Cilium is deployed from the upstream Helm chart by the cilium Argo CD Application in feedc0de/homelab-gitops. The GitOps repository is the only normal deployment writer and owns the chart version, cluster values, Hubble PKI resources, and availability alerts. Change the chart version and values in that repository; do not run a parallel deployment pipeline from here.

This repository is retained as a local administrator recovery aid and for render validation. install.sh uses cilium-cli to reconcile the existing installation and should be reserved for recovery if Argo CD is unavailable. After recovery, check that the live release matches the GitOps desired version and values before returning control to Argo CD.

Hubble TLS uses cert-manager with a namespace-scoped internal CA. The certificates and their issuers are managed by the Cilium Argo application; no private keys or rendered Secret data are committed. Cilium's Hubble server and Relay support reloading renewed certificates without restarting the workloads. See the upstream Hubble TLS documentation.

To validate a local change, run ./test.sh. This does not deploy anything to Kubernetes.