# Cilium

The `cilium` Argo CD Application consumes the upstream `cilium` Helm chart.
Its `targetRevision` in `bootstrap/cilium.yaml` is the single chart-version
setting; the values in this directory are the cluster-specific configuration.
The same Application owns the Hubble internal CA/issuers and Cilium availability
alert in `resources/`.

Cilium is the cluster CNI, so chart upgrades are higher risk than ordinary app
upgrades. Before changing `targetRevision`, render the new chart with
`values.yaml`, compare resource identities and critical networking settings,
and confirm the rollback/recovery route. Do not remove the retained Cilium Helm
release record or delete Cilium CRDs as cleanup; the CRDs are not rendered or
managed by this Argo Application. Argo is the normal writer; the old `cilium`
repository's installer is break-glass recovery only.

If Argo cannot restore Cilium, see [RECOVERY.md](RECOVERY.md) for the
break-glass procedure.