autoDirectNodeRoutes: true
bgpControlPlane:
  enabled: true
bpf:
  masquerade: false
cgroup:
  automount:
    enabled: false
  hostRoot: /sys/fs/cgroup
cluster:
  id: 1
  name: home-kubernetes
containerRuntime:
  integration: containerd
  #% if bootstrap_distribution in ["k3s"] %#
  socketPath: /var/run/k3s/containerd/containerd.sock
  #% endif %#
# NOTE: devices might need to be set if you have more than one active NIC on your hosts
# devices: eno+ eth+
endpointRoutes:
  enabled: true
hubble:
  enabled: false
ipam:
  mode: kubernetes
ipv4NativeRoutingCIDR: "#{ bootstrap_pod_network }#"
#% if bootstrap_feature_gates.dual_stack_ipv4_first %#
ipv6NativeRoutingCIDR: "#{ bootstrap_pod_network_v6 }#"
ipv6:
  enabled: true
#% endif %#
#% if bootstrap_distribution in ["k3s"] %#
k8sServiceHost: 127.0.0.1
k8sServicePort: 6444
#% elif bootstrap_distribution in ["talos"] %#
k8sServiceHost: 127.0.0.1
k8sServicePort: 7445
#% endif %#
kubeProxyReplacement: true
kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
l2announcements:
  #% if ((bootstrap_bgp.enabled) or (bootstrap_feature_gates.dual_stack_ipv4_first)) %#
  enabled: false # https://github.com/cilium/cilium/issues/28985
  #% else %#
  enabled: true
  #% endif %#
loadBalancer:
  algorithm: maglev
  mode: dsr
localRedirectPolicy: true
operator:
  replicas: 1
  rollOutPods: true
rollOutCiliumPods: true
routingMode: native
securityContext:
  capabilities:
    ciliumAgent:
      - CHOWN
      - KILL
      - NET_ADMIN
      - NET_RAW
      - IPC_LOCK
      - SYS_ADMIN
      - SYS_RESOURCE
      - DAC_OVERRIDE
      - FOWNER
      - SETGID
      - SETUID
    cleanCiliumState:
      - NET_ADMIN
      - SYS_ADMIN
      - SYS_RESOURCE