# Cilium is the CNI, network-policy engine, and eBPF service datapath for the
# production-style K3s profile. Set this endpoint before bootstrapping a
# cluster because kube-proxy is intentionally disabled.
kubeProxyReplacement: true
k8sServiceHost: "127.0.0.1"
k8sServicePort: 6443

ipam:
  mode: kubernetes

# k3d nodes share a directly reachable Docker bridge. Native routing avoids
# nested VXLAN service paths that can prevent pod access to ClusterIP services.
routingMode: native
autoDirectNodeRoutes: true
# K3s allocates pod addresses from this cluster-wide CIDR. Native routing
# requires the CIDR so Cilium can distinguish pod traffic from underlay traffic.
ipv4NativeRoutingCIDR: 10.42.0.0/16

# The k3d nodes run as nested containers on the Flatcar host. eBPF masquerade
# keeps return traffic for cross-node service backends inside the Cilium path.
bpf:
  masquerade: true

# Keep socket load-balancing in the node namespace for the nested k3d profile.
# Pod traffic is handled by the eBPF service datapath instead.
socketLB:
  hostNamespaceOnly: true

hubble:
  enabled: true
  relay:
    enabled: true
  ui:
    enabled: true

operator:
  replicas: 1