The cilium Argo CD Application consumes the upstream cilium Helm chart. Its targetRevision in bootstrap/cilium.yaml is the single chart-version setting; the values in this directory are the cluster-specific configuration. The same Application owns the Hubble internal CA/issuers and Cilium availability alert in resources/.

Cilium is the cluster CNI, so chart upgrades are higher risk than ordinary app upgrades. Before changing targetRevision, render the new chart with values.yaml, compare resource identities and critical networking settings, and confirm the rollback/recovery route. Do not remove the retained Cilium Helm release record or delete Cilium CRDs as cleanup; the CRDs are not rendered or managed by this Argo Application. Argo is the normal writer; the old cilium repository's installer is break-glass recovery only.

If Argo cannot restore Cilium, see RECOVERY.md for the break-glass procedure.