kubernetes-security-baseline-lab/local-quickstart/cilium.md

Cilium local profile

The standard k3d profile is the default quick start. This profile is for demonstrating Cilium with kube-proxy replacement.

Create it with:

k3d cluster create --config local-quickstart/k3d-cilium-cluster-config.yaml

Before installing Cilium, set the API server endpoint in a temporary values file. The endpoint must be reachable directly from every node. Do not use the Kubernetes service VIP because kube-proxy is disabled during bootstrap.

kubectl config current-context
kubectl get nodes -o wide
cp deployments/cilium/cilium-values.yaml /tmp/cilium-values.yaml
# Replace REPLACE_WITH_API_SERVER_DNS_OR_PRIVATE_IP with the reachable API endpoint.
helm repo add cilium https://helm.cilium.io/
helm repo update
helm upgrade --install cilium cilium/cilium \
  --namespace kube-system \
  --version 1.20.0 \
  --values /tmp/cilium-values.yaml
kubectl -n kube-system rollout status daemonset/cilium --timeout=300s
kubectl -n kube-system get pods -l k8s-app=cilium

Install ArgoCD only after Cilium is Ready. Apply deployments/argocd/optional-apps/cilium.yaml manually after the endpoint is configured; it is intentionally outside the root app-of-apps watched directory until the cluster has been bootstrapped without kube-proxy.

Delete the profile with:

k3d cluster delete security-baseline-cilium