From 923b2925de5889b592141765a34d9df57753b287 Mon Sep 17 00:00:00 2001
From: Zoe Roux <zoe.roux@zoriya.dev>
Date: Wed, 2 Jul 2025 14:42:08 +0200
Subject: [PATCH] Add a cilium-values.yaml

---
 README.md          | 25 +++------------------
 cilium-values.yaml | 56 ++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 59 insertions(+), 22 deletions(-)
 create mode 100644 cilium-values.yaml

diff --git a/README.md b/README.md
index 766c491..b6d9ed8 100644
--- a/README.md
+++ b/README.md
@@ -6,29 +6,10 @@ talosctl kubeconfig -n 192.168.0.200 -e 192.168.0.200
 talosctl bootstrap
 
 helm repo add cilium https://helm.cilium.io/
-helm install cilium cilium/cilium \
+helm upgrade -i cilium cilium/cilium \
     --version 1.17.5 \
-    --namespace \
-    --set ipam.mode=kubernetes \
-    --set kubeProxyReplacement=true \
-    --set securityContext.capabilities.ciliumAgent="{CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID}" \
-    --set securityContext.capabilities.cleanCiliumState="{NET_ADMIN,SYS_ADMIN,SYS_RESOURCE}" \
-    --set cgroup.autoMount.enabled=false \
-    --set cgroup.hostRoot=/sys/fs/cgroup \
-    --set k8sServiceHost=localhost \
-    --set k8sServicePort=7445 \
-    --set=bpf.masquerade=true \
-    --set=l2announcements.enabled=true \
-    --set=l2announcements.leaseDuration="300s" \
-    --set=l2announcements.leaseRenewDeadline="60s" \
-    --set=l2announcements.leaseRetryPeriod="10s" \
-    --set=k8sClientRateLimit.qps="50" \
-    --set=k8sClientRateLimit.burst="100" \
-    --set=externalIPs.enabled=true \
-    --set=ingressController.enabled=true \
-    --set=ingressController.loadbalancerMode=dedicated \
-    --set=gatewayAPI.enabled=true \
-    --set=operator.replicas="1"
+    --namespace kube-system \
+    --values ./cilium-values.yaml
 
 helm install argocd oci://ghcr.io/argoproj/argo-helm/argo-cd -n argocd --create-namespace
 
diff --git a/cilium-values.yaml b/cilium-values.yaml
new file mode 100644
index 0000000..0aedd2f
--- /dev/null
+++ b/cilium-values.yaml
@@ -0,0 +1,56 @@
+ipam:
+  mode: kubernetes
+kubeProxyReplacement: true
+
+securityContext:
+  capabilities:
+    ciliumAgent:
+      - CHOWN
+      - KILL
+      - NET_ADMIN
+      - NET_RAW
+      - IPC_LOCK
+      - SYS_ADMIN
+      - SYS_RESOURCE
+      - DAC_OVERRIDE
+      - FOWNER
+      - SETGID
+      - SETUID
+    cleanCiliumState: [NET_ADMIN,SYS_ADMIN,SYS_RESOURCE]
+
+cgroup:
+  autoMount:
+    enabled: false
+  hostRoot: /sys/fs/cgroup
+
+k8sServiceHost: localhost
+k8sServicePort: 7445
+
+bpf:
+  masquerade: true
+
+l2announcements:
+  enabled: true
+  leaseDuration: 300s
+  leaseRenewDeadline: 60s
+  leaseRetryPeriod: 10s
+
+k8sClientRateLimit:
+  qps: 50
+  burst: 100
+
+externalIPs:
+  enabled: true
+
+ingressController:
+  enabled: true
+  loadbalancerMode: shared
+  service:
+    annotations:
+      lbipam.cilium.io/ips: 192.168.0.201
+
+gatewayAPI:
+  enabled: true
+operator:
+  replicas: 1
+