apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: cilium
  namespace: kube-system
spec:
  interval: 15m
  releaseName: cilium
  targetNamespace: kube-system
  chart:
    spec:
      chart: cilium
      version: 1.20.4
      sourceRef:
        kind: HelmRepository
        name: cilium
        namespace: flux-system
  upgrade:
    remediation:
      retries: 3
  values:
    updateStrategy:
      rollingUpdate:
        maxUnavailable: 1
    envoy:
      updateStrategy:
        rollingUpdate:
          maxUnavailable: 1
    upgradeCompatibility: "1.19"
    ipam:
      operator:
        clusterPoolIPv4PodCIDRList: 172.19.28.14/12
    cluster:
      name: "********"
    bpf:
      masquerade: true
    resources:
      limits:
        memory: 4Gi
      requests:
        cpu: 100m
        memory: 512Mi
    bgpControlPlane:
      enabled: true
    kubeProxyReplacement: true
    policyEnforcementMode: always
    gatewayAPI:
      enabled: true
      enableAlpn: true
      enableAppProtocol: true
    encryption:
      enabled: true
      type: wireguard
    hostFirewall:
      enabled: true
    hubble:
      export:
        static:
          enabled: true
          filePath: stdout
          allowList:
            - '{"verdict":["DROPPED","AUDIT"]}'
      relay:
        enabled: true
        replicas: 2
      ui:
        enabled: true
        replicas: 2
    k8sServiceHost: k3s.********.internal
    k8sServicePort: 6443
    operator:
      replicas: 2
    routingMode: tunnel
    tunnelProtocol: vxlan