testing deployment of Cilium v1.11.2 in a talos based cluster.

cilium.yaml

---
# Source: cilium/templates/cilium-agent/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: "cilium"
  namespace: kube-system
---
# Source: cilium/templates/cilium-operator/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: "cilium-operator"
  namespace: kube-system
---
# Source: cilium/templates/hubble/tls-helm/ca-secret.yaml
apiVersion: v1
kind: Secret
metadata:
  name: hubble-ca-secret
  namespace: kube-system
data:
  ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURLRENDQWhDZ0F3SUJBZ0lSQVA1elVMUnhDT3g2b250ajFFSENBZTB3RFFZSktvWklodmNOQVFFTEJRQXcKSGpFY01Cb0dBMVVFQXhNVGFIVmlZbXhsTFdOaExtTnBiR2wxYlM1cGJ6QWVGdzB5TWpBek1qRXlNVEl3TWpWYQpGdzB5TlRBek1qQXlNVEl3TWpWYU1CNHhIREFhQmdOVkJBTVRFMmgxWW1Kc1pTMWpZUzVqYVd4cGRXMHVhVzh3CmdnRWlNQTBHQ1NxR1NJYjNEUUVCQVFVQUE0SUJEd0F3Z2dFS0FvSUJBUURkYkRTWm1WZXZ0VHNJL2xtL2JNekgKcGVWS2ZLVnNJMWd6UDBiOWM1c3pCWXNINGJFR1k5MGhoajVpUkwyUFBHalZQd2lXU2YyNWNmaWlUdzVuWFlnTwpGSENVZHd4ZFlNVjV1NGZHZ1dCL25ocFY5Z0JOLzlWSzF3dXp3TGsxZ3NaKzVNSnR0OW1RdG5aRjRkZFllV1FVCjd1WEFvRWFsdXRWeWNVZHZka2EyYWtGc2FoSW96d0RXUHhtZ2I1N2tkcTFiOERjKzhwdHpLV3pTWE8wcVZpWVYKZVk4bnRJK2RxNlNCRE5NOTRabFJFR2ZIcFB5eGxOd3l2aGk1M2lzREcxS2pMSGlzZWtVRU1UL3hmaEFTdFh6ZwozYml4M0U0KzJkNXhuei8vQ2dPRzBtUUw0SkFySHYvMVhhejFYcDZmWStMVFBKMS9DV2FDUVpIRVlkcXVCVGl4CkFnTUJBQUdqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDcERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FValdDTStZSFUvbWYrZ1A2MgpobndML3RBWnFEOHdEUVlKS29aSWh2Y05BUUVMQlFBRGdnRUJBTUpnK2c1NkN3Zm0yZm1yQld2YTAyZjFCWWdFCis0TmVZS1IvTzFRQ1FDRzNLb21lRXBNcitCTS9oSFdHUWhzeForYlY3cm9yR2ZEVUFSRmNCUU80KzdBQUJzNm0KMnBDV2poUSszM2xBSUNhZEY3dVFSdlN1aHRFQWo0YmZBQ3hXVnR4WUZHWjBCc0FqaXpZcmdBRlJ1M05hdVR0WQozNWpuTWpyNlBQNit0WDdrNUdXQ09PMkFsRFREWnk5RlVWU2JtczNBRkpXWVZFQWthaytSY3gxdkFxS1lrdVk3CktoaGJoVzJYMWVGYkVraENZcFN4MGVLV3ZJcEh0eEFvUURJYzRMNHovUjJ5ZGl2MVRpd2gzTWxyLy8rRmhVWWsKSy9idTgzRzBPMFpQUmRJQTcyY0piQTN5cStVNE1VQVZxSnhTb2pnQnNkRDFwZnhOT0FyR2ZERnphb1U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
  ca.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcFFJQkFBS0NBUUVBM1d3MG1abFhyN1U3Q1A1WnYyek14NlhsU255bGJDTllNejlHL1hPYk13V0xCK0d4CkJtUGRJWVkrWWtTOWp6eG8xVDhJbGtuOXVYSDRvazhPWjEySURoUndsSGNNWFdERmVidUh4b0ZnZjU0YVZmWUEKVGYvVlN0Y0xzOEM1TllMR2Z1VENiYmZaa0xaMlJlSFhXSGxrRk83bHdLQkdwYnJWY25GSGIzWkd0bXBCYkdvUwpLTThBMWo4Wm9HK2U1SGF0Vy9BM1B2S2JjeWxzMGx6dEtsWW1GWG1QSjdTUG5hdWtnUXpUUGVHWlVSQm54NlQ4CnNaVGNNcjRZdWQ0ckF4dFNveXg0ckhwRkJERS84WDRRRXJWODROMjRzZHhPUHRuZWNaOC8vd29EaHRKa0MrQ1