chore(cilium): Move Cilium configuration to kustomize-bases

k8s-peterg/cilium/gateways.yaml

@@ -26,30 +26,3 @@ spec:
         certificateRefs:
           - kind: Secret
             name: tls-wildcard-peterg-nl
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  name: internal
-spec:
-  gatewayClassName: cilium
-  addresses:
-    - type: IPAddress
-      value: 10.167.84.11
-  listeners:
-    - allowedRoutes:
-        namespaces:
-          from: All
-      name: http
-      port: 80
-      protocol: HTTP
-    - allowedRoutes:
-        namespaces:
-          from: All
-      name: https
-      port: 443
-      protocol: HTTPS
-      tls:
-        certificateRefs:
-          - kind: Secret
-            name: tls-wildcard-peterg-nl

k8s-peterg/cilium/httproute.yaml

@@ -1,22 +1,6 @@
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
-metadata:
-  name: http-filter-redirect
-spec:
-  parentRefs:
-    - name: public
-      sectionName: http
-    - name: internal
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
 metadata:
   name: hubble-route
   namespace: kube-system

k8s-peterg/cilium/ip-pool.yaml

@@ -14,10 +14,3 @@ metadata:
 spec:
   blocks:
     - cidr: "10.7.65.250/32"
----
-apiVersion: "cilium.io/v2alpha1"
-kind: CiliumL2AnnouncementPolicy
-metadata:
-  name: l2adv
-spec:
-  loadBalancerIPs: true

k8s-peterg/cilium/kustomization.yaml

@@ -4,14 +4,19 @@ kind: Kustomization
 namespace: kube-system
 
 resources:
+  - ../../kustomize-bases/cilium
   - ip-pool.yaml
   - gateways.yaml
   - httproute.yaml
 
-helmCharts:
+patches:
-  - name: cilium
+  - patch: |-
-    repo: https://helm.cilium.io
+      - op: replace
-    namespace: kube-system
+        path: /spec/addresses/0/value
-    releaseName: cilium
+        value: 10.167.84.11 
-    version: 1.18.3
+      - op: replace
-    valuesFile: values.yaml
+        path: /spec/listeners/1/tls/certificateRefs/0/name
+        value: tls-wildcard-peterg-nl
+    target:
+      kind: Gateway
+      name: internal

k8s-wheatley/cilium/ip-pool.yaml

@@ -6,10 +6,3 @@ metadata:
 spec:
   blocks:
     - cidr: "10.13.37.30/32"
----
-apiVersion: "cilium.io/v2alpha1"
-kind: CiliumL2AnnouncementPolicy
-metadata:
-  name: l2adv
-spec:
-  loadBalancerIPs: true

k8s-wheatley/cilium/kustomization.yaml

@@ -4,14 +4,19 @@ kind: Kustomization
 namespace: kube-system
 
 resources:
+  - ../../kustomize-bases/cilium
   - ip-pool.yaml
   - gateways.yaml
   - httproute.yaml
 
-helmCharts:
+patches:
-  - name: cilium
+  - patch: |-
-    repo: https://helm.cilium.io
+      - op: replace
-    namespace: kube-system
+        path: /spec/addresses/0/value
-    releaseName: cilium
+        value: 10.13.37.30 
-    version: 1.18.3
+      - op: replace
-    valuesFile: values.yaml
+        path: /spec/listeners/1/tls/certificateRefs/0/name
+        value: tls-wildcard-wheatley-in
+    target:
+      kind: Gateway
+      name: internal

k8s-wheatley/cilium/values.yaml

@@ -1,38 +0,0 @@
-k8sServiceHost: localhost
-k8sServicePort: 7445
-kubeProxyReplacement: true
-
-cgroup:
-  hostRoot: /sys/fs/cgroup
-  autoMount:
-    enabled: false
-
-securityContext:
-  capabilities:
-    ciliumAgent:
-      - CHOWN
-      - KILL
-      - NET_ADMIN
-      - NET_RAW
-      - IPC_LOCK
-      - SYS_ADMIN
-      - SYS_RESOURCE
-      - DAC_OVERRIDE
-      - FOWNER
-      - SETGID
-      - SETUID
-    cleanCiliumState:
-      - NET_ADMIN
-      - SYS_ADMIN
-      - SYS_RESOURCE
-
-hubble:
-  relay:
-    enabled: true
-  ui:
-    enabled: true
-
-gatewayAPI:
-  enabled: true
-  enableAlpn: true
-  enableAppProtocol: true

kustomize-bases/cilium/gateways.yaml

@@ -7,7 +7,7 @@ spec:
   gatewayClassName: cilium
   addresses:
     - type: IPAddress
-      value: 10.13.37.30
+      value: placeholder
   listeners:
     - allowedRoutes:
         namespaces:
@@ -15,3 +15,13 @@ spec:
       name: http
       port: 80
       protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - kind: Secret
+            name: placeholder

kustomize-bases/cilium/httproute.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: http-filter-redirect
+spec:
+  parentRefs:
+    - name: public
+      sectionName: http
+    - name: internal
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https

kustomize-bases/cilium/kustomization.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: kube-system
+
+resources:
+  - l2-advertisement.yaml
+  - gateways.yaml
+  - httproute.yaml
+
+helmCharts:
+  - name: cilium
+    repo: https://helm.cilium.io
+    namespace: kube-system
+    releaseName: cilium
+    version: 1.18.3
+    valuesFile: values.yaml

kustomize-bases/cilium/l2-advertisement.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: "cilium.io/v2alpha1"
+kind: CiliumL2AnnouncementPolicy
+metadata:
+  name: l2adv
+spec:
+  loadBalancerIPs: true