cni:
  exclusive: false
upgradeCompatibility: "1.15"
cluster:
  name: virt-cluster
  id: 2

kubeProxyReplacement: true


socketLB: # Enabled because of problems with kubevirt reaching services
  enabled: true
  hostNamespaceOnly: true

# Talos specific
k8sServiceHost: localhost
k8sServicePort: 7445
securityContext:
  capabilities:
    ciliumAgent: [ CHOWN, KILL, NET_ADMIN, NET_RAW, IPC_LOCK, SYS_ADMIN, SYS_RESOURCE, DAC_OVERRIDE, FOWNER, SETGID, SETUID ]
    cleanCiliumState: [ NET_ADMIN, SYS_ADMIN, SYS_RESOURCE ]

cgroup:
  autoMount:
    enabled: false
  hostRoot: /sys/fs/cgroup

# https://docs.cilium.io/en/stable/network/concepts/ipam/
ipam:
  mode: kubernetes

# Devices are used to masquade traffic originating from these interfaces
# used with egressgateway
devices: [ eth0, br0, br99-wifi, br1100-testlan ]
operator:
  rollOutPods: true
  resources:
    limits:
      cpu: 500m
      memory: 256Mi
    requests:
      cpu: 50m
      memory: 128Mi
  prometheus:
    enabled: true
    metricsService: true
    serviceMonitor:
      enabled: true
# Roll out cilium agent pods automatically when ConfigMap is updated.
rollOutCiliumPods: true
resources:
  limits:
    cpu: 1000m
    memory: 1Gi
  requests:
    cpu: 200m
    memory: 512Mi

#debug:
#  enabled: true

# Increase rate limit when doing L2 announcements
#k8sClientRateLimit:
#  qps: 20
#  burst: 100

# l2announcements:
#   enabled: true

externalIPs:
  enabled: true

enableCiliumEndpointSlice: false

ipv6:
  enabled: true


loadBalancer:
  # https://docs.cilium.io/en/stable/network/kubernetes/kubeproxy-free/#maglev-consistent-hashing
  algorithm: maglev

gatewayAPI:
  enabled: false # We disable gatewayAPI for now

envoy:
  securityContext:
    capabilities:
      keepCapNetBindService: true
      envoy: [ NET_ADMIN, PERFMON, SYS_ADMIN, BPF ]

bpf:
  vlanBypass: [ 0 ]
  masquade: true

egressGateway:
  enabled: true

# ingressController:
#   enabled: true
#   default: true
#   loadbalancerMode: dedicated
#   service:
#     annotations:
#       io.cilium/lb-ipam-ips: "10.99.101.50 2a02:a44d:67b4:501:ffff::"
#     labels:
#       network-announcement: "l2"

hubble:
  enabled: true
  relay:
    enabled: true
    rollOutPods: true
  ui:
    enabled: true
    rollOutPods: true

prometheus:
  metricsService: true
  enabled: true
  serviceMonitor:
    enabled: true

dashboards:
  enabled: false
  label: grafana_dashboard