cilium 1.17.8

2025-10-24 19:24:16 +02:00
parent 4786b2ff42
commit 92c95645af
5 changed files with 4128 additions and 122 deletions
--- a/cilium/cilium-preflight.yaml
+++ b/cilium/cilium-preflight.yaml
@@ -0,0 +1,293 @@
+---
+# Source: cilium/templates/cilium-preflight/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: "cilium-pre-flight"
+  namespace: kube-system
+---
+# Source: cilium/templates/cilium-preflight/clusterrole.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: cilium-pre-flight
+  labels:
+    app.kubernetes.io/part-of: cilium
+rules:
+- apiGroups:
+  - networking.k8s.io
+  resources:
+  - networkpolicies
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - discovery.k8s.io
+  resources:
+  - endpointslices
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - namespaces
+  - services
+  - pods
+  - endpoints
+  - nodes
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - list
+  - watch
+  # This is used when validating policies in preflight. This will need to stay
+  # until we figure out how to avoid "get" inside the preflight, and then
+  # should be removed ideally.
+  - get
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - get
+- apiGroups:
+  - cilium.io
+  resources:
+  - ciliumloadbalancerippools
+  - ciliumbgppeeringpolicies
+  - ciliumbgpnodeconfigs
+  - ciliumbgpadvertisements
+  - ciliumbgppeerconfigs
+  - ciliumclusterwideenvoyconfigs
+  - ciliumclusterwidenetworkpolicies
+  - ciliumegressgatewaypolicies
+  - ciliumendpoints
+  - ciliumendpointslices
+  - ciliumenvoyconfigs
+  - ciliumidentities
+  - ciliumlocalredirectpolicies
+  - ciliumnetworkpolicies
+  - ciliumnodes
+  - ciliumnodeconfigs
+  - ciliumcidrgroups
+  - ciliuml2announcementpolicies
+  - ciliumpodippools
+  verbs:
+  - list
+  - watch
+- apiGroups:
+  - cilium.io
+  resources:
+  - ciliumidentities
+  - ciliumendpoints
+  - ciliumnodes
+  verbs:
+  - create
+- apiGroups:
+  - cilium.io
+  # To synchronize garbage collection of such resources
+  resources:
+  - ciliumidentities
+  verbs:
+  - update
+- apiGroups:
+  - cilium.io
+  resources:
+  - ciliumendpoints
+  verbs:
+  - delete
+  - get
+- apiGroups:
+  - cilium.io
+  resources:
+  - ciliumnodes
+  - ciliumnodes/status
+  verbs:
+  - get
+  - update
+- apiGroups:
+  - cilium.io
+  resources:
+  - ciliumendpoints/status
+  - ciliumendpoints
+  - ciliuml2announcementpolicies/status
+  - ciliumbgpnodeconfigs/status
+  verbs:
+  - patch
+---
+# Source: cilium/templates/cilium-preflight/clusterrolebinding.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: cilium-pre-flight
+  labels:
+    app.kubernetes.io/part-of: cilium
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cilium-pre-flight
+subjects:
+- kind: ServiceAccount
+  name: "cilium-pre-flight" 
+  namespace: kube-system
+---
+# Source: cilium/templates/cilium-preflight/daemonset.yaml
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: cilium-pre-flight-check
