27 lines
1.3 KiB
Markdown
27 lines
1.3 KiB
Markdown
# Cilium recovery
|
|
|
|
Argo CD is the normal owner of Cilium. Use this only if Argo CD cannot restore
|
|
the CNI and the cluster needs a break-glass repair. Work from a fresh checkout
|
|
of this repository and verify `kubectl config current-context` is
|
|
`kubernetes-admin@kubernetes` before any cluster changes.
|
|
|
|
The chart version is canonically recorded as `spec.sources[0].targetRevision`
|
|
in `bootstrap/cilium.yaml`; the cluster configuration is in `apps/cilium/values.yaml`.
|
|
After checking the context and reviewing the target version, recover the Helm
|
|
release with the Cilium CLI (the CLI expects a `v` prefix):
|
|
|
|
```sh
|
|
chart_version="$(yq -r '.spec.sources[0].targetRevision' bootstrap/cilium.yaml)"
|
|
cilium upgrade --namespace kube-system --version "v${chart_version}" \
|
|
--values apps/cilium/values.yaml --wait
|
|
```
|
|
|
|
Restore the Hubble CA resources from `apps/cilium/resources/hubble-pki.yaml` only
|
|
if they are missing. Do not uninstall Cilium, delete its CRDs, or remove the
|
|
retained Helm release record during recovery. Once Argo is healthy, return all
|
|
routine changes to GitOps and let it reconcile. The command follows the
|
|
documented Cilium CLI upgrade interface.
|
|
|
|
This is a recovery procedure, not a second deployment path. Keep credentials
|
|
and secret values out of this public repository.
|