From c40cf551c8816e3d1c81de25adef00ac36ebe00c Mon Sep 17 00:00:00 2001 From: 0xFEEDC0DE64 Date: Mon, 19 Oct 2026 10:13:16 +0200 Subject: [PATCH] Document Cilium Argo ownership and upgrade safety --- apps/cilium/README.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100644 apps/cilium/README.md diff --git a/apps/cilium/README.md b/apps/cilium/README.md new file mode 100644 index 0000000..80c3522 --- /dev/null +++ b/apps/cilium/README.md @@ -0,0 +1,15 @@ +# Cilium + +The `cilium` Argo CD Application consumes the upstream `cilium` Helm chart. +Its `targetRevision` in `bootstrap/cilium.yaml` is the single chart-version +setting; the values in this directory are the cluster-specific configuration. +The same Application owns the Hubble internal CA/issuers and Cilium availability +alert in `resources/`. + +Cilium is the cluster CNI, so chart upgrades are higher risk than ordinary app +upgrades. Before changing `targetRevision`, render the new chart with +`values.yaml`, compare resource identities and critical networking settings, +and confirm the rollback/recovery route. Do not remove the retained Cilium Helm +release record or delete Cilium CRDs as cleanup; the CRDs are not rendered or +managed by this Argo Application. Argo is the normal writer; the old `cilium` +repository's installer is break-glass recovery only.