+  namespace: kube-system
+spec:
+  selector:
+    matchLabels:
+      k8s-app: cilium-pre-flight-check
+      kubernetes.io/cluster-service: "true"
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/part-of: cilium
+        k8s-app: cilium-pre-flight-check
+        app.kubernetes.io/name: cilium-pre-flight-check
+        kubernetes.io/cluster-service: "true"
+    spec:
+      affinity:
+        podAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+          - labelSelector:
+              matchLabels:
+                k8s-app: cilium
+            topologyKey: kubernetes.io/hostname
+      initContainers:
+        - name: clean-cilium-state
+          image: "quay.io/cilium/cilium:v1.17.8@sha256:6d7ea72ed311eeca4c75a1f17617a3d596fb6038d30d00799090679f82a01636"
+          imagePullPolicy: IfNotPresent
+          command: ["/bin/echo"]
+          args:
+          - "hello"
+          terminationMessagePolicy: FallbackToLogsOnError
+      containers:
+        - name: cilium-pre-flight-check
+          image: "quay.io/cilium/cilium:v1.17.8@sha256:6d7ea72ed311eeca4c75a1f17617a3d596fb6038d30d00799090679f82a01636"
+          imagePullPolicy: IfNotPresent
+          command: ["/bin/sh"]
+          args:
+          - -c
+          - "touch /tmp/ready; sleep 1h"
+          livenessProbe:
+            exec:
+              command:
+              - cat
+              - /tmp/ready
+            initialDelaySeconds: 5
+            periodSeconds: 5
+          readinessProbe:
+            exec:
+              command:
+              - cat
+              - /tmp/ready
+            initialDelaySeconds: 5
+            periodSeconds: 5
+          env:
+          - name: K8S_NODE_NAME
+            valueFrom:
+              fieldRef:
+                apiVersion: v1
+                fieldPath: spec.nodeName
+          volumeMounts:
+          - name: cilium-run
+            mountPath: /var/run/cilium
+          terminationMessagePolicy: FallbackToLogsOnError
+      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
+      restartPolicy: Always
+      priorityClassName: system-node-critical
+      serviceAccountName: "cilium-pre-flight"
+      automountServiceAccountToken: true
+      terminationGracePeriodSeconds: 1
+      nodeSelector:
+        kubernetes.io/os: linux
+      tolerations:
+        - operator: Exists
+      volumes:
+        # To keep state between restarts / upgrades
+      - name: cilium-run
+        hostPath:
+          path: /var/run/cilium
+          type: DirectoryOrCreate
+      - name: bpf-maps
+        hostPath:
+          path: /sys/fs/bpf
+          type: DirectoryOrCreate
+---
+# Source: cilium/templates/cilium-preflight/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cilium-pre-flight-check
+  namespace: kube-system
+  labels:
+    app.kubernetes.io/part-of: cilium
+    app.kubernetes.io/name: cilium-pre-flight-check    
+spec:
+  selector:
+    matchLabels:
+      k8s-app: cilium-pre-flight-check-deployment