EKS3g3LzlWMnM5VjZlbjJQaTB6eWRmd2xtZ2tHUnhHSGFyZ1U0c1FJREFRQUJBb0lCQVFDU2JMc0FGRHE3ZEdLYwoyTzdxdXYxVXphMHFxL0VNNlBhcnRSMngvK0JUUmtnaHB5dFU2WGRUY3g0UUNCcysvSmpxNUNzK2o2R2RIL1JuCkNWYWlIbVVad29TTWVZbVF1cXo4aW5vSVdJaEMvSCszOXQxT3QyOEtkZGxFUHA5NzlvWmpaYzM1bG9ubXUvTE0KMWNOOXU1RG1rdkVXaUNjUDg5U3hRSjRYNUtSd2ZlcHhVbG1FY0JxUjErQ3JmSU9SbVQzUEZNQWNaNXFvbHJCOAo5dm5NQ1M4VlkxdFpZcC96YndHWTdmWmo0RzE5ZnRYbEE3ZFZzVWxWamxEaHpLUVBFbkZYYVJRWWZUeG1Nd1ZyClBoVXBQWlBpaWExbnE0TkUyTkk4SnBId29GeVVWcEZEakl3amJNdE9NZUpqSld1dTVZZkh4aTlFZEV0cGphR3oKUUpBTm9LSlJBb0dCQVB2TWQ4a1BOUTN4K2QyakdFZEtPdjFoK0xzeDNld1RIRG9VQkp1TjVRd2kzNkpmWVBGSwp6Rk96S2JhZXJZRTMwN2hLcjZicHF0cDBrUTZoQkhXUXpzREt0NEs3eTBLTkpqUm5WR0kvVFpmVHBFNmFiQ1pGCmwwVStJNVJvc0JhVjNCQ3AxaGNsekMyUG9YVlJFQWFpcjI0dW14Nmp5eU5oZnNPbnd6VXFLTlZGQW9HQkFPRWQKL1ZDUlRxMUhhTmdZZFhHTGhTZS94Ny9uS1BtV3JyOEJZVUJmNkdXVkY1V2FrK1BBMlAwNHdmdmhldThFTTFtcQoySGpJYktCWnV4ZWxtUEN6VTA2Ym9YN3lwSXlUK29tWkJBZ2xpQUtKejBqK04wN3RmTFJPNFdxYXA5ZXZIR3AzCmJsVEFvZUcxVE9GYWRiZGJYakZoRXRmYUtqSjdzUnREUkdNU3F4NTlBb0dBZmM0aTZ5blY4Q20rRmFhdk1xODcKMmUxaFFPWWhZeG9KT0Z0WUVnQkxPRTBVUHlRNFkxWmowRTNyd1hwMlplRm12dVZSN2F0QjJmUHpwY045WHVBQwo3UUJidjgza09GUWRpb0UyQUFCdzNESzZIU3U2YlVUSDE2aThUaUlnR0tpM1V2d0lJM2lYRXd4NE53MVJYSDliCjkwa0I1OFVlY1liOHR2VFM2M1V0QWFFQ2dZRUF5NkRGNzJmUTVCcXc4cStGSkhVUXVEallwWFNpY3NualBYRXgKRi9ycEMySUdXRlBmckdkWG9BNEVJaVArZ0UrcloxT0x4ZzE5ZkxwTjZ3RG15K3RaMHNRaUcrTytCazhnay9CdQpYalFjeURjQjRrUFpvYkplVi9iMkhlalJJOThJOUNFZUV0bkFWSnNiZE1qUHJGQ2dia2dodEZCcVZRbmYxUXBPCnhOTXhLRDBDZ1lFQWd0WUlpdThqRDlUK3JxMUcwUVhDN053RjBiY0dCa1NWM1N5RDIra3lFTktkdDVHQ2VvNEcKQ2YvVjFjS3hCK2txSDRkVmxhSW41L01ha3BiTnJ1Y0tNWEJyRVk5R05CV2tXYzF5QWVob1NhcHZBbE5uWVlEdAo4MkQyMTVEOWg2VTk4eXZyeWhEM2hvWm5RR2NOQ2J3TzNlcFBSNWVSMDlnT3QyVVdEcFNlUFA0PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=
---
# Source: cilium/templates/hubble/tls-helm/server-secret.yaml
apiVersion: v1
kind: Secret
metadata:
  name: hubble-server-certs
  namespace: kube-system
type: kubernetes.io/tls
data:
  ca.crt:  LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURLRENDQWhDZ0F3SUJBZ0lSQVA1elVMUnhDT3g2b250ajFFSENBZTB3RFFZSktvWklodmNOQVFFTEJRQXcKSGpFY01Cb0dBMVVFQXhNVGFIVmlZbXhsTFdOaExtTnBiR2wxYlM1cGJ6QWVGdzB5TWpBek1qRXlNVEl3TWpWYQpGdzB5TlRBek1qQXlNVEl3TWpWYU1CNHhIREFhQmdOVkJBTVRFMmgxWW1Kc1pTMWpZUzVqYVd4cGRXMHVhVzh3CmdnRWlNQTBHQ1NxR1NJYjNEUUVCQVFVQUE0SUJEd0F3Z2dFS0FvSUJBUURkYkRTWm1WZXZ0VHNJL2xtL2JNekgKcGVWS2ZLVnNJMWd6UDBiOWM1c3pCWXNINGJFR1k5MGhoajVpUkwyUFBHalZQd2lXU2YyNWNmaWlUdzVuWFlnTwpGSENVZHd4ZFlNVjV1NGZHZ1dCL25ocFY5Z0JOLzlWSzF3dXp3TGsxZ3NaKzVNSnR0OW1RdG5aRjRkZFllV1FVCjd1WEFvRWFsdXRWeWNVZHZka2EyYWtGc2FoSW96d0RXUHhtZ2I1N2tkcTFiOERjKzhwdHpLV3pTWE8wcVZpWVYKZVk4bnRJK2RxNlNCRE5NOTRabFJFR2ZIcFB5eGxOd3l2aGk1M2lzREcxS2pMSGlzZWtVRU1UL3hmaEFTdFh6ZwozYml4M0U0KzJkNXhuei8vQ2dPRzBtUUw0SkFySHYvMVhhejFYcDZmWStMVFBKMS9DV2FDUVpIRVlkcXVCVGl4CkFnTUJBQUdqWVRCZk1BNEdBMVVkRHdFQi93UUVBd0lDcERBZEJnTlZIU1VFRmpBVUJnZ3JCZ0VGQlFjREFRWUkKS3dZQkJRVUhBd0l3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFkQmdOVkhRNEVGZ1FValdDTStZSFUvbWYrZ1A2MgpobndML3RBWnFEOHdEUVlKS29aSWh2Y05BUUVMQlFBRGdnRUJBTUpnK2c1NkN3Zm0yZm1yQld2YTAyZjFCWWdFCis0TmVZS1IvTzFRQ1FDRzNLb21lRXBNcitCTS9oSFdHUWhzeForYlY3cm9yR2ZEVUFSRmNCUU80KzdBQUJzNm0KMnBDV2poUSszM2xBSUNhZEY3dVFSdlN1aHRFQWo0YmZBQ3hXVnR4WUZHWjBCc0FqaXpZcmdBRlJ1M05hdVR0WQozNWpuTWpyNlBQNit0WDdrNUdXQ09PMkFsRFREWnk5RlVWU2JtczNBRkpXWVZFQWthaytSY3gxdkFxS1lrdVk3CktoaGJoVzJYMWVGYkVraENZcFN4MGVLV3ZJcEh0eEFvUURJYzRMNHovUjJ5ZGl2MVRpd2gzTWxyLy8rRmhVWWsKSy9idTgzRzBPMFpQUmRJQTcyY0piQTN5cStVNE1VQVZxSnhTb2pnQnNkRDFwZnhOT0FyR2ZERnphb1U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURZVENDQWttZ0F3SUJBZ0lSQU04L1Jtc0NGb0s1TFlhRjVDTytBUTR3RFFZSktvWklodmNOQVFFTEJRQXcKSGpFY01Cb0dBMVVFQXhNVGFIVmlZbXhsTFdOaExtTnBiR2wxYlM1cGJ6QWVGdzB5TWpBek1qRXlNVEl3TWpWYQpGdzB5TlRBek1qQXlNVEl3TWpWYU1Db3hLREFtQmdOVkJBTU1IeW91WkdWbVlYVnNkQzVvZFdKaWJHVXRaM0p3Cll5NWphV3hwZFcwdWFXOHdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCRHdBd2dnRUtBb0lCQVFDZEhrU04KWWt1YnVjeis1QWl2ZFdDRkovcHhoaDZCKzlkRE1RTERITGFISmRrUzNUNTZmTWtoQXYxVFBDUnRJektmZHVxeQpicTdVQ1p6WUR2bmg5Y0NFNldHb3V2UXFXMmVsUlJ6R2d0ejd6anc2UzRDeFdjdFFSTktNbFZzanZwd2NSS3Y2Cms0a256Z1FQMGt6R2EyYlFrR29JS1NoRDdEWlNmSmNlMGN5RGQzUWdKeUx2Mk5OeDF3YjY2TDVjZWVTcG95MFUKclBNNHRwOUlNU3pvMlNoclRVM2RUNzZqWWFwVERXSVJidUlWT240dWU2RkhBenJBWDZ3OUY3QnhObHAyS09Tbwoya1ArK05MSm40Y205TDh5alNJMW5zU0JNKzNiK1FvQWxYdXc0U0V4YnpreXI4Z0hBYmRqMHFjdjljMVZXL1Q4CitxTWp2b3pXZXdFN2xHWHJBZ01CQUFHamdZMHdnWW93RGdZRFZSMFBBUUgvQkFRREFnV2dNQjBHQTFVZEpRUVcKTUJRR0NDc0dBUVVGQndNQkJnZ3JCZ0VGQlFjREFqQU1CZ05WSFJNQkFmOEVBakFBTUI4R0ExVWRJd1FZTUJhQQpGSTFnalBtQjFQNW4vb0QrdG9aOEMvN1FHYWcvTUNvR0ExVWRFUVFqTUNHQ0h5b3VaR1ZtWVhWc2RDNW9kV0ppCmJHVXRaM0p3WXk1amFXeHBkVzB1YVc4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQkFMaGdvQmF2bW1KaUpuc0oKZGJpQXFUNThVYUdEZHBJWG9JM2gwQzd1cnJhdk12ME5vb1pXd01sMjVsNUE4bmtPQlIzdUoyUGZYV1E0cVhMcQpXd3grTmh3SmFlb0puVHBVMkpYZlluazVoK3hkZW5jcVIyUWN5eVp1ZHVnZGxlNmdOeDFuS1dNL2Uvb3BPNk94CnBVTmQ4QXIzSFpVUEVKVjJXbEZ5bEJndGRTWDA5RUQ4VHdIaVpZK0d4ZWNGaEFEbk9EZ2s3MzNYWEpsMElzL28KcVNKbFVqNmVWTWhGWm04TUJ0R0JCYi8ydG03dENCVjJ3SjA1S2R6ZUVhTUNvdWcxZUhVc2ppV2ZtTXFITGJoMwphcVl4ZVRaNWlnYWRiUm5RcUY4UkN1aVVsZXh6QzBFR054NEtMNysraVEzZnQyM3VNL1pteHNDSTQrenRiREU1CmVkTS9vYzg9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
  tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBblI1RWpXSkxtN25NL3VRSXIzVmdoU2Y2Y1lZZWdmdlhRekVDd3h5Mmh5WFpFdDArCmVuekpJUUw5VXp3a2JTTXluM2Jxc202dTFBbWMyQTc1NGZYQWhPbGhxTHIwS2x0bnBVVWN4b0xjKzg0OE9rdUEKc1ZuTFVFVFNqSlZiSTc2Y0hFU3IrcE9KSjg0RUQ5Sk14bXRtMEpCcUNDa29RK3cyVW55WEh0SE1nM2QwSUNjaQo3OWpUY2RjRyt1aStYSG5rcWFNdEZLenpPTGFmU0RFczZOa29hMDFOM1UrK28yR3FVdzFpRVc3aUZUcCtMbnVoClJ3TTZ3RitzUFJld2NUWmFkaWprcU5wRC92alN5WitISnZTL01vMGlOWjdFZ1RQdDIva0tBSlY3c09FaE1XODUKTXEvSUJ3RzNZOUtuTC9YTlZWdjAvUHFqSTc2TTFuc0JPNVJsNndJREFRQUJBb0lCQUFVZVVrOWt6MS9BV3N4Rwo4MzE3em13b0ZFR1VnL1BxRjJZcDk1UVJvR1NndUFTa1RuL0JCdkJiWDVOUmwwSXk3bGhCa0gzRm0wNXZEYndBCktPWFNrcllCd0Z1MTAzUjV5OU9YZjh0N3dlVTJIOElxYVlQZGtBRUtiTzJGaEJXVEJSVHFxOHVhK05IaUpVRzYKc1NPWnBoelBSNVVDZWp4VU9xVFBTRUVKeHFiVnRWS0VmVG9QRm1ZMFB4UTBKU0F6MDdTVGRwRitLUlo4eWtFZgphd2d5TUlBUVBGQWorbzhLNXliVkxlbytqU3hLYVlUSUgrOHdzOU54RHJXZjJFM1Fwd0RHOGJ3bmh6bVN0bzkyCmhJV3o1UmxiZEhHZWFQMmhrVjdpMFBRWEhRaVljVFRkZ1pkR1RMdDVtNk9kTys5V1hnaU11WnZKbkUraStJZ1oKOWduMEhza0NnWUVBeDNUV0FyRWxkVWNCYjhqMC9VTThEMlBUS05xN29pbEJHUUYwcTdvRytsNlVKMkxrVzZWQwp3dlptc3F2d1I4RElJdDZ0WnlPMU53ZjVIZGpWekNuaUJWSU8yTHp0Rk95UWpUTnpTU01DR2tEbXlMOHp6Qk9CCkNuMGxWRkVwdlZmdVBKbUxITnoxcjkzekVJdjMvYVJ6TzBMdWNReGJ4Y3dqc0NBVDYyQyt3dVVDZ1lFQXlhalMKUzdTSDZDVUFYUHlSSnR0KzFWZ2pWWWN4NEdRQjl6MFFMa0VGTFM0V3dJTkI3MmFBOXIzYS9wcU9uc2tMbnEwRAorcXR4SlNncTB5TFhpeHZ0dHU3ZW9hdzVoTXJ6V043VG9oeGIwMi8yODBzbU1PWkI3NnFWMjNlSldIWkUwQTF2CkJ3U1FQd2w3Snp4NGcxaWlMbkNWVGlrUjluNHVVNmFpeUNwdTZJOENnWUVBajVVU0Fyb1had2VJaHpvNDhxQ1YKK2RZNHlpNDc2STZlS0N3ZUd3azl3THFaR0lsZUxvTVhQbFkycytTR2dvRExFaDhPNFRLWlgxWkVCVEoxSmhYNAplVEFMTkFjOC9GVVg4aTNaamdxL2xycWw2Rm1NSmhyY1IvcXpCckd1eEhrcUxVR3pIVUlMTTJFcGV2M250aFhPClJoajJvVGJ1VWNPVTVWTVNROTFQTmVrQ2dZQW5DYzZFSjFPMEJnMjI4cEhxOHN6djRoc2RBSW9RUld2My85TTEKRVJNK2R0Q2l2Z1l5b1NaUUhkcmFOUE50RzhCckhGVkwzb3FOeGVQY2NiOUdSOGJTQmhZRk9FRCtTd2VtNmFRUQptdXJQMkxuMnlWS0FYdUxlMGFnbkQxSUFWUXpuTmVLTGVqK3VaRmg1OVFQamNYSWNDV0Z0K3hkbUgzRTZjbVRLCjJTUVZVd0tCZ0VkME5sT0hQYjgwK0pxVVU2a2FUOEhPMTNmTDUyMmQ1K1htU2Z2WWFTOTVLMmRyVVI4RnBxS3MKd2QyN1EwUDdPVXo3bWxycVh2UFpmYm9waFpSZjZpbXhqK0hyWERhb1JCWjFGaG5VKzVxc2NGYkZxUm03K3dVegpLbDJaYnkvSy9ncjZoWThwUVlZQ1JKVmZ0MjA2NGM3enBiMnVrZlRERlkyeVErWUp1RVE4Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==
---
# Source: cilium/templates/cilium-configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: cilium-config
  namespace: kube-system
data:

