fix(cilium): disable kube-proxy replacement, adjust cgroup and capabi…

…lities
tyriis · Apr 6, 2024 · 47ba4ce · 47ba4ce
1 parent df49c21
commit 47ba4ce
Show file tree

Hide file tree

Showing 3 changed files with 44 additions and 2 deletions.
diff --git a/infra/talos/talconfig.yaml b/infra/talos/talconfig.yaml
@@ -75,7 +75,7 @@ domain: cluster.local
 allowSchedulingOnMasters: true
 allowSchedulingOnControlPlanes: true
 cniConfig:
-  name: flannel
+  name: none
 
 controlPlane:
   schematic:

diff --git a/kubernetes/talos-flux/apps/kube-system/cilium/app/helm-release.yaml b/kubernetes/talos-flux/apps/kube-system/cilium/app/helm-release.yaml
@@ -133,4 +133,25 @@ spec:
     rollOutCiliumPods: true
     securityContext:
       privileged: true
+      capabilities:
+        ciliumAgent:
+          - CHOWN
+          - KILL
+          - NET_ADMIN
+          - NET_RAW
+          - IPC_LOCK
+          - SYS_ADMIN
+          - SYS_RESOURCE
+          - DAC_OVERRIDE
+          - FOWNER
+          - SETGID
+          - SETUID
+        cleanCiliumState:
+          - NET_ADMIN
+          - SYS_ADMIN
+          - SYS_RESOURCE
+    cgroup:
+      autoMount:
+        enabled: false
+      hostRoot: /sys/fs/cgroup
     routingMode: native
diff --git a/kubernetes/talos-flux/bootstrap/cilium/values.yaml b/kubernetes/talos-flux/bootstrap/cilium/values.yaml
@@ -72,7 +72,7 @@ endpointRoutes:
 ipam:
   mode: kubernetes
 ipv4NativeRoutingCIDR: 10.245.0.0/16
-# kubeProxyReplacement: strict
+kubeProxyReplacement: disabled
 # kubeProxyReplacementHealthzBindAddr: 0.0.0.0:10256
 l2announcements:
   enabled: false
@@ -106,4 +106,25 @@ dashboards:
 rollOutCiliumPods: true
 securityContext:
   privileged: true
+  capabilities:
+    ciliumAgent:
+      - CHOWN
+      - KILL
+      - NET_ADMIN
+      - NET_RAW
+      - IPC_LOCK
+      - SYS_ADMIN
+      - SYS_RESOURCE
+      - DAC_OVERRIDE
+      - FOWNER
+      - SETGID
+      - SETUID
+    cleanCiliumState:
+      - NET_ADMIN
+      - SYS_ADMIN
+      - SYS_RESOURCE
+  cgroup:
+    autoMount:
+      enabled: false
+    hostRoot: /sys/fs/cgroup
 # routingMode: native