE agent configuration

106
packages/system/cilium/charts/cilium/values.yaml.tmpl
View file

@ -213,6 +213,12 @@ serviceAccounts:
name: cilium-coredns-mcsapi-autoconfig
automount: true
annotations: {}
# -- Ztunnel is used if encryption.type=ztunnel
ztunnel:
create: true
name: ztunnel-cilium
automount: false
annotations: {}
# -- Configure termination grace period for cilium-agent DaemonSet.
terminationGracePeriodSeconds: 1
# -- Install the cilium agent resources.
@ -221,6 +227,22 @@ agent: true
name: cilium
# -- Roll out cilium agent pods automatically when configmap is updated.
rollOutCiliumPods: false
# -- Configuration for the ConfigMap drift detection feature.
# When enabled, the agent continuously watches the cilium-config ConfigMap
# and exposes a cilium_drift_checker_config_delta Prometheus metric reporting
# the number of keys that differ between the ConfigMap and the agent's active
# settings. A non-zero value indicates that the agent has not yet applied all
# current ConfigMap changes and needs to be restarted.
configDriftDetection:
# -- Enable watching of the cilium-config ConfigMap and reflecting its
# contents into the agent's internal DynamicConfig table.
enabled: true
# -- Enable the drift checker which compares the DynamicConfig table against
# the agent's active settings and publishes the
# cilium_drift_checker_config_delta metric.
driftChecker: true
# -- List of config-map keys to ignore when computing the drift delta.
ignoredKeys: []
# -- Agent container image.
image:
# @schema
@ -1148,9 +1170,89 @@ encryption:
wireguard:
# -- Controls WireGuard PersistentKeepalive option. Set 0s to disable.
persistentKeepalive: 0s
# -- ztunnel encryption configuration.
# ztunnel is Istio's purpose-built, per-node proxy for handling L4 traffic in ambient mesh mode.
# These settings only apply when encryption.type is set to "ztunnel".
ztunnel:
# -- ztunnel container image.
image:
# @schema
# type: [null, string]
# @schema
override: ~
repository: "docker.io/istio/ztunnel"
tag: "1.28.0-distroless"
pullPolicy: "IfNotPresent"
# @schema
# type: [null, string]
# @schema
digest: ~
useDigest: false
# -- CA server address for certificate requests.
caAddress: "https://localhost:15012"
# -- TCP port for the health API.
healthPort: 15021
# -- ztunnel resource limits & requests.
resources:
requests:
cpu: 200m
memory: 512Mi
# -- ztunnel update strategy.
updateStrategy:
type: RollingUpdate
rollingUpdate:
maxSurge: 1
maxUnavailable: 0
# -- Configure termination grace period for ztunnel DaemonSet.
terminationGracePeriodSeconds: 30
# -- Readiness probe configuration.
readinessProbe:
initialDelaySeconds: 0
periodSeconds: 10
failureThreshold: 3
# -- Node selector for ztunnel pods.
nodeSelector:
kubernetes.io/os: linux
# -- Node tolerations for ztunnel scheduling.
tolerations:
- effect: NoSchedule
operator: Exists
- key: CriticalAddonsOnly
operator: Exists
- effect: NoExecute
operator: Exists
# -- Affinity for ztunnel pods.
affinity: {}
# @schema
# type: [null, string]
# @schema
# -- The priority class to use for ztunnel pods.
priorityClassName: ~
# -- Annotations to be added to all ztunnel resources.
annotations: {}
# -- Annotations to be added to ztunnel pods.
podAnnotations: {}
# -- Labels to be added to ztunnel pods.
podLabels: {}
# -- Additional ztunnel container environment variables.
extraEnv: []
# -- Additional ztunnel volumes.
extraVolumes: []
# -- Additional ztunnel volumeMounts.
extraVolumeMounts: []
# -- ztunnel secrets configuration.
secrets:
# -- Base64-encoded bootstrap root certificate content.
# If not provided, the secret must be created manually before deploying.
# @schema
# type: [null, string]
# @schema
bootstrapRootCert: ~
endpointHealthChecking:
# -- Enable connectivity health checking between virtual endpoints.
enabled: true
# -- Max duration to wait for envoy to respond to configuration changes. Default "10s".
endpointPolicyUpdateTimeoutDuration: null
endpointRoutes:
# @schema
# type: [boolean, string]
@ -2339,8 +2441,6 @@ enableMasqueradeRouteSource: false
enableIPv4BIGTCP: false
# -- Enables IPv6 BIG TCP support which increases maximum IPv6 GSO/GRO limits for nodes and pods
enableIPv6BIGTCP: false
# -- Enable BIG TCP in tunneling mode and increase maximum GRO/GSO limits for VXLAN/GENEVE tunnels
enableTunnelBIGTCP: false
nat:
# -- Number of the top-k SNAT map connections to track in Cilium statedb.
@ -2420,7 +2520,7 @@ loadBalancer:
# -- serviceTopology enables K8s Topology Aware Hints -based service
# endpoints filtering
# serviceTopology: false
serviceTopology: false
# -- L7 LoadBalancer
l7:

2
packages/system/cilium/images/cilium/Dockerfile
View file

@ -1,2 +1,2 @@
ARG VERSION=v1.19.1
ARG VERSION=v1.19.3
FROM quay.io/cilium/cilium:${VERSION}

4
packages/system/cilium/values.yaml
View file

@ -15,8 +15,8 @@ cilium:
mode: "kubernetes"
image:
repository: ghcr.io/cozystack/cozystack/cilium
tag: 1.19.1
digest: "sha256:ab3acf270821df4614a8456348a4e0d3098aed72a4b2016a0edfa30d91428c3d"
tag: 1.19.3
digest: "sha256:700f06f4803a838a8e830be5ace4650e3ad82bdefabfb2f4d110368d307a5efb"
envoy:
enabled: false
rollOutCiliumPods: true