The cluster CNI is managed with cilium-cli and pinned to Cilium v1.20.0. The values in values.yaml were recovered from the live Helm release with:

cilium-cli upgrade --version v1.20.0 --dry-run-helm-values

They preserve the Kubernetes API endpoint, VXLAN tunnel routing, kube-proxy replacement, two operator replicas, and Hubble Relay/UI. The operator replicas are restricted to Odroid workers, use required pod anti-affinity so they run on different nodes, and have a disruption budget that keeps at least one available during voluntary disruptions.

Hubble TLS

Hubble mTLS certificates are issued and automatically renewed by cert-manager. hubble-pki.yaml creates a namespace-scoped internal CA; no private keys or other Secrets are committed. Do not use the public Let's Encrypt issuers for these internal Cilium identities.

L2 load balancers

There are currently no CiliumL2AnnouncementPolicy or CiliumLoadBalancerIPPool resources in the cluster. Load-balancer IPs are announced by MetalLB, so no Cilium L2 configuration was added here.

Install or reconcile

Run this from a machine with both kubectl and cilium-cli configured for the cluster. From the current location that machine is dahoam:

rsync -av cilium/ dahoam:cilium/
ssh dahoam 'cd cilium && ./install.sh'

The script creates the cert-manager CA first, then installs or reconciles the pinned Cilium release. Existing Cilium agents are restarted with a rolling DaemonSet update so they load renewed Hubble certificates before Relay is restarted and health-checked.