+      kubernetes.io/cluster-service: "true"
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/part-of: cilium
+        k8s-app: cilium-pre-flight-check-deployment
+        kubernetes.io/cluster-service: "true"
+        app.kubernetes.io/name: cilium-pre-flight-check
+    spec:
+      containers:
+        - name: cnp-validator
+          image: "quay.io/cilium/cilium:v1.17.8@sha256:6d7ea72ed311eeca4c75a1f17617a3d596fb6038d30d00799090679f82a01636"
+          imagePullPolicy: IfNotPresent
+          command: ["/bin/sh"]
+          args:
+          - -ec
+          - |
+            cilium-dbg preflight validate-cnp;
+            touch /tmp/ready-validate-cnp;
+            sleep 1h;
+          readinessProbe:
+            exec:
+              command:
+              - cat
+              - /tmp/ready-validate-cnp
+            initialDelaySeconds: 5
+            periodSeconds: 5
+          env:
+          - name: KUBERNETES_SERVICE_HOST
+            value: "localhost"
+          - name: KUBERNETES_SERVICE_PORT
+            value: "7445"
+          terminationMessagePolicy: FallbackToLogsOnError
+      hostNetwork: true
+      restartPolicy: Always
+      priorityClassName: system-cluster-critical
+      serviceAccountName: "cilium-pre-flight"
+      automountServiceAccountToken: true
+      terminationGracePeriodSeconds: 1
+      affinity:
+        podAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+          - labelSelector:
+              matchLabels:
+                k8s-app: cilium
+            topologyKey: kubernetes.io/hostname
+      nodeSelector:
+        kubernetes.io/os: linux
+      tolerations:
+        - operator: Exists
--- a/cilium/main.yaml
+++ b/cilium/main.yaml
@@ -768,8 +768,6 @@ data:
  bpf-map-dynamic-size-ratio: "0.0025"
  bpf-policy-map-max: "16384"
  bpf-root: /sys/fs/bpf
-  ces-rate-limits: '[{"burst":20,"limit":10,"nodes":0},{"burst":100,"limit":50,"nodes":100}]'
-  ces-slice-mode: identity
  cgroup-root: /sys/fs/cgroup
  cilium-endpoint-gc-interval: 5m0s
  cluster-id: "1"
@@ -781,7 +779,6 @@ data:
  custom-cni-conf: "false"
  datapath-mode: veth
  debug: "false"
-  debug-verbose: ""
  default-lb-service-ipam: lbipam
  devices: eth+
  direct-routing-skip-unreachable: "false"
@@ -790,7 +787,6 @@ data:
  egress-gateway-reconciliation-trigger-interval: 1s
  enable-auto-protect-node-port-range: "true"
  enable-bpf-clock-probe: "false"
-  enable-cilium-endpoint-slice: "true"
  enable-endpoint-health-checking: "true"
  enable-endpoint-lockdown-on-policy-overflow: "false"
  enable-envoy-config: "true"
@@ -889,11 +885,9 @@ data:
  nat-map-stats-entries: "32"
  nat-map-stats-interval: 30s
  node-port-bind-protection: "true"
-  nodeport-addresses: ""
  nodes-gc-interval: 5m0s
  operator-api-serve-addr: 127.0.0.1:9234
  operator-prometheus-serve-addr: :9963
-  policy-cidr-match-mode: ""
  policy-secrets-namespace: cilium-secrets
