# Cilium

Cilium is deployed from the upstream Helm chart by the `cilium` Argo CD
Application in `feedc0de/homelab-gitops`. The GitOps repository is the only
normal deployment writer and owns the chart version, cluster values, Hubble
PKI resources, and availability alerts. Change the chart version and values in
that repository; do not run a parallel deployment pipeline from here.

This repository is retained as a local administrator recovery aid and for
render validation. `install.sh` uses `cilium-cli` to reconcile the existing
installation and should be reserved for recovery if Argo CD is unavailable.
After recovery, check that the live release matches the GitOps desired version
and values before returning control to Argo CD.

Hubble TLS uses cert-manager with a namespace-scoped internal CA. The
certificates and their issuers are managed by the Cilium Argo application; no
private keys or rendered Secret data are committed. Cilium's Hubble server and
Relay support reloading renewed certificates without restarting the
workloads. See the [upstream Hubble TLS documentation](https://docs.cilium.io/en/stable/observability/hubble/configuration/tls/).

To validate a local change, run `./test.sh`. This does not deploy anything to
Kubernetes.