modified: services/cilium/deploy/README.md

modified:   services/cilium/deploy/app/helm-release.yaml
modified:   services/cilium/deploy/app/helm-repo.yaml
new file:   services/cilium/deploy/app/helm-values.yaml
modified:   services/cilium/deploy/app/kustomization.yaml

services/cilium/deploy/README.md

@@ -1,6 +1,6 @@
 # Cilium
 
-<https://github.com/cilium/charts>
+<oci://quay.io/cilium/charts/cilium>
 <https://docs.cilium.io/en/stable/helm-reference/#helm-reference>
 
 ## setup and deploy
@@ -25,3 +25,12 @@ kubectl exec -n cilium  ${POD_NAME} -c cilium-agent -- cilium-dbg status
 ```bash
 kubectl get CiliumLoadBalancerIPPool -A 
 ```
+
+**Force helm:**
+
+```bash
+helm upgrade --install cilium oci://quay.io/cilium/charts/cilium \
+--version 1.19.5 \
+-f ./deploy/app/helm-values.yaml \
+--namespace cilium 
+```

services/cilium/deploy/app/helm-release.yaml

@@ -13,12 +13,7 @@ spec:
         kind: HelmRepository
         name: cilium
       interval: 40h
-  values:
-    kubeProxyReplacement: true
-    installCRDs: true
-    routingMode: native
-    enableIPv4Masquerade: true # required even if using bpf.masquerade: true
-    autoDirectNodeRoutes: true
-    bpf:
-      masquerade: true
-      hostLegacyRouting: false # force use of bfp
+  valuesFrom:
+    - kind: Secret
+      name: cilium-helm-values
+      valuesKey: values.yaml

services/cilium/deploy/app/helm-repo.yaml

@@ -4,4 +4,4 @@ metadata:
   name: cilium
 spec:
   interval: 40h
-  url: https://helm.cilium.io
+  url: oci://quay.io/cilium/charts/cilium

services/cilium/deploy/app/helm-values.yaml

@@ -0,0 +1,9 @@
+kubeProxyReplacement: true
+installCRDs: true
+routingMode: native
+enableIPv4Masquerade: true # required even if using bpf.masquerade: true
+autoDirectNodeRoutes: true
+ipv4NativeRoutingCIDR: "10.42.0.0/16"
+bpf:
+  masquerade: true
+  hostLegacyRouting: false # force use of bfp

services/cilium/deploy/app/kustomization.yaml

@@ -4,3 +4,9 @@ namespace: cilium
 resources:
  - helm-repo.yaml 
  - helm-release.yaml
+secretGenerator:
+  - name: cilium-helm-values
+    files:
+      - values.yaml=helm-values.yaml
+generatorOptions:
+  disableNameSuffixHash: true