23 lines
1.2 KiB
Markdown
23 lines
1.2 KiB
Markdown
# Cilium
|
|
|
|
Cilium is deployed from the upstream Helm chart by the `cilium` Argo CD
|
|
Application in `feedc0de/homelab-gitops`. The GitOps repository is the only
|
|
normal deployment writer and owns the chart version, cluster values, Hubble
|
|
PKI resources, and availability alerts. Change the chart version and values in
|
|
that repository; do not run a parallel deployment pipeline from here.
|
|
|
|
This repository is retained as a local administrator recovery aid and for
|
|
render validation. `install.sh` uses `cilium-cli` to reconcile the existing
|
|
installation and should be reserved for recovery if Argo CD is unavailable.
|
|
After recovery, check that the live release matches the GitOps desired version
|
|
and values before returning control to Argo CD.
|
|
|
|
Hubble TLS uses cert-manager with a namespace-scoped internal CA. The
|
|
certificates and their issuers are managed by the Cilium Argo application; no
|
|
private keys or rendered Secret data are committed. Cilium's Hubble server and
|
|
Relay support reloading renewed certificates without restarting the
|
|
workloads. See the [upstream Hubble TLS documentation](https://docs.cilium.io/en/stable/observability/hubble/configuration/tls/).
|
|
|
|
To validate a local change, run `./test.sh`. This does not deploy anything to
|
|
Kubernetes.
|