  # Identity allocation mode selects how identities are shared between cilium
  # nodes by setting how they are stored. The options are "crd" or "kvstore".
  # - "crd" stores identities in kubernetes as CRDs (custom resource definition).
  #   These can be queried with:
  #     kubectl get ciliumid
  # - "kvstore" stores identities in an etcd kvstore, that is
  #   configured below. Cilium versions before 1.6 supported only the kvstore
  #   backend. Upgrades from these older cilium versions should continue using
  #   the kvstore by commenting out the identity-allocation-mode below, or
  #   setting it to "kvstore".
  identity-allocation-mode: crd
  cilium-endpoint-gc-interval: "5m0s"
  # Disable the usage of CiliumEndpoint CRD
  disable-endpoint-crd: "false"

  # If you want to run cilium in debug mode change this value to true
  debug: "false"
  # The agent can be put into the following three policy enforcement modes
  # default, always and never.
  # https://docs.cilium.io/en/latest/policy/intro/#policy-enforcement-modes
  enable-policy: "default"

  # Enable IPv4 addressing. If enabled, all endpoints are allocated an IPv4
  # address.
  enable-ipv4: "true"

  # Enable IPv6 addressing. If enabled, all endpoints are allocated an IPv6
  # address.
  enable-ipv6: "false"
  # Users who wish to specify their own custom CNI configuration file must set
  # custom-cni-conf to "true", otherwise Cilium may overwrite the configuration.
  custom-cni-conf: "false"
  enable-bpf-clock-probe: "true"
  # If you want cilium monitor to aggregate tracing for packets, set this level
  # to "low", "medium", or "maximum". The higher the level, the less packets
  # that will be seen in monitor output.
  monitor-aggregation: medium

  # The monitor aggregation interval governs the typical time between monitor
  # notification events for each allowed connection.
  #
  # Only effective when monitor aggregation is set to "medium" or higher.
  monitor-aggregation-interval: 5s

  # The monitor aggregation flags determine which TCP flags which, upon the
  # first observation, cause monitor notifications to be generated.
  #
  # Only effective when monitor aggregation is set to "medium" or higher.
  monitor-aggregation-flags: all
  # Specifies the ratio (0.0-1.0) of total system memory to use for dynamic
  # sizing of the TCP CT, non-TCP CT, NAT and policy BPF maps.
  bpf-map-dynamic-size-ratio: "0.0025"
  # bpf-policy-map-max specifies the maximum number of entries in endpoint
  # policy map (per endpoint)
  bpf-policy-map-max: "16384"
  # bpf-lb-map-max specifies the maximum number of entries in bpf lb service,
  # backend and affinity maps.
  bpf-lb-map-max: "65536"
  # bpf-lb-bypass-fib-lookup instructs Cilium to enable the FIB lookup bypass
  # optimization for nodeport reverse NAT handling.
  bpf-lb-external-clusterip: "false"

  # Pre-allocation of map entries allows per-packet latency to be reduced, at
  # the expense of up-front memory allocation for the entries in the maps. The
  # default value below will minimize memory usage in the default installation;
  # users who are sensitive to latency may consider setting this to "true".
  #
  # This option was introduced in Cilium 1.4. Cilium 1.3 and earlier ignore
  # this option and behave as though it is set to "true".
  #
  # If this value is modified, then during the next Cilium startup the restore
  # of existing endpoints and tracking of ongoing connections may be disrupted.
  # As a result, reply packets may be dropped and the load-balancing decisions
  # for established connections may change.
  #
  # If this option is set to "false" during an upgrade from 1.3 or earlier to
  # 1.4 or later, then it may cause one-time disruptions during the upgrade.
  preallocate-bpf-maps: "false"

  # Regular expression matching compatible Istio sidecar istio-proxy
  # container image names
  sidecar-istio-proxy-image: "cilium/istio_proxy"

  # Name of the cluster. Only relevant when building a mesh of clusters.
  cluster-name: default
  # Unique ID of the cluster. Must be unique across all conneted clusters and
  # in the range of 1 and 255. Only relevant when building a mesh of clusters.
  cluster-id: ""

  # Encapsulation mode for communication between nodes
  # Possible values:
  #   - disabled
  #   - vxlan (default)
  #   - geneve
  tunnel: vxlan
  # Enables L7 proxy for L7 policy enforcement and visibility
  enable-l7-proxy: "true"

  enable-ipv4-masquerade: "true"
  enable-ipv6-masquerade: "true"

  enable-xt-socket-fallback: "true"
  install-iptables-rules: "true"
  install-no-conntrack-iptables-rules: "false"

  auto-direct-node-routes: "false"
  enable-bandwidth-manager: "false"
  enable-local-redirect-policy: "false"

