From 3478b27701c32100db517444dbd5ed8b1cf53f52 Mon Sep 17 00:00:00 2001 From: 0xFEEDC0DE64 Date: Mon, 19 Oct 2026 10:08:53 +0200 Subject: [PATCH] Adopt Cilium with Argo CD --- apps/cilium/resources/cilium-alerts.yaml | 35 ++++++++++++++++++ apps/cilium/resources/hubble-pki.yaml | 46 +++++++++++++++++++++++ apps/cilium/values.yaml | 32 ++++++++++++++++ bootstrap/cilium-project.yaml | 47 ++++++++++++++++++++++++ bootstrap/cilium.yaml | 31 ++++++++++++++++ bootstrap/kustomization.yaml | 2 + 6 files changed, 193 insertions(+) create mode 100644 apps/cilium/resources/cilium-alerts.yaml create mode 100644 apps/cilium/resources/hubble-pki.yaml create mode 100644 apps/cilium/values.yaml create mode 100644 bootstrap/cilium-project.yaml create mode 100644 bootstrap/cilium.yaml diff --git a/apps/cilium/resources/cilium-alerts.yaml b/apps/cilium/resources/cilium-alerts.yaml new file mode 100644 index 0000000..ae59092 --- /dev/null +++ b/apps/cilium/resources/cilium-alerts.yaml @@ -0,0 +1,35 @@ +apiVersion: monitoring.coreos.com/v1 +kind: PrometheusRule +metadata: + name: cilium-availability + namespace: prometheus +spec: + groups: + - name: cilium.availability + rules: + - alert: CiliumAgentDown + expr: | + kube_daemonset_status_desired_number_scheduled{namespace="kube-system", daemonset="cilium"} + - + kube_daemonset_status_number_ready{namespace="kube-system", daemonset="cilium"} + > 0 + for: 5m + labels: + namespace: kube-system + severity: critical + annotations: + summary: One or more Cilium agents are unavailable + description: >- + Only {{ $value }} fewer Cilium agents are ready than desired. + Affected nodes may lose pod networking or service connectivity. + - alert: CiliumOperatorDown + expr: | + kube_deployment_status_replicas_available{namespace="kube-system", deployment="cilium-operator"} < 1 + for: 5m + labels: + namespace: kube-system + severity: critical + annotations: + summary: The Cilium operator is unavailable + description: >- + No Cilium operator replica has been available for at least five minutes. diff --git a/apps/cilium/resources/hubble-pki.yaml b/apps/cilium/resources/hubble-pki.yaml new file mode 100644 index 0000000..dc4ca70 --- /dev/null +++ b/apps/cilium/resources/hubble-pki.yaml @@ -0,0 +1,46 @@ +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + name: hubble-selfsigned + namespace: kube-system + annotations: + argocd.argoproj.io/sync-wave: "-1" +spec: + selfSigned: {} +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: hubble-ca + namespace: kube-system + annotations: + argocd.argoproj.io/sync-wave: "-1" +spec: + secretName: hubble-ca + commonName: Hubble Internal CA + duration: 87600h + renewBefore: 720h + isCA: true + privateKey: + algorithm: ECDSA + size: 256 + rotationPolicy: Never + issuerRef: + group: cert-manager.io + kind: Issuer + name: hubble-selfsigned + usages: + - cert sign + - crl sign + - digital signature +--- +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + name: hubble-ca + namespace: kube-system + annotations: + argocd.argoproj.io/sync-wave: "-1" +spec: + ca: + secretName: hubble-ca diff --git a/apps/cilium/values.yaml b/apps/cilium/values.yaml new file mode 100644 index 0000000..4004252 --- /dev/null +++ b/apps/cilium/values.yaml @@ -0,0 +1,32 @@ +cluster: + name: kubernetes + +hubble: + relay: + enabled: true + ui: + enabled: true + tls: + auto: + enabled: true + method: certmanager + certManagerIssuerRef: + group: cert-manager.io + kind: Issuer + name: hubble-ca + +k8sServiceHost: 192.168.0.2 +k8sServicePort: 6443 +kubeProxyReplacement: true + +operator: + replicas: 2 + nodeSelector: + kubernetes.io/os: linux + odroid-h3: enabled + podDisruptionBudget: + enabled: true + maxUnavailable: 1 + +routingMode: tunnel +tunnelProtocol: vxlan diff --git a/bootstrap/cilium-project.yaml b/bootstrap/cilium-project.yaml new file mode 100644 index 0000000..91ebd72 --- /dev/null +++ b/bootstrap/cilium-project.yaml @@ -0,0 +1,47 @@ +apiVersion: argoproj.io/v1alpha1 +kind: AppProject +metadata: + name: cilium + namespace: argocd +spec: + description: Cilium CNI, Hubble PKI, and availability alerts + sourceRepos: + - https://helm.cilium.io/ + - https://code.brunner.ninja/feedc0de/homelab-gitops.git + destinations: + - namespace: kube-system + server: https://kubernetes.default.svc + - namespace: cilium-secrets + server: https://kubernetes.default.svc + - namespace: prometheus + server: https://kubernetes.default.svc + clusterResourceWhitelist: + - group: "" + kind: Namespace + - group: rbac.authorization.k8s.io + kind: ClusterRole + - group: rbac.authorization.k8s.io + kind: ClusterRoleBinding + namespaceResourceWhitelist: + - group: "" + kind: ConfigMap + - group: "" + kind: Service + - group: "" + kind: ServiceAccount + - group: apps + kind: DaemonSet + - group: apps + kind: Deployment + - group: cert-manager.io + kind: Certificate + - group: cert-manager.io + kind: Issuer + - group: monitoring.coreos.com + kind: PrometheusRule + - group: policy + kind: PodDisruptionBudget + - group: rbac.authorization.k8s.io + kind: Role + - group: rbac.authorization.k8s.io + kind: RoleBinding diff --git a/bootstrap/cilium.yaml b/bootstrap/cilium.yaml new file mode 100644 index 0000000..d74cce7 --- /dev/null +++ b/bootstrap/cilium.yaml @@ -0,0 +1,31 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: cilium + namespace: argocd +spec: + project: cilium + sources: + - repoURL: https://helm.cilium.io/ + chart: cilium + targetRevision: 1.20.3 + helm: + releaseName: cilium + valueFiles: + - $values/apps/cilium/values.yaml + - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git + targetRevision: main + ref: values + - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git + targetRevision: main + path: apps/cilium/resources + destination: + server: https://kubernetes.default.svc + namespace: kube-system + syncPolicy: + automated: + enabled: false + prune: false + selfHeal: false + syncOptions: + - CreateNamespace=false diff --git a/bootstrap/kustomization.yaml b/bootstrap/kustomization.yaml index f477d61..d44df50 100644 --- a/bootstrap/kustomization.yaml +++ b/bootstrap/kustomization.yaml @@ -26,6 +26,8 @@ resources: - cert-manager.yaml - metallb-project.yaml - metallb.yaml +- cilium-project.yaml +- cilium.yaml - brgkepler-com.yaml - gschissenes-equipment.yaml - immich-crack.yaml