  policy-secrets-only-from-secrets-namespace: "true"
  preallocate-bpf-maps: "false"
@@ -971,8 +965,8 @@ metadata:
 ---
 apiVersion: v1
 data:
-  ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURFekNDQWZ1Z0F3SUJBZ0lRSUZ3eThzeXlxQ2loRTFRQUZPWkdqVEFOQmdrcWhraUc5dzBCQVFzRkFEQVUKTVJJd0VBWURWUVFERXdsRGFXeHBkVzBnUTBFd0hoY05NalV4TURJeU1qSXlPVE0zV2hjTk1qZ3hNREl4TWpJeQpPVE0zV2pBVU1SSXdFQVlEVlFRREV3bERhV3hwZFcwZ1EwRXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCCkR3QXdnZ0VLQW9JQkFRREY1YjJsR2tZcjJjNm53MVVlS3UvOWkxazU2ZzNITUZnSXZ4MS9TSks1L2VIek1zT1oKQ1FTdUg1QlhoNnpGbDlQTktFaXNNdE1LRjdsSmF1TWFpajFxY1lqcURkVlFQM1F3V2tOa1hPNndtNU02YlQ5agpPUEt5bXljTHNtTFEzLzE5NUtZME5KbkJMNWtLYit2UDdBeHllOGpGeUoxQWFLNHhqZHp0REMwZjM5VHJKaysvCjMxdjZqUnpZczRwL29rN1pyRDd3Yi9Td2dCdzJocGVuLzdhN0Z3akQzVDhxMUF2bDdESkQ5bzBwMm1QZFA0OGgKNnMxUHB3eUUvcWZ4QVovRm85YTBHdWs0dVlMTmJvRjBEVVNZS3dVOVU2SzZLMEp6OXF5Mjh3NUtKaGRDUnRJVgpWdGRGNDJMeUhNaVZmT3pBQzFKQllLSTgvWTdjUndrc3hIOS9BZ01CQUFHallUQmZNQTRHQTFVZER3RUIvd1FFCkF3SUNwREFkQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXcKQXdFQi96QWRCZ05WSFE0RUZnUVV2dHJyVWhScHBuOTE3ZlBLc2JBLzVnZExFVUF3RFFZSktvWklodmNOQVFFTApCUUFEZ2dFQkFKS09WRVpDSzlnQkxLaUxVZ1dTd2dybms4cWp6cHR5YUFlSEtsUUhIS1FNYXBycWdUZkVPRmQ4CkYzRUxwQmZYeHBRNTJBa3N4c0JjZ2ZJRnphclRrRU8yOHNCR0pheEhxbENaQVpBY2ZhSWVJdVR4TlNnQXNtV0UKV2J1bDduWGZmL2FsNXJsRWJnZXdiMVpzSVVaNGF4L3FJZzJFd3l5VGhNQ0lpdi9HZFBmY2NWZ2ZLVlJOdGJ4WQpaOWxXdTlNOVRSU0JsOUVtQTNuWFVsRnBnMmZVYSsxNzNpeWpGa05pRXh0RldzaXVlcUxOd3F4czY5R0pEVFh5CnpUVklWWUFWeWdmcFM1cTJ0eERKdzNlcWNDZUlvREljelI0eU1nSUdkcG1nWTdYZmZYOVI2aTd2UFNEcDYwRjUKZTRHWG54NUhtYjBYK2tueXRxZ1pTNWphV25ZVzNxST0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
-  ca.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBeGVXOXBScEdLOW5PcDhOVkhpcnYvWXRaT2VvTnh6QllDTDhkZjBpU3VmM2g4ekxECm1Ra0VyaCtRVjRlc3haZlR6U2hJckRMVENoZTVTV3JqR29vOWFuR0k2ZzNWVUQ5ME1GcERaRnp1c0p1VE9tMC8KWXpqeXNwc25DN0ppME4vOWZlU21ORFNad1MrWkNtL3J6K3dNY252SXhjaWRRR2l1TVkzYzdRd3RIOS9VNnlaUAp2OTliK28wYzJMT0tmNkpPMmF3KzhHLzBzSUFjTm9hWHAvKzJ1eGNJdzkwL0t0UUw1ZXd5US9hTktkcGozVCtQCkllck5UNmNNaFA2bjhRR2Z4YVBXdEJycE9MbUN6VzZCZEExRW1Dc0ZQVk9pdWl0Q2MvYXN0dk1PU2lZWFFrYlMKRlZiWFJlTmk4aHpJbFh6c3dBdFNRV0NpUFAyTzNFY0pMTVIvZndJREFRQUJBb0lCQUFtVlhkODZkcXJyVExQMQpBTkM3a3N6ayttRjMvZWExZFNDWmgyUEUramtuZUh3WmxmWlBHbFBBa0J5QmVSMWloQ1p0VUVPaWlxekoxaG56CmxPTlkzQ0RkNE1hTlViaXorUkZuN29JYlZxemxJRVRXSDZmaG0wcFFMSnljZEJIVEYvTWs5WEg1YmxzcDZteFUKUDRleTRCRnY1Q2o5bkh2a1o2VmJQL3JzeURINXRiOFdtbGpxbExQZlo0eENoQWlkRVE4L1N1UksvYy8vT2h5dgpITTN0RndyNmhlclRjTW5BZ0piS0JNR0NBMTlCOWxZRFNJY2NmTUJ2Z2tvZWVGNEVTWlJrUksyRVZtTVRBOHlFClFQRnB5YnZyYTZtNG1nVEdYL3NBMFBIczZkMXRkODVhTU1zbmFoeHdpSS9DdFYzVzVSOEpqd1lZeFR3VWllUWIKRkcyek5qMENnWUVBK2hBdlYvQWhndnl6VjBWaWtVUmZlMUk1U0ZXSXhEK2licDZweUgxN3dVbHdDMmFBRzZGSwpRWVFLWFAwOUhYZGcvMUYvODdYYldEZWlZTU1DWFBZREJMaVorNkRXN1RHUkJPeWdJS1RwT2l5UTNnTE0zdmhXClgwVHE5MEJJT1cyMjRnSFVsUVJodFExTDFyYjZPU3o0eXRuTjFZQjVRSjB4MWFLaFNpRjVQMlVDZ1lFQXlwaUIKcjRTOWhqczBKWjRlczZMbEtLZ0gydGRrTUlKUURaUmsxRkQrMWtNdExoTVYwZEN4NUlDZWlnUWhHZ1ZWRWJkeQo2cFFONUJ3Q0IvK1JkelBSVkJBRFMwb2JGVHpURWs3T3Q2NjVCcE9iY1JCSVpkWDAyOEpjVVRDT1pIclZQRzFoClEraC9YMEltK3BXMHZ2dFUrcjVGV2ZpVSt2cmNDSGtwbHpTb2J4TUNnWUFXc0FVN20wUFBHSkpFNXJ5c3BXRnMKVk9keGtxRVgvUllGcDB1TUx5WmRRUVp6WWxkWkttY01UcWlLQzBmU05wU01WWjZnUSsya3NWZUFJL0ZBOGVrUQpNcGQxNXYvWkFWaEE5QjhMRnlzNTVmVTJ6MVk3SEpqcGg5MHhsWmwzN0daZFZ3RXNpL3M1YS8xbmU2NTBKWXBsCkRTSEpyeUJSSm5IeENoSk1JWUZZcVFLQmdENlpaT2p3NFFiSzRGQUhUWUZBQWdMUCtLMWNCRzhndE0rZFhKSmwKL0hnRUJiL0kwZU1rMHZMQjh6cStEK1JVWlhhMThtSWRJVFdzbWN3UzRjV3RVeTdnUzhSRnY1eU9VTUhGYkFaQgpqSlpGb2JBTDBmTDFhMVZEOXZaM1JHZ3p0Qk9aMElZRkh1WTJNSWtaSE9JdUVwSHZuTW95RHdhRjROc1ZaUTU5CmpOWFZBb0dCQUtxOGcvcnNQVysraFd5Yy9URHZmMEEyL1N0UFhaemVKV1RsQWVHZHVYRjgrQlhYVWhLU2J6U2MKNFQrSDgybkVBRVR0UWpmK04vVjlwZ2dVOEszQW42NjBJVnY0OXBndWJRMGpuVHBGK05TdmpMc0EyRDNTUURBdQpvNVNST3M3NnFQaWRueEszSHlRRk1qQkhKbGk0OWVINFp2bkVaK21iWG11amdkSkxPbGhlCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==
+  ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURFekNDQWZ1Z0F3SUJBZ0lRSVl0VE1lazQyektUb2pzV0I5Wm05ekFOQmdrcWhraUc5dzBCQVFzRkFEQVUKTVJJd0VBWURWUVFERXdsRGFXeHBkVzBnUTBFd0hoY05NalV4TURJek1qQTFOek0xV2hjTk1qZ3hNREl5TWpBMQpOek0xV2pBVU1SSXdFQVlEVlFRREV3bERhV3hwZFcwZ1EwRXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCCkR3QXdnZ0VLQW9JQkFRQzh2am5vbVJDL3M1VUlQQ0lrV29tcC9nWTJ3UFUwU0hIVjBzYytNRXk5TndqSy92czQKMHhkQkpTblhyai92aFcxY0RqUFZHN2hNeHZONUJtZEZZTUtIYitqREl3d0JmYkR3SVQ0SktVV0dDVi9FMVFkMwp4dHlrYUF0V2doMHFOd05Wb2VHZmZ5UDFnNHhhYStJcGRyTk03K2lSbGZ4ekQyUGx3L2RsVzZLQzFaY2ErK0VyCjdhTS82bnV3cm50ZWM5dmpJWnUxbTZvN3UxNUF0NW9GcmxVUEoyUUloS09sMUdtdUprV0NEVUtaZmRSZXdLYTQKOXpJKzBvVS8xV1RZVFJVV3k4bGFSTXNGL1FlNjZRc3BkM0JOZGxLVlhQWlgvNlgyUjdqZWNsRzdJT2FveVNLTgp2WHZwVkpBbFJFU3A2U2ZFNy9HVzJhbm4zaVBVMWkvYlhXSUJBZ01CQUFHallUQmZNQTRHQTFVZER3RUIvd1FFCkF3SUNwREFkQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXcKQXdFQi96QWRCZ05WSFE0RUZnUVVQYU1uTDdVOEEza0RtYlVOay91OTBua3dIZWN3RFFZSktvWklodmNOQVFFTApCUUFEZ2dFQkFKSlNXd0c3S0VzNzZjSFNkQVJpb2Y5VFVZK1VFK0U0TWJSMytPYmFFWlJ2bXZmMGZ4UlVIQS9RCm1VSW1RTGYvTHRlK2RDRGx5RmxFK0ZSazM0RUErT3V0eDRYczEwRElKRzY4bEFsbGRtTk1xNXRKQU5zV25DVW4KVVZTR0U0eTZwRkFxU3RzVE5neDBNeUQ3Y3cvMnQ1NlpzT2FxSW5TVXNKUXZZZWhYWGwwV1BORGpwZVhFcGNrSgpkb0k5Z3VReERHRTc3SUs5QmNvSXY2d1p2elVrSFRBUndGSWNIaC8zUjJvQ1lzTXZvN29Jd3Z0cHcybFMxU1JwCkFqcTRjejdtRzVxaC9MUE5vd1FZc0QwUDhaUG9XN0UxRTBGU3BCK0pVOTUzVTJNOW16ME5pUzJQa1VPeXl6dXQKYTdWUDZBb09VMjRHb3J3SEVCSWduaWpQMk0rYnNRVT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
+  ca.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBdkw0NTZKa1F2N09WQ0R3aUpGcUpxZjRHTnNEMU5FaHgxZExIUGpCTXZUY0l5djc3Ck9OTVhRU1VwMTY0Lzc0VnRYQTR6MVJ1NFRNYnplUVpuUldEQ2gyL293eU1NQVgydzhDRStDU2xGaGdsZnhOVUgKZDhiY3BHZ0xWb0lkS2pjRFZhSGhuMzhqOVlPTVdtdmlLWGF6VE8vb2taWDhjdzlqNWNQM1pWdWlndFdYR3Z2aApLKzJqUCtwN3NLNTdYblBiNHlHYnRadXFPN3RlUUxlYUJhNVZEeWRrQ0lTanBkUnByaVpGZ2cxQ21YM1VYc0NtCnVQY3lQdEtGUDlWazJFMFZGc3ZKV2tUTEJmMEh1dWtMS1hkd1RYWlNsVnoyVi8rbDlrZTQzbkpSdXlEbXFNa