Adopt Cilium with Argo CD

apps/cilium/resources/cilium-alerts.yaml

@@ -0,0 +1,35 @@
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: cilium-availability
+  namespace: prometheus
+spec:
+  groups:
+  - name: cilium.availability
+    rules:
+    - alert: CiliumAgentDown
+      expr: |
+        kube_daemonset_status_desired_number_scheduled{namespace="kube-system", daemonset="cilium"}
+          -
+        kube_daemonset_status_number_ready{namespace="kube-system", daemonset="cilium"}
+          > 0
+      for: 5m
+      labels:
+        namespace: kube-system
+        severity: critical
+      annotations:
+        summary: One or more Cilium agents are unavailable
+        description: >-
+          Only {{ $value }} fewer Cilium agents are ready than desired.
+          Affected nodes may lose pod networking or service connectivity.
+    - alert: CiliumOperatorDown
+      expr: |
+        kube_deployment_status_replicas_available{namespace="kube-system", deployment="cilium-operator"} < 1
+      for: 5m
+      labels:
+        namespace: kube-system
+        severity: critical
+      annotations:
+        summary: The Cilium operator is unavailable
+        description: >-
+          No Cilium operator replica has been available for at least five minutes.

apps/cilium/resources/hubble-pki.yaml

@@ -0,0 +1,46 @@
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: hubble-selfsigned
+  namespace: kube-system
+  annotations:
+    argocd.argoproj.io/sync-wave: "-1"
+spec:
+  selfSigned: {}
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: hubble-ca
+  namespace: kube-system
+  annotations:
+    argocd.argoproj.io/sync-wave: "-1"
+spec:
+  secretName: hubble-ca
+  commonName: Hubble Internal CA
+  duration: 87600h
+  renewBefore: 720h
+  isCA: true
+  privateKey:
+    algorithm: ECDSA
+    size: 256
+    rotationPolicy: Never
+  issuerRef:
+    group: cert-manager.io
+    kind: Issuer
+    name: hubble-selfsigned
+  usages:
+  - cert sign
+  - crl sign
+  - digital signature
+---
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: hubble-ca
+  namespace: kube-system
+  annotations:
+    argocd.argoproj.io/sync-wave: "-1"
+spec:
+  ca:
+    secretName: hubble-ca

apps/cilium/values.yaml

@@ -0,0 +1,32 @@
+cluster:
+  name: kubernetes
+
+hubble:
+  relay:
+    enabled: true
+  ui:
+    enabled: true
+  tls:
+    auto:
+      enabled: true
+      method: certmanager
+      certManagerIssuerRef:
+        group: cert-manager.io
+        kind: Issuer
+        name: hubble-ca
+
+k8sServiceHost: 192.168.0.2
+k8sServicePort: 6443
+kubeProxyReplacement: true
+
+operator:
+  replicas: 2
+  nodeSelector:
+    kubernetes.io/os: linux
+    odroid-h3: enabled
+  podDisruptionBudget:
+    enabled: true
+    maxUnavailable: 1
+
+routingMode: tunnel
+tunnelProtocol: vxlan

bootstrap/cilium-project.yaml

@@ -0,0 +1,47 @@
+apiVersion: argoproj.io/v1alpha1
+kind: AppProject
+metadata:
+  name: cilium
+  namespace: argocd
+spec:
+  description: Cilium CNI, Hubble PKI, and availability alerts
+  sourceRepos:
+  - https://helm.cilium.io/
+  - https://code.brunner.ninja/feedc0de/homelab-gitops.git
+  destinations:
+  - namespace: kube-system
+    server: https://kubernetes.default.svc
+  - namespace: cilium-secrets
+    server: https://kubernetes.default.svc
+  - namespace: prometheus
+    server: https://kubernetes.default.svc
+  clusterResourceWhitelist:
+  - group: ""
+    kind: Namespace
+  - group: rbac.authorization.k8s.io
+    kind: ClusterRole
+  - group: rbac.authorization.k8s.io
+    kind: ClusterRoleBinding
+  namespaceResourceWhitelist:
+  - group: ""
+    kind: ConfigMap
+  - group: ""
+    kind: Service
+  - group: ""
+    kind: ServiceAccount
+  - group: apps
+    kind: DaemonSet
+  - group: apps
+    kind: Deployment
+  - group: cert-manager.io
+    kind: Certificate
+  - group: cert-manager.io
+    kind: Issuer
+  - group: monitoring.coreos.com
+    kind: PrometheusRule
+  - group: policy
+    kind: PodDisruptionBudget
+  - group: rbac.authorization.k8s.io
+    kind: Role
+  - group: rbac.authorization.k8s.io
+    kind: RoleBinding

bootstrap/cilium.yaml

@@ -0,0 +1,31 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cilium
+  namespace: argocd
+spec:
+  project: cilium
+  sources:
+  - repoURL: https://helm.cilium.io/
+    chart: cilium
+    targetRevision: 1.20.3
+    helm:
+      releaseName: cilium
+      valueFiles:
+      - $values/apps/cilium/values.yaml
+  - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
+    targetRevision: main
+    ref: values
+  - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
+    targetRevision: main
+    path: apps/cilium/resources
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: kube-system
+  syncPolicy:
+    automated:
+      enabled: false
+      prune: false
+      selfHeal: false
+    syncOptions:
+    - CreateNamespace=false

bootstrap/kustomization.yaml

@@ -26,6 +26,8 @@ resources:
 - cert-manager.yaml
 - metallb-project.yaml
 - metallb.yaml
+- cilium-project.yaml
+- cilium.yaml
 - brgkepler-com.yaml
 - gschissenes-equipment.yaml
 - immich-crack.yaml