modified: services/cilium/deploy/README.md

modified:   services/cilium/deploy/app/helm-release.yaml
modified:   services/cilium/deploy/app/helm-repo.yaml
new file:   services/cilium/deploy/app/helm-values.yaml
modified:   services/cilium/deploy/app/kustomization.yaml

services/cilium/deploy/app/helm-release.yaml

@@ -13,12 +13,7 @@ spec:
         kind: HelmRepository
         name: cilium
       interval: 40h
-  values:
-    kubeProxyReplacement: true
-    installCRDs: true
-    routingMode: native
-    enableIPv4Masquerade: true # required even if using bpf.masquerade: true
-    autoDirectNodeRoutes: true
-    bpf:
-      masquerade: true
-      hostLegacyRouting: false # force use of bfp
+  valuesFrom:
+    - kind: Secret
+      name: cilium-helm-values
+      valuesKey: values.yaml

services/cilium/deploy/app/helm-repo.yaml

@@ -4,4 +4,4 @@ metadata:
   name: cilium
 spec:
   interval: 40h
-  url: https://helm.cilium.io
+  url: oci://quay.io/cilium/charts/cilium

services/cilium/deploy/app/helm-values.yaml

@@ -0,0 +1,9 @@
+kubeProxyReplacement: true
+installCRDs: true
+routingMode: native
+enableIPv4Masquerade: true # required even if using bpf.masquerade: true
+autoDirectNodeRoutes: true
+ipv4NativeRoutingCIDR: "10.42.0.0/16"
+bpf:
+  masquerade: true
+  hostLegacyRouting: false # force use of bfp

services/cilium/deploy/app/kustomization.yaml

@@ -4,3 +4,9 @@ namespace: cilium
 resources:
  - helm-repo.yaml 
  - helm-release.yaml
+secretGenerator:
+  - name: cilium-helm-values
+    files:
+      - values.yaml=helm-values.yaml
+generatorOptions:
+  disableNameSuffixHash: true