Commit d3a8a4a

Cilium is open source software for providing and transparently securing

network connectivity and loadbalancing between application workloads such as

| authentication.mutual.spire.install.agent.tolerations | list | `[{"effect":"NoSchedule","key":"node.kubernetes.io/not-ready"},{"effect":"NoSchedule","key":"node-role.kubernetes.io/master"},{"effect":"NoSchedule","key":"node-role.kubernetes.io/control-plane"},{"effect":"NoSchedule","key":"node.cloudprovider.kubernetes.io/uninitialized","value":"true"},{"key":"CriticalAddonsOnly","operator":"Exists"}]` | SPIRE agent tolerations configuration By default it follows the same tolerations as the agent itself to allow the Cilium agent on this node to connect to SPIRE. ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ |

| authentication.mutual.spire.install.enabled | bool | `true` | Enable SPIRE installation. This will only take effect only if authentication.mutual.spire.enabled is true |

| authentication.mutual.spire.install.existingNamespace | bool | `false` | SPIRE namespace already exists. Set to true if Helm should not create, manage, and import the SPIRE namespace. |

| authentication.mutual.spire.install.namespace | string | `"cilium-spire"` | SPIRE namespace to install into |

| authentication.mutual.spire.install.server.affinity | object | `{}` | SPIRE server affinity configuration |

| authentication.mutual.spire.install.server.annotations | object | `{}` | SPIRE server annotations |

| clustermesh.apiserver.extraVolumeMounts | list | `[]` | Additional clustermesh-apiserver volumeMounts. |

| clustermesh.apiserver.extraVolumes | list | `[]` | Additional clustermesh-apiserver volumes. |

| clustermesh.apiserver.healthPort | int | `9880` | TCP port for the clustermesh-apiserver health API. |

| clustermesh.apiserver.kvstoremesh.enabled | bool | `true` | Enable KVStoreMesh. KVStoreMesh caches the information retrieved from the remote clusters in the local etcd instance. |

| clustermesh.apiserver.kvstoremesh.extraArgs | list | `[]` | Additional KVStoreMesh arguments. |

| clustermesh.apiserver.kvstoremesh.extraEnv | list | `[]` | Additional KVStoreMesh environment variables. |

| envoy.healthPort | int | `9878` | TCP port for the health API. |

| envoy.httpRetryCount | int | `3` | Maximum number of retries for each HTTP request |

| envoy.idleTimeoutDurationSeconds | int | `60` | Set Envoy upstream HTTP idle connection timeout seconds. Does not apply to connections with pending requests. Default 60s |

| envoy.initialFetchTimeoutSeconds | int | `30` | Time in seconds after which the initial fetch on an xDS stream is considered timed out |

| envoy.livenessProbe.failureThreshold | int | `10` | failure threshold of liveness probe |

| envoy.livenessProbe.periodSeconds | int | `30` | interval between checks of the liveness probe |

| hubble.relay.extraVolumes | list | `[]` | Additional hubble-relay volumes. |

| hubble.relay.gops.enabled | bool | `true` | Enable gops for hubble-relay |

| hubble.relay.gops.port | int | `9893` | Configure gops listen port for hubble-relay |

| hubble.relay.listenHost | string | `""` | Host to listen to. Specify an empty string to bind to all the interfaces. |

| hubble.relay.listenPort | string | `"4245"` | Port to listen to. |

| hubble.relay.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |

| hubble.ui.updateStrategy | object | `{"rollingUpdate":{"maxUnavailable":1},"type":"RollingUpdate"}` | hubble-ui update strategy. |

| identityAllocationMode | string | `"crd"` | Method to use for identity allocation (`crd`, `kvstore` or `doublewrite-readkvstore` / `doublewrite-readcrd` for migrating between identity backends). |

| identityChangeGracePeriod | string | `"5s"` | Time to wait before using new identity on endpoint identity change. |

| imagePullSecrets | list | `[]` | Configure image pull secrets for pulling container images |

| ingressController.default | bool | `false` | Set cilium ingress controller to be the default ingress controller This will let cilium ingress controller route entries without ingress class set |

| ingressController.defaultSecretName | string | `nil` | Default secret name for ingresses without .spec.tls[].secretName set. |

| operator.hostNetwork | bool | `true` | HostNetwork setting |

| operator.identityGCInterval | string | `"15m0s"` | Interval for identity garbage collection. |

| operator.identityHeartbeatTimeout | string | `"30m0s"` | Timeout for identity heartbeats. |

| operator.nodeGCInterval | string | `"5m0s"` | Interval for cilium node garbage collection. |

| operator.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for cilium-operator pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |

| operator.podAnnotations | object | `{}` | Annotations to be added to cilium-operator pods |

| preflight.extraEnv | list | `[]` | Additional preflight environment variables. |

| preflight.extraVolumeMounts | list | `[]` | Additional preflight volumeMounts. |

| preflight.extraVolumes | list | `[]` | Additional preflight volumes. |

| preflight.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for preflight pod assignment ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector |

| preflight.podAnnotations | object | `{}` | Annotations to be added to preflight pods |

| preflight.podDisruptionBudget.enabled | bool | `false` | enable PodDisruptionBudget ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ |

# @schema

override: ~

repository: "quay.io/cilium/cilium"

pullPolicy: "IfNotPresent"

# cilium-digest

useDigest: true

scheduling:

# @schema

override: ~

repository: "quay.io/cilium/hubble-relay"

# hubble-relay-digest

useDigest: true

pullPolicy: "IfNotPresent"

# -- Specifies the resources for the hubble-relay pods

# @schema

override: ~

repository: "quay.io/cilium/cilium-envoy"

pullPolicy: "IfNotPresent"

useDigest: true

# -- Additional containers added to the cilium Envoy DaemonSet.

extraContainers: []

# @schema

override: ~

repository: "quay.io/cilium/operator"

# operator-generic-digest

# operator-azure-digest

# operator-aws-digest

# operator-alibabacloud-digest

useDigest: true

pullPolicy: "IfNotPresent"

suffix: ""

# @schema

override: ~

repository: "quay.io/cilium/cilium"

# cilium-digest

useDigest: true

pullPolicy: "IfNotPresent"

# -- The priority class to use for the preflight pod.

# @schema

override: ~

repository: "quay.io/cilium/clustermesh-apiserver"

# clustermesh-apiserver-digest

useDigest: true

pullPolicy: "IfNotPresent"

# -- TCP port for the clustermesh-apiserver health API.

override: ~

repository: "docker.io/library/busybox"

tag: "1.37.0"

useDigest: true

pullPolicy: "IfNotPresent"

# SPIRE agent configuration

FROM quay.io/cilium/cilium:${VERSION}