# Cilium recovery

Argo CD is the normal owner of Cilium. Use this only if Argo CD cannot restore
the CNI and the cluster needs a break-glass repair. Work from a fresh checkout
of this repository and verify `kubectl config current-context` is
`kubernetes-admin@kubernetes` before any cluster changes.

The chart version is canonically recorded as `spec.sources[0].targetRevision`
in `bootstrap/cilium.yaml`; the cluster configuration is in `apps/cilium/values.yaml`.
After checking the context and reviewing the target version, recover the Helm
release with the Cilium CLI (the CLI expects a `v` prefix):

```sh
chart_version="$(yq -r '.spec.sources[0].targetRevision' bootstrap/cilium.yaml)"
cilium upgrade --namespace kube-system --version "v${chart_version}" \
  --values apps/cilium/values.yaml --wait
```

Restore the Hubble CA resources from `apps/cilium/resources/hubble-pki.yaml` only
if they are missing. Do not uninstall Cilium, delete its CRDs, or remove the
retained Helm release record during recovery. Once Argo is healthy, return all
routine changes to GitOps and let it reconcile. The command follows the
documented Cilium CLI upgrade interface.

This is a recovery procedure, not a second deployment path. Keep credentials
and secret values out of this public repository.