# helm upgrade --install cilium cilium/cilium --version 1.20.2 -n kube-system -f values.yaml
# into the workload cluster (lab1), not the management cluster
ipam:
  mode: kubernetes          # use the node podCIDRs from Cluster.spec.clusterNetwork (10.244.0.0/16), not 10.0.0.0/8
operator:
  replicas: 1               # default 2 with node anti-affinity would pin one to a worker and block scale-to-zero
  nodeSelector:             # replicas: 1 alone still let the scheduler pick the worker; chart tolerates the CP taint
    node-role.kubernetes.io/control-plane: ""