  kube-proxy-replacement:  "disabled"
  enable-health-check-nodeport: "true"
  node-port-bind-protection: "true"
  enable-auto-protect-node-port-range: "true"
  enable-session-affinity: "true"
  enable-l2-neigh-discovery: "true"
  enable-endpoint-health-checking: "true"
  enable-health-checking: "true"
  enable-well-known-identities: "false"
  enable-remote-node-identity: "true"
  operator-api-serve-addr: "127.0.0.1:9234"
  # Enable Hubble gRPC service.
  enable-hubble: "true"
  # UNIX domain socket for Hubble server to listen to.
  hubble-socket-path:  "/var/run/cilium/hubble.sock"
  # An additional address for Hubble server to listen to (e.g. ":4244").
  hubble-listen-address: ":4244"
  hubble-disable-tls: "false"
  hubble-tls-cert-file: /var/lib/cilium/tls/hubble/server.crt
  hubble-tls-key-file: /var/lib/cilium/tls/hubble/server.key
  hubble-tls-client-ca-files: /var/lib/cilium/tls/hubble/client-ca.crt
  ipam: "kubernetes"
  disable-cnp-status-updates: "true"
  cgroup-root: "/run/cilium/cgroupv2"
  enable-k8s-terminating-endpoint: "true"
---
# Source: cilium/templates/cilium-agent/clusterrole.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cilium
rules:
- apiGroups:
  - networking.k8s.io
  resources:
  - networkpolicies
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - discovery.k8s.io
  resources:
  - endpointslices
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - namespaces
  - services
  - nodes
  - endpoints
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - pods
  - pods/finalizers
  verbs:
  - get
  - list
  - watch
  - update
  - delete
- apiGroups:
  - ""
  resources:
  - nodes
  verbs:
  - get
  - list
  - watch
  - update
- apiGroups:
  - ""
  resources:
  - nodes
  - nodes/status
  verbs:
  - patch
- apiGroups:
  - apiextensions.k8s.io
  resources:
  - customresourcedefinitions
  verbs:
  # Deprecated for removal in v1.10
  - create
  - list
  - watch
  - update