2kKamIxNzZWU1FKVVJFcWVrbnhPL3hsdG1wNTk0ajFOWXYyMTFpQVFJREFRQUJBb0lCQUJMdURVYkwyMGN1enJxMQp0VUxxSmJaNytNbVREc1RBbzFJcndybjFCQzFTRUxxeldpVDMzdlEwc3Y2anhsdlNpUVpia2sxRWEzYWYyWm1BCnorakFiS0pDMGhpSU1sTVA5U2dRWFhWend6cFBSR0NzY1FSTldLSFFvWnA2a0V4RW1qd0RjV3FheU5OOTd4eSsKaHo5YlhWNVJEWVZVZ3E1VGs5UmVsRGlCT1VwZno1SWJFbmJpRHJkZWhvU0MxVXVsS3JLbzlvTDBoSDBFNVpqOQp1bDMzRlMxWkdrQ3VXTm10NzB5OEtPaXBWcWtab2I5UVYxNE5kY094cU9pQjVwZGZnREJqS21tSTBaL0JuYVZkCjlObkU1WXFKci9NQWhXbnNablptMVpTY0xLMXNQN2dVY0NER21nM1lPWDBqUytxSTRUNlF1NEhnaHVJTGZ6QUwKUEo5T0tyVUNnWUVBME1IU3AzV202M3VoY3BMV2xQL0RreDVwWmh3NjRQNEV5YmU5Y0k2SlRML0EwSU5ydGFsbwpHWHRxdElSRDBxYk9ETDE5c3dwWVhZMFNJVTJJMGJsWHZUaUxqaGNrOU1sRlFwS1o1NjlTM0VCNUVabUtLbjhUCkNFMnAzc2JET201Vmc2Sm1RbmJIQ0d2UjB2L0FiN2hQQ2xhdG81WGorTjJGR2t4SU1rUUM3ajhDZ1lFQTUzVG4KeFp5MDRFdE9URUtZaWxHcGlIUXdvS0VXcHZ4T1MyV0Z4aFdHZ3dRYTF1Z3gxY3g4eWV2S3V3K3haUEtpNU91Ygp1Wml6S3h5NUZYWWFtZ0VCSDFJNHpPWENSNDBZZGR5U2dqOFIzeC9Bdi9heitRdzVtWFhIYU1jY21YQXpTdDFvClc5c0lrWFpWWkMxUUVhRk5BaEtLQ3VtMCtIeDh2aVpHT1ZDc0g3OENnWUFocjFUZGZxZUxrZXh3UDI5dXBZS2EKWjZyY05pdnVDQzhmbVkxdzd4OEtpbHFEaXVGRGMrMS9SeUhsdFAzNHJML000SHE2L0MxY0V4cGMwMVVEZW1QRQovYTNQSkw3cTNOdFhMYTYxNnQxMCt0Wk9WN2NxdWt5STUzZEVvay80U3J0enZTM0JCY2VCL1Z2akx5K1BGMjl4Cm5LRHlKNHFjcXFvQ24xSjdBZXh6SXdLQmdRQy9tUk8vanRCZ0Y1YVNKRkszdFkvOGlBbzAvZ1NOYUxDN1V5Z2cKNkhLNEErN2YxY2hqTG1waWtGRDY5cXVuWC8rZU5yZHJOTStrTVp1NCsxSmNCOWJSQWJSSlVTeTVKRUNLV0hQagpZNmc4cHNGZFp6Qm1Ta3RvRUlwbzN1SjYxZGx2OE1aUnU0aGxPYXJJU1laTmdkUUlraVk1a0dzaGc1T1RxSVZiCkxyKzlhd0tCZ0VJaXNHQkxSOTAvOWJ3cmx2NjI4bTlqblR3anRqbE9rODAvbzh4S2IyV0VQd2g0T0JKR0R4WUMKbG9TV2ljaTZqT0NKSE9QSkVYcjR5eDZmLzhnQzE1UHBqbXFVWTR0NFdSeTVMWDByaWpLNGxVd0dONkNBaFJNNgozNmN5cGZBK21pRzgrcXNuZkJQSXRHNDd1c2ZOQWlTdW54bzg2bG1KRHB5VXF1WU5ZNkNOCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==
 kind: Secret
 metadata:
  name: cilium-ca
@@ -980,9 +974,9 @@ metadata:
 ---
 apiVersion: v1
 data:
-  ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURFekNDQWZ1Z0F3SUJBZ0lRSUZ3eThzeXlxQ2loRTFRQUZPWkdqVEFOQmdrcWhraUc5dzBCQVFzRkFEQVUKTVJJd0VBWURWUVFERXdsRGFXeHBkVzBnUTBFd0hoY05NalV4TURJeU1qSXlPVE0zV2hjTk1qZ3hNREl4TWpJeQpPVE0zV2pBVU1SSXdFQVlEVlFRREV3bERhV3hwZFcwZ1EwRXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCCkR3QXdnZ0VLQW9JQkFRREY1YjJsR2tZcjJjNm53MVVlS3UvOWkxazU2ZzNITUZnSXZ4MS9TSks1L2VIek1zT1oKQ1FTdUg1QlhoNnpGbDlQTktFaXNNdE1LRjdsSmF1TWFpajFxY1lqcURkVlFQM1F3V2tOa1hPNndtNU02YlQ5agpPUEt5bXljTHNtTFEzLzE5NUtZME5KbkJMNWtLYit2UDdBeHllOGpGeUoxQWFLNHhqZHp0REMwZjM5VHJKaysvCjMxdjZqUnpZczRwL29rN1pyRDd3Yi9Td2dCdzJocGVuLzdhN0Z3akQzVDhxMUF2bDdESkQ5bzBwMm1QZFA0OGgKNnMxUHB3eUUvcWZ4QVovRm85YTBHdWs0dVlMTmJvRjBEVVNZS3dVOVU2SzZLMEp6OXF5Mjh3NUtKaGRDUnRJVgpWdGRGNDJMeUhNaVZmT3pBQzFKQllLSTgvWTdjUndrc3hIOS9BZ01CQUFHallUQmZNQTRHQTFVZER3RUIvd1FFCkF3SUNwREFkQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXcKQXdFQi96QWRCZ05WSFE0RUZnUVV2dHJyVWhScHBuOTE3ZlBLc2JBLzVnZExFVUF3RFFZSktvWklodmNOQVFFTApCUUFEZ2dFQkFKS09WRVpDSzlnQkxLaUxVZ1dTd2dybms4cWp6cHR5YUFlSEtsUUhIS1FNYXBycWdUZkVPRmQ4CkYzRUxwQmZYeHBRNTJBa3N4c0JjZ2ZJRnphclRrRU8yOHNCR0pheEhxbENaQVpBY2ZhSWVJdVR4TlNnQXNtV0UKV2J1bDduWGZmL2FsNXJsRWJnZXdiMVpzSVVaNGF4L3FJZzJFd3l5VGhNQ0lpdi9HZFBmY2NWZ2ZLVlJOdGJ4WQpaOWxXdTlNOVRSU0JsOUVtQTNuWFVsRnBnMmZVYSsxNzNpeWpGa05pRXh0RldzaXVlcUxOd3F4czY5R0pEVFh5CnpUVklWWUFWeWdmcFM1cTJ0eERKdzNlcWNDZUlvREljelI0eU1nSUdkcG1nWTdYZmZYOVI2aTd2UFNEcDYwRjUKZTRHWG54NUhtYjBYK2tueXRxZ1pTNWphV25ZVzNxST0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
-  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURTRENDQWpDZ0F3SUJBZ0lRRDVhcGM4NThYdDNzM1ZvcU9WcjEwekFOQmdrcWhraUc5dzBCQVFzRkFEQVUKTVJJd0VBWURWUVFERXdsRGFXeHBkVzBnUTBFd0hoY05NalV4TURJeU1qSXlPVE0zV2hjTk1qWXhNREl5TWpJeQpPVE0zV2pBak1TRXdId1lEVlFRRERCZ3FMbWgxWW1Kc1pTMXlaV3hoZVM1amFXeHBkVzB1YVc4d2dnRWlNQTBHCkNTcUdTSWIzRFFFQkFRVUFBNElCRHdBd2dnRUtBb0lCQVFEdjhBQVdXNVlpS0plVm5CaHVIV1kyRFRSUE9BVUQKVnVTL1dRcHk3dW0rWUE2T1ZzanJrcUh3RVhpbTNyUkhGM0J5czlGcmRMemlvb2ZiTk1JZXoyakdyTkFIeGdLMgppV3JPdmE0bkdaVVNiaVRNRUh0cHczN2xabkdxMzhJRCtjYUNGaHBLWHk1UGlnQUVMWE9JOXMzakxqUVA1dUhxClVVN0ZDOWVjL1FHalVMMW5WVnJNdTA0bkgwaHQvNEtxd2RxNzgwVUliMEVua1YzOGhyVlkvRVZZcGE1VmVBK3UKWk05eVZZeVhHdXdZZ1RBZHdIYUhiTEhsdjdrdkdiYWQ2RTRDSDR1V1hvMFB1OCtVZFpRV2dGRWdhSDVCVGVaMApON1ptdHpGVDdzeGF6ZjZEMVRUeElnelBaNlNheFMxYkNEUGFOS1JBMmlReUY1SnNhUGlwRDhjSkFnTUJBQUdqCmdZWXdnWU13RGdZRFZSMFBBUUgvQkFRREFnV2dNQjBHQTFVZEpRUVdNQlFHQ0NzR0FRVUZCd01CQmdnckJnRUYKQlFjREFqQU1CZ05WSFJNQkFmOEVBakFBTUI4R0ExVWRJd1FZTUJhQUZMN2E2MUlVYWFaL2RlM3p5ckd3UCtZSApTeEZBTUNNR0ExVWRFUVFjTUJxQ0dDb3VhSFZpWW14bExYSmxiR0Y1TG1OcGJHbDFiUzVwYnpBTkJna3Foa2lHCjl3MEJBUXNGQUFPQ0FRRUFrZWs0bWJnM0dHb3VHVjJhUk5pRVR1RmRFcEptaHRjWEJPRW02VXdqS2dKc01EOGsKTWRzSFNCQ0J5TGJIc0VYaTlvVVpoYTB2SHhHdE0rYnRFL1gvK2pKNWFVelNUZC9MZ3lNSHBhWkN3MHpFRFp5RQozMFlHRjUrUlc5MTN3SWM2MDRENldBc0V0aDVPNHd4cWpXSExLNnNaS1BWbzVja0pVaFJUY3pKR25vOHdTbWZhCjNuMDYzYVA5OTRzNVJzWUQyL2JHWlZpWDlLRXdPRVJia1JIRzNRcGttajJYSHg1WStINWFueGVMQ2dJcmlJdVkKaDBUcmh3bm45Z1dXajUzdU1aakMrTTNHZ3hEcExqYXp4Tlg4WkNGaFJzN0dqWTNia1Rwc1RSYS9WL213ZXNvLwpBRklJaXY2cW50amFYQ2d4ZGNRVFQ1eUl3QWZRVHFXZXM2Q0JaUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
-  tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcFFJQkFBS0NBUUVBNy9BQUZsdVdJaWlYbFp3WWJoMW1OZzAwVHpnRkExYmt2MWtLY3U3cHZtQU9qbGJJCjY1S2g4QkY0cHQ2MFJ4ZHdjclBSYTNTODRxS0gyelRDSHM5b3hxelFCOFlDdG9scXpyMnVKeG1WRW00a3pCQjcKYWNOKzVXWnhxdC9DQS9uR2doWWFTbDh1VDRvQUJDMXppUGJONHk0MEQrYmg2bEZPeFF2WG5QMEJvMUM5WjFWYQp6THRPSng5SWJmK0Nxc0hhdS9ORkNHOUJKNUZkL0lhMVdQeEZXS1d1VlhnUHJtVFBjbFdNbHhyc0dJRXdIY0IyCmgyeXg1Yis1THhtMm5laE9BaCtMbGw2TkQ3dlBsSFdVRm9CUklHaCtRVTNtZERlMlpyY3hVKzdNV3MzK2c5VTAKOFNJTXoyZWttc1V0V3dnejJqU2tRTm9rTWhlU2JHajRxUS9IQ1FJREFRQUJBb0lCQUR4TGJtb3Y1OEY3dStQLwp6dS9VK1h0NXcveG9Vbkl0WXR4bTdzWkZIWDRXdTNHdmcxd1hoQlJFLzdISFl6dytPcWJJWTBjQ2xmako2U1AvCjFReFRDTHhzYnZhVkh0ZHFIdW9ISm4xeTQxQTNWNDNrVW04WWpvbnRQWUU0SzVRK0wxRS9acW5yMDBKdnBtTm0KWEpNOW1pMk56YzExTXE1a2NrdjRGdDIvZ3FyY1FhMFBCQ3NCUnBIRTJBZEIwNzI2NXlHTU1ITWcvQTlTK2lWMQptTldjN0JUZTFkNDBBWnhuNk1XU