From 2c793da4f696bc50989cfca70ca96f5d9a85fc83 Mon Sep 17 00:00:00 2001 From: Jan Novak Date: Sun, 27 Sep 2026 11:16:04 +0200 Subject: [PATCH] Cilium values file for lab1; runbook Step 4 uses helm upgrade --install ipam.mode=kubernetes, operator.replicas=1 (default 2 would pin one on a worker and block scale-to-zero). Keys checked against chart 1.20.2. Co-Authored-By: Claude Opus 5.5 --- configs/cilium/values.yaml | 6 ++++++ docs/phase-1-proxmox-capi.md | 21 +++++++++++++++++---- 2 files changed, 23 insertions(+), 4 deletions(-) create mode 100644 configs/cilium/values.yaml diff --git a/configs/cilium/values.yaml b/configs/cilium/values.yaml new file mode 100644 index 0000000..9d66a38 --- /dev/null +++ b/configs/cilium/values.yaml @@ -0,0 +1,6 @@ +# helm upgrade --install cilium cilium/cilium --version 1.20.2 -n kube-system -f values.yaml +# into the workload cluster (lab1), not the management cluster +ipam: + mode: kubernetes # use the node podCIDRs from Cluster.spec.clusterNetwork (10.244.0.0/16), not 10.0.0.0/8 +operator: + replicas: 1 # default 2 with node anti-affinity would pin one to a worker and block scale-to-zero diff --git a/docs/phase-1-proxmox-capi.md b/docs/phase-1-proxmox-capi.md index 18769b7..dcb5635 100644 --- a/docs/phase-1-proxmox-capi.md +++ b/docs/phase-1-proxmox-capi.md @@ -124,13 +124,26 @@ matches Nodes to Machines by it. ## Step 4 — Cilium +Values in [configs/cilium/values.yaml](../configs/cilium/values.yaml); `upgrade --install` is +safe to re-run. + ```bash -export KUBECONFIG=$PWD/lab1.kubeconfig -helm repo add cilium https://helm.cilium.io && helm repo update -helm install cilium cilium/cilium --version 1.20.2 -n kube-system --set ipam.mode=kubernetes +clusterctl get kubeconfig lab1 --kubeconfig ~/.kube/lab-mgmt.kubeconfig > ~/.kube/lab1.kubeconfig +chmod 600 ~/.kube/lab1.kubeconfig +export KUBECONFIG=~/.kube/lab1.kubeconfig + +helm repo add cilium https://helm.cilium.io && helm repo update cilium +helm upgrade --install cilium cilium/cilium --version 1.20.2 -n kube-system \ + -f configs/cilium/values.yaml --wait --timeout 10m + +kubectl get nodes # both Ready +kubectl -n kube-system get pods -o wide # cilium DaemonSet 2/2, operator 1/1, coredns Running ``` -`ipam.mode=kubernetes` uses the pod CIDR from `clusterNetwork` instead of Cilium's `10.0.0.0/8` default. +- `ipam.mode=kubernetes` uses the pod CIDR from `clusterNetwork` instead of Cilium's `10.0.0.0/8` default. +- `operator.replicas: 1`: the default 2 replicas with node anti-affinity put one on a worker, and a + kube-system pod without a PDB blocks scale-down to zero. +- kube-proxy stays (kubeadm default); no kube-proxy replacement in this phase. ## Step 5 — autoscaling annotations