  # This is used when validating policies in preflight. This will need to stay
  # until we figure out how to avoid "get" inside the preflight, and then
  # should be removed ideally.
  - get
- apiGroups:
  - cilium.io
  resources:
  - ciliumnetworkpolicies
  - ciliumnetworkpolicies/status
  - ciliumnetworkpolicies/finalizers
  - ciliumclusterwidenetworkpolicies
  - ciliumclusterwidenetworkpolicies/status
  - ciliumclusterwidenetworkpolicies/finalizers
  - ciliumendpoints
  - ciliumendpoints/status
  - ciliumendpoints/finalizers
  - ciliumnodes
  - ciliumnodes/status
  - ciliumnodes/finalizers
  - ciliumidentities
  - ciliumidentities/finalizers
  - ciliumlocalredirectpolicies
  - ciliumlocalredirectpolicies/status
  - ciliumlocalredirectpolicies/finalizers
  - ciliumegressnatpolicies
  - ciliumendpointslices
  verbs:
  - '*'
---
# Source: cilium/templates/cilium-operator/clusterrole.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cilium-operator
rules:
- apiGroups:
  - ""
  resources:
  # to automatically delete [core|kube]dns pods so that are starting to being
  # managed by Cilium
  - pods
  verbs:
  - get
  - list
  - watch
  - delete
- apiGroups:
  - discovery.k8s.io
  resources:
  - endpointslices
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - services
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  # to perform LB IP allocation for BGP
  - services/status
  verbs:
  - update
- apiGroups:
  - ""
  resources:
  # to perform the translation of a CNP that contains `ToGroup` to its endpoints
  - services
  - endpoints
  # to check apiserver connectivity
  - namespaces
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - cilium.io
  resources:
  - ciliumnetworkpolicies
  - ciliumnetworkpolicies/status
  - ciliumnetworkpolicies/finalizers
  - ciliumclusterwidenetworkpolicies
  - ciliumclusterwidenetworkpolicies/status
  - ciliumclusterwidenetworkpolicies/finalizers
  - ciliumendpoints
  - ciliumendpoints/status
  - ciliumendpoints/finalizers
  - ciliumnodes
  - ciliumnodes/status
  - ciliumnodes/finalizers
  - ciliumidentities
  - ciliumendpointslices
  - ciliumidentities/status
  - ciliumidentities/finalizers
  - ciliumlocalredirectpolicies
  - ciliumlocalredirectpolicies/status
  - ciliumlocalredirectpolicies/finalizers
  verbs:
  - '*'
- apiGroups:
  - apiextensions.k8s.io
  resources:
  - customresourcedefinitions
  verbs:
  - create
  - get
  - list
  - update
  - watch
# For cilium-operator running in HA mode.
#
# Cilium operator running in HA mode requires the use of ResourceLock for Leader Election
# between multiple running instances.
# The preferred way of doing this is to use LeasesResourceLock as edits to Leases are less
# common and fewer objects in the cluster watch "all Leases".
- apiGroups:
  - coordination.k8s.io
  resources:
  - leases
  verbs:
  - create
  - get
  - update
---
# Source: cilium/templates/cilium-agent/clusterrolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cilium
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cilium
subjects:
- kind: ServiceAccount
  name: "cilium"
  namespace: kube-system
---
# Source: cilium/templates/cilium-operator/clusterrolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cilium-operator
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cilium-operator
subjects:
- kind: ServiceAccount
  name: "cilium-operator"
  namespace: kube-system
---
# Source: cilium/templates/cilium-agent/daemonset.yaml
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: cilium
  namespace: kube-system
  labels:
    k8s-app: cilium
spec:
  selector:
    matchLabels:
      k8s-app: cilium
  updateStrategy:
    rollingUpdate:
      maxUnavailable: 2
    type: RollingUpdate
  template:
    metadata:
      annotations:
        # This annotation plus the CriticalAddonsOnly toleration makes
        # cilium to be a critical pod in the cluster, which ensures cilium
        # gets priority scheduling.
        # https://kubernetes.io/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/
        scheduler.alpha.kubernetes.io/critical-pod: ""
      labels:
        k8s-app: cilium
    spec:
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: kubernetes.io/os
                operator: In
                values:
                - linux
            - matchExpressions:
              - key: beta.kubernetes.io/os
                operator: In
                values:
                - linux
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchExpressions:
              - key: k8s-app
                operator: In
                values:
                - cilium
            topologyKey: kubernetes.io/hostname
      containers:
      - name: cilium-agent
        image: "quay.io/cilium/cilium:v1.11.2@sha256:4332428fbb528bda32fffe124454458c9b716c86211266d1a03c4ddf695d7f60"
        imagePullPolicy: IfNotPresent
        command:
        - cilium-agent
        args:
        - --config-dir=/tmp/cilium/config-map
        startupProbe:
          httpGet:
            host: "127.0.0.1"
            path: /healthz
            port: 9876
            scheme: HTTP
            httpHeaders:
            - name: "brief"
              value: "true"
          failureThreshold: 105
          periodSeconds: 2
          successThreshold: 1
        livenessProbe:
          httpGet:
            host: "127.0.0.1"
            path: /healthz
            port: 9876
            scheme: HTTP
            httpHeaders:
            - name: "brief"
              value: "true"
          periodSeconds: 30
          successThreshold: 1
          failureThreshold: 10
          timeoutSeconds: 5
        readinessProbe:
          httpGet:
            host: "127.0.0.1"
            path: /healthz
            port: 9876
            scheme: HTTP
            httpHeaders:
            - name: "brief"
              value: "true"
          periodSeconds: 30
          successThreshold: 1
          failureThreshold: 3
          timeoutSeconds: 5
        env:
        - name: K8S_NODE_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: spec.nodeName
        - name: CILIUM_K8S_NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        - name: CILIUM_CLUSTERMESH_CONFIG
          value: /var/lib/cilium/clustermesh/
        - name: CILIUM_CNI_CHAINING_MODE
          valueFrom:
            configMapKeyRef:
              name: cilium-config
              key: cni-chaining-mode
              optional: true
        - name: CILIUM_CUSTOM_CNI_CONF
          valueFrom:
            configMapKeyRef:
              name: cilium-config
              key: custom-cni-conf
              optional: true
        lifecycle:
          postStart:
            exec:
              command:
              - "/cni-install.sh"
              - "--enable-debug=false"
              - "--cni-exclusive=true"
          preStop:
            exec:
              command:
              - /cni-uninstall.sh
        securityContext:
          privileged: true
        volumeMounts:
        - name: bpf-maps
          mountPath: /sys/fs/bpf
          mountPropagation: Bidirectional
        - name: cilium-run
          mountPath: /var/run/cilium
        - name: cni-path
          mountPath: /host/opt/cni/bin
        - name: etc-cni-netd
          mountPath: /host/etc/cni/net.d
        - name: clustermesh-secrets
          mountPath: /var/lib/cilium/clustermesh
          readOnly: true
        - name: cilium-config-path
          mountPath: /tmp/cilium/config-map
          readOnly: true
          # Needed to be able to load kernel modules
        - name: lib-modules
