Cilium values file for lab1; runbook Step 4 uses helm upgrade --install

ipam.mode=kubernetes, operator.replicas=1 (default 2 would pin one on a
worker and block scale-to-zero). Keys checked against chart 1.20.2.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

configs/cilium/values.yaml

@@ -0,0 +1,6 @@
+# helm upgrade --install cilium cilium/cilium --version 1.20.2 -n kube-system -f values.yaml
+# into the workload cluster (lab1), not the management cluster
+ipam:
+  mode: kubernetes          # use the node podCIDRs from Cluster.spec.clusterNetwork (10.244.0.0/16), not 10.0.0.0/8
+operator:
+  replicas: 1               # default 2 with node anti-affinity would pin one to a worker and block scale-to-zero

docs/phase-1-proxmox-capi.md

@@ -124,13 +124,26 @@ matches Nodes to Machines by it.
 
 ## Step 4 — Cilium
 
+Values in [configs/cilium/values.yaml](../configs/cilium/values.yaml); `upgrade --install` is
+safe to re-run.
+
 ```bash
-export KUBECONFIG=$PWD/lab1.kubeconfig
+clusterctl get kubeconfig lab1 --kubeconfig ~/.kube/lab-mgmt.kubeconfig > ~/.kube/lab1.kubeconfig
-helm repo add cilium https://helm.cilium.io && helm repo update
+chmod 600 ~/.kube/lab1.kubeconfig
-helm install cilium cilium/cilium --version 1.20.2 -n kube-system --set ipam.mode=kubernetes
+export KUBECONFIG=~/.kube/lab1.kubeconfig
+
+helm repo add cilium https://helm.cilium.io && helm repo update cilium
+helm upgrade --install cilium cilium/cilium --version 1.20.2 -n kube-system \
+  -f configs/cilium/values.yaml --wait --timeout 10m
+
+kubectl get nodes                                          # both Ready
+kubectl -n kube-system get pods -o wide                    # cilium DaemonSet 2/2, operator 1/1, coredns Running
 ```
 
-`ipam.mode=kubernetes` uses the pod CIDR from `clusterNetwork` instead of Cilium's `10.0.0.0/8` default.
+- `ipam.mode=kubernetes` uses the pod CIDR from `clusterNetwork` instead of Cilium's `10.0.0.0/8` default.
+- `operator.replicas: 1`: the default 2 replicas with node anti-affinity put one on a worker, and a
+  kube-system pod without a PDB blocks scale-down to zero.
+- kube-proxy stays (kubeadm default); no kube-proxy replacement in this phase.
 
 ## Step 5 — autoscaling annotations