* fix: correct CiliumBGPNodeConfigOverride CRD wait condition and deprecate legacy BGP Peering Policy
- Fix copy-paste bug where cilium_bgp_advertisements was used instead of
cilium_bgp_node_config_overrides when waiting for the
CiliumBGPNodeConfigOverride CRD. This caused the CRD readiness check
to be skipped when only node config overrides were configured.
- Add deprecation notices across docs, sample inventory, and defaults
to guide users away from the legacy v2alpha1 CiliumBGPPeeringPolicy
toward the supported BGP v2 API variables.
* fix(cilium): simplify BGP node override condition
* fix: render routingMode native when cilium_tunnel_mode is disabled
When cilium_tunnel_mode is set to 'disabled', the previous template rendered
'tunnelProtocol: disabled', which Cilium does not recognise and falls back to
vxlan. With native routing this conflicts and agents CrashLoopBackOff.
Render 'routingMode: native' instead when disabled, matching the Cilium Helm
chart API (per maintainer review on #13427 and #13314).
Refs kubernetes-sigs/kubespray#13267
Signed-off-by: Mehrdad Biukian Naeini <mehrdadbiukian@gmail.com>
* fix(cilium): tighten routingMode native render (remove stray blank line)
Per review comment on kubernetes-sigs/kubespray#13427, drop the extra
blank line after the routingMode/tunnelProtocol if-block so the rendered
Helm values file is clean.
Validated by rendering the template for cilium_tunnel_mode in
{disabled, vxlan, geneve}: disabled yields 'routingMode: native' with no
tunnelProtocol; vxlan/geneve yield 'tunnelProtocol: <mode>'.
Signed-off-by: Mehrdad Biukian Naeini <mehrdadbiukian@gmail.com>
---------
Signed-off-by: Mehrdad Biukian Naeini <mehrdadbiukian@gmail.com>
Cilium < 1.20 unconditionally registers a field indexer for TLSRoute
v1alpha2 when the Gateway API controller is enabled, but Gateway API
>= 1.5.0 ships TLSRoute v1alpha2 with served=false in the standard
channel. The result is cilium-operator CrashLoopBackOff with:
no matches for kind "TLSRoute" in version "gateway.networking.k8s.io/v1alpha2"
The fix landed in Cilium 1.20 only and will not be backported.
Add a preflight assert that triggers only when all of the following
hold: cilium_gateway_api_enabled, gateway_api_enabled, cilium_version
< 1.20.0, gateway_api_version >= 1.5.0, and gateway_api_channel ==
"standard". Users hit by this combo get a clear error and two
workarounds (pin gateway_api_version to 1.4.1, or switch
gateway_api_channel to "experimental") instead of debugging a crash
loop after the fact.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
The cilium_enable_prometheus variable was defined in defaults and
documented in sample inventory but never mapped to the Helm values
template, making it a no-op. Add the prometheus.enabled field to
values.yaml.j2 so that setting cilium_enable_prometheus: true
correctly enables Prometheus metrics on the Cilium agent.
Signed-off-by: Kay Yan <kay.yan@daocloud.io>
`cilium install` is equivalent to `helm install`, it will failed if
cilium relase exist. `cilium version` can know the release exist without
helm binary
Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>
Give users two options: besides skip Cilium, add
`cilium_remove_old_resources`, default is `false`, when set to `true`,
it will remove the content of the old version, but it will cause the
downtime, need to be careful to use.
Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>
This patch fixes the indentation in the `encryption` section.
Previously configuration like this:
```yml
cilium_encryption_enabled: true
cilium_encryption_type: wireguard
```
Would template to a `values.yaml` file with indentation that looks like this:
```yml
encryption:
enabled: True
type: wireguard
nodeEncryption: False
```
instead of this:
```yml
encryption:
enabled: true
type: wireguard
nodeEncryption: false
```
This syntax issue causes an error during Cilium installation.
This patch also makes all boolean values in this template file go through the `to_json` filter.
Since values like `True` and `False` are not compliant with the YAML v1.2 spec,
avoiding them is preferable.
`to_json` may be used for all other values in this template to ensure we end up with
a valid YAML document in all cases (even when various strings include special characters),
but this was left for another (future) patch.
* feat(cilium): add configurable Hubble export log rotation parameters
- Adds support for `cilium_hubble_export_file_max_backups` and `cilium_hubble_export_file_max_size_mb`
- Applies values only if `cilium_hubble_export_file_path` is defined
- Default values are set in role defaults
- Cleans up template logic by removing unnecessary conditionals
* Fix indentation for hubble export settings
* Fix undefined variable issue with ipwrap in kubeconfig override that caused pre-commit errors
* Update main.yml
rollback
- This enables ithe override of the tolerations for the cilium-operator deployment
- default behaviour is to leave the toleration as is unless the var is set
Dasmat Hansda
Mehrdad Biukian
Nikhil Kumar
wangsifei99
somaz
Ali Afsharzadeh
Kay Yan
Karim Farid
ERIK
VoidQuark
Shaleen Bathla
r3m8
Qasim Mehmood
Anurag Ojha
Clement Phu
Aman Shrivastava
Xuhui Sun
Mustafa Mertcan Çam
Takuya Murakami
Kim Hyunyoung, Abel
ChengHao Yang
Slavi Pantaleev
ErmolenkoMaxim
felipe88alves
Cheolhui Kim
Max Gautier
peterw
Boris