          mountPath: /lib/modules
          readOnly: true
        - name: xtables-lock
          mountPath: /run/xtables.lock
        - name: hubble-tls
          mountPath: /var/lib/cilium/tls/hubble
          readOnly: true
      hostNetwork: true
      initContainers:
      # Required to mount cgroup2 filesystem on the underlying Kubernetes node.
      # We use nsenter command with host's cgroup and mount namespaces enabled.
      - name: mount-cgroup
        image: "quay.io/cilium/cilium:v1.11.2@sha256:4332428fbb528bda32fffe124454458c9b716c86211266d1a03c4ddf695d7f60"
        imagePullPolicy: IfNotPresent
        env:
        - name: CGROUP_ROOT
          value: /run/cilium/cgroupv2
        - name: BIN_PATH
          value: /opt/cni/bin
        command:
        - sh
        - -ec
        # The statically linked Go program binary is invoked to avoid any
        # dependency on utilities like sh and mount that can be missing on certain
        # distros installed on the underlying host. Copy the binary to the
        # same directory where we install cilium cni plugin so that exec permissions
        # are available.
        - |
          cp /usr/bin/cilium-mount /hostbin/cilium-mount;
          nsenter --cgroup=/hostproc/1/ns/cgroup --mount=/hostproc/1/ns/mnt "${BIN_PATH}/cilium-mount" $CGROUP_ROOT;
          rm /hostbin/cilium-mount
        volumeMounts:
        - name: hostproc
          mountPath: /hostproc
        - name: cni-path
          mountPath: /hostbin
        securityContext:
          privileged: true
      - name: clean-cilium-state
        image: "quay.io/cilium/cilium:v1.11.2@sha256:4332428fbb528bda32fffe124454458c9b716c86211266d1a03c4ddf695d7f60"
        imagePullPolicy: IfNotPresent
        command:
        - /init-container.sh
        env:
        - name: CILIUM_ALL_STATE
          valueFrom:
            configMapKeyRef:
              name: cilium-config
              key: clean-cilium-state
              optional: true
        - name: CILIUM_BPF_STATE
          valueFrom:
            configMapKeyRef:
              name: cilium-config
              key: clean-cilium-bpf-state
              optional: true
        securityContext:
          privileged: true
        volumeMounts:
        - name: bpf-maps
          mountPath: /sys/fs/bpf
          # Required to mount cgroup filesystem from the host to cilium agent pod
        - name: cilium-cgroup
          mountPath: /run/cilium/cgroupv2
          mountPropagation: HostToContainer
        - name: cilium-run
          mountPath: /var/run/cilium
        resources:
          requests:
            cpu: 100m
            memory: 100Mi
      restartPolicy: Always
      priorityClassName: system-node-critical
      serviceAccount: "cilium"
      serviceAccountName: "cilium"
      terminationGracePeriodSeconds: 1
      tolerations:
        - operator: Exists
      volumes:
        # To keep state between restarts / upgrades
      - name: cilium-run
        hostPath:
          path: /var/run/cilium
          type: DirectoryOrCreate
        # To keep state between restarts / upgrades for bpf maps
      - name: bpf-maps
        hostPath:
          path: /sys/fs/bpf
          type: DirectoryOrCreate
      # To mount cgroup2 filesystem on the host
      - name: hostproc
        hostPath:
          path: /proc
          type: Directory
      # To keep state between restarts / upgrades for cgroup2 filesystem
      - name: cilium-cgroup
        hostPath:
          path: /run/cilium/cgroupv2
          type: DirectoryOrCreate
      # To install cilium cni plugin in the host
      - name: cni-path
        hostPath:
          path:  /opt/cni/bin
          type: DirectoryOrCreate
        # To install cilium cni configuration in the host
      - name: etc-cni-netd
        hostPath:
          path: /etc/cni/net.d
          type: DirectoryOrCreate
        # To be able to load kernel modules
      - name: lib-modules
        hostPath:
          path: /lib/modules
        # To access iptables concurrently with other processes (e.g. kube-proxy)
      - name: xtables-lock
        hostPath:
          path: /run/xtables.lock
          type: FileOrCreate
        # To read the clustermesh configuration
      - name: clustermesh-secrets
        secret:
          secretName: cilium-clustermesh
          # note: the leading zero means this number is in octal representation: do not remove it
          defaultMode: 0400
          optional: true
        # To read the configuration from the config map
      - name: cilium-config-path
        configMap:
          name: cilium-config
      - name: hubble-tls
        projected:
          # note: the leading zero means this number is in octal representation: do not remove it
          defaultMode: 0400
          sources:
          - secret:
              name: hubble-server-certs
              optional: true
              items:
              - key: ca.crt
                path: client-ca.crt
              - key: tls.crt
                path: server.crt
              - key: tls.key
                path: server.key
---
# Source: cilium/templates/cilium-operator/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: cilium-operator
  namespace: kube-system
  labels:
    io.cilium/app: operator
    name: cilium-operator
spec:
  # See docs on ServerCapabilities.LeasesResourceLock in file pkg/k8s/version/version.go
  # for more details.
  replicas: 2
  selector:
    matchLabels:
      io.cilium/app: operator
      name: cilium-operator
  strategy:
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 1
    type: RollingUpdate
  template:
    metadata:
      annotations:
      labels:
        io.cilium/app: operator
        name: cilium-operator
    spec:
      # In HA mode, cilium-operator pods must not be scheduled on the same
      # node as they will clash with each other.
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchExpressions:
              - key: io.cilium/app
                operator: In
                values:
                - operator
            topologyKey: kubernetes.io/hostname
      containers:
      - name: cilium-operator
        image: quay.io/cilium/operator-generic:v1.11.2@sha256:4c8bea6818ee3e4932f99e9c1d7efa88b8c0f3cd516160caec878406531e45e7
        imagePullPolicy: IfNotPresent
        command:
        - cilium-operator-generic
        args:
        - --config-dir=/tmp/cilium/config-map
        - --debug=$(CILIUM_DEBUG)
        env:
        - name: K8S_NODE_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: spec.nodeName
        - name: CILIUM_K8S_NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        - name: CILIUM_DEBUG
          valueFrom:
            configMapKeyRef:
              key: debug
              name: cilium-config
              optional: true
        livenessProbe:
          httpGet:
            host: "127.0.0.1"
            path: /healthz
            port: 9234
            scheme: HTTP
          initialDelaySeconds: 60
          periodSeconds: 10
          timeoutSeconds: 3
        volumeMounts:
        - name: cilium-config-path
          mountPath: /tmp/cilium/config-map
          readOnly: true
      hostNetwork: true
      restartPolicy: Always
      priorityClassName: system-cluster-critical
      serviceAccount: "cilium-operator"
      serviceAccountName: "cilium-operator"
      tolerations:
        - operator: Exists
      volumes:
        # To read the configuration from the config map
      - name: cilium-config-path
        configMap:
          name: cilium-config