3BZTDFRdDRHMWcwTnVjWkd0MldxSFBPN0taWm1PVkdRa08ycU5ISzBrSnVmCjdqNUNGL1JuV2NHYXEzUzlhZFZtendJTHV1bm9DSXpOWThiZHIzcURJMlFyK20rNmZEaWlHSERwMkQxdFpPbXgKZzZpdWRTVUNnWUVBOER4MU1Ddng3bytkU3JUUTJWV0pHZU96Z1kvaDZabURjR0RmbzBHeGg0NkxwcEdWcHp0MAphbTUzUWJiT0xPcGRXOE5VNUxZVWlLU2hSRFplYS8yK2VHSEhTWWExOEVzTXkydXN1ODFwK3d0ZU1EMGRHUmNwCktjanorcEducnY1STlPYlUvTUJtSFVHRHN6enlnU1lBZk5XWDBaWjFIbEgrSzFvYlJQeU5wY2NDZ1lFQS82NkcKakw1a1I0OC9UeGkwWDhDM2FTN2ZiMnJwdUJ5VWZRTnlQeEsxek5MMmwrQlZJTlJvM0UrQUs0dCtTaFNERFpMZApmeklSdkJpU1JMRjVlTVNpSnZVc0RzclRmMXdaM1FBSXo5dUdnRU1JQUc5b3N1S1Z1c2t1K2YrT3hsbUpOajVpCkg5Z0w0QUcvbWdTWHRCZTY4UzdqYUo4eXdBZkdMRUFUTS9WWTdLOENnWUVBdWxGcFllN3pOOTVTVTNwZzcrNFMKNHUxaWJ2MjBiSVFQR0wxSk5Vamg4d3h1NnNUR21HallKU04vZ292UTQ2endzeGFQWk1LQ3NtZGNXNWIvTENvago2eUdLZWsvc0UyMWhndk1EaUxRTG1oUjYvRmFwbHFnTDJNaHQwTXZlalMzU1QzNG5lYytPWXVwSXhsNWloaDkvCkNWSnU2TElVSzJ2VUFMTmxxdDlrekVrQ2dZRUFsT3YyZXF1NmhPT3VvRWRuYUE0N3hnd0RJRVpKYzI5U0hhNlEKTUtTWk4zLzVHV1VVc0ZhSDdTcHhJT3ZTMXhzemFnaU04clViRjAvSWdqSk02a2E5bTZ0WnloUGhOR0ZVdnlCeQpBWDkveTkwL0grSEVQYzAwSU9ObGRUK2d6VzhCT0pNRlhEN2VTODg0NW1DZWE4c1dtN3dQd0xSWlB2aElPU1hwCkNXNXlLUWtDZ1lFQXc5MmhVR1pRZy94MWNja3VaRTZBQ1c2ZW0yZm5MWnVFVzlvMHBjLy9KSm5SZTc2NjZwb2wKYnZXOXlqZm81bnk0UTlzWjRXRXVldHYvbmRmRGZQOStSTlY5ZksvS0c1UThDbG1LZHVFWll2NHBoSEN5emE1ZwoycmY2RFBWamlvSi9HRmtWNzVjYWxldVE0TkxuVFk2akZCU0x2QUNBREFUcEt2UzVKaG5KOUt3PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=
+  ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURFekNDQWZ1Z0F3SUJBZ0lRSVl0VE1lazQyektUb2pzV0I5Wm05ekFOQmdrcWhraUc5dzBCQVFzRkFEQVUKTVJJd0VBWURWUVFERXdsRGFXeHBkVzBnUTBFd0hoY05NalV4TURJek1qQTFOek0xV2hjTk1qZ3hNREl5TWpBMQpOek0xV2pBVU1SSXdFQVlEVlFRREV3bERhV3hwZFcwZ1EwRXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCCkR3QXdnZ0VLQW9JQkFRQzh2am5vbVJDL3M1VUlQQ0lrV29tcC9nWTJ3UFUwU0hIVjBzYytNRXk5TndqSy92czQKMHhkQkpTblhyai92aFcxY0RqUFZHN2hNeHZONUJtZEZZTUtIYitqREl3d0JmYkR3SVQ0SktVV0dDVi9FMVFkMwp4dHlrYUF0V2doMHFOd05Wb2VHZmZ5UDFnNHhhYStJcGRyTk03K2lSbGZ4ekQyUGx3L2RsVzZLQzFaY2ErK0VyCjdhTS82bnV3cm50ZWM5dmpJWnUxbTZvN3UxNUF0NW9GcmxVUEoyUUloS09sMUdtdUprV0NEVUtaZmRSZXdLYTQKOXpJKzBvVS8xV1RZVFJVV3k4bGFSTXNGL1FlNjZRc3BkM0JOZGxLVlhQWlgvNlgyUjdqZWNsRzdJT2FveVNLTgp2WHZwVkpBbFJFU3A2U2ZFNy9HVzJhbm4zaVBVMWkvYlhXSUJBZ01CQUFHallUQmZNQTRHQTFVZER3RUIvd1FFCkF3SUNwREFkQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXcKQXdFQi96QWRCZ05WSFE0RUZnUVVQYU1uTDdVOEEza0RtYlVOay91OTBua3dIZWN3RFFZSktvWklodmNOQVFFTApCUUFEZ2dFQkFKSlNXd0c3S0VzNzZjSFNkQVJpb2Y5VFVZK1VFK0U0TWJSMytPYmFFWlJ2bXZmMGZ4UlVIQS9RCm1VSW1RTGYvTHRlK2RDRGx5RmxFK0ZSazM0RUErT3V0eDRYczEwRElKRzY4bEFsbGRtTk1xNXRKQU5zV25DVW4KVVZTR0U0eTZwRkFxU3RzVE5neDBNeUQ3Y3cvMnQ1NlpzT2FxSW5TVXNKUXZZZWhYWGwwV1BORGpwZVhFcGNrSgpkb0k5Z3VReERHRTc3SUs5QmNvSXY2d1p2elVrSFRBUndGSWNIaC8zUjJvQ1lzTXZvN29Jd3Z0cHcybFMxU1JwCkFqcTRjejdtRzVxaC9MUE5vd1FZc0QwUDhaUG9XN0UxRTBGU3BCK0pVOTUzVTJNOW16ME5pUzJQa1VPeXl6dXQKYTdWUDZBb09VMjRHb3J3SEVCSWduaWpQMk0rYnNRVT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURTRENDQWpDZ0F3