JJGadgets
8a6f98ae6c
* fix(cilium): disable BPF masquerade It could cause issues/complications with more advanced networking configuration on the host (e.g. using FRR OpenFabric for host-level routing between nodes, or using other eBPF apps with Cilium). There's also no real advantage to using in homelab, so it should be safer to disable this. * fix(cilium): disable BPF masquerade It could cause issues/complications with more advanced networking configuration on the host (e.g. using FRR OpenFabric for host-level routing between nodes, or using other eBPF apps with Cilium). There's also no real advantage to using in homelab, so it should be safer to disable this.
129 lines
2.6 KiB
YAML
129 lines
2.6 KiB
YAML
autoDirectNodeRoutes: true
|
|
bgpControlPlane:
|
|
enabled: true
|
|
bpf:
|
|
masquerade: false
|
|
cgroup:
|
|
automount:
|
|
enabled: false
|
|
hostRoot: /sys/fs/cgroup
|
|
cluster:
|
|
id: 1
|
|
name: home-kubernetes
|
|
containerRuntime:
|
|
integration: containerd
|
|
#% if bootstrap_distribution in ["k3s"] %#
|
|
socketPath: /var/run/k3s/containerd/containerd.sock
|
|
#% endif %#
|
|
# NOTE: This might need to be set if you have more than one active NIC on your hosts
|
|
# devices:
|
|
# - eno0
|
|
endpointRoutes:
|
|
enabled: true
|
|
#% if bootstrap_cloudflare.enabled %#
|
|
hubble:
|
|
enabled: true
|
|
metrics:
|
|
enabled:
|
|
- dns:query
|
|
- drop
|
|
- tcp
|
|
- flow
|
|
- port-distribution
|
|
- icmp
|
|
- http
|
|
serviceMonitor:
|
|
enabled: true
|
|
dashboards:
|
|
enabled: true
|
|
annotations:
|
|
grafana_folder: Cilium
|
|
relay:
|
|
enabled: true
|
|
rollOutPods: true
|
|
prometheus:
|
|
serviceMonitor:
|
|
enabled: true
|
|
ui:
|
|
enabled: true
|
|
rollOutPods: true
|
|
ingress:
|
|
enabled: true
|
|
className: internal
|
|
hosts:
|
|
- "hubble.${SECRET_DOMAIN}"
|
|
tls:
|
|
- hosts:
|
|
- "hubble.${SECRET_DOMAIN}"
|
|
#% else %#
|
|
hubble:
|
|
enabled: false
|
|
#% endif %#
|
|
ipam:
|
|
mode: kubernetes
|
|
ipv4NativeRoutingCIDR: "${CLUSTER_CIDR}"
|
|
#% if bootstrap_feature_gates.dual_stack_ipv4_first %#
|
|
ipv6NativeRoutingCIDR: "${CLUSTER_CIDR_V6}"
|
|
ipv6:
|
|
enabled: true
|
|
#% endif %#
|
|
#% if bootstrap_distribution in ["k3s"] %#
|
|
k8sServiceHost: 127.0.0.1
|
|
k8sServicePort: 6444
|
|
#% elif bootstrap_distribution in ["talos"] %#
|
|
k8sServiceHost: 127.0.0.1
|
|
k8sServicePort: 7445
|
|
#% endif %#
|
|
kubeProxyReplacement: true
|
|
kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
|
|
l2announcements:
|
|
#% if ((bootstrap_bgp.enabled) or (bootstrap_feature_gates.dual_stack_ipv4_first)) %#
|
|
enabled: false # https://github.com/cilium/cilium/issues/28985
|
|
#% else %#
|
|
enabled: true
|
|
#% endif %#
|
|
loadBalancer:
|
|
algorithm: maglev
|
|
mode: dsr
|
|
localRedirectPolicy: true
|
|
operator:
|
|
replicas: 1
|
|
rollOutPods: true
|
|
prometheus:
|
|
enabled: true
|
|
serviceMonitor:
|
|
enabled: true
|
|
dashboards:
|
|
enabled: true
|
|
annotations:
|
|
grafana_folder: Cilium
|
|
prometheus:
|
|
enabled: true
|
|
serviceMonitor:
|
|
enabled: true
|
|
trustCRDsExist: true
|
|
dashboards:
|
|
enabled: true
|
|
annotations:
|
|
grafana_folder: Cilium
|
|
rollOutCiliumPods: true
|
|
routingMode: native
|
|
securityContext:
|
|
capabilities:
|
|
ciliumAgent:
|
|
- CHOWN
|
|
- KILL
|
|
- NET_ADMIN
|
|
- NET_RAW
|
|
- IPC_LOCK
|
|
- SYS_ADMIN
|
|
- SYS_RESOURCE
|
|
- DAC_OVERRIDE
|
|
- FOWNER
|
|
- SETGID
|
|
- SETUID
|
|
cleanCiliumState:
|
|
- NET_ADMIN
|
|
- SYS_ADMIN
|
|
- SYS_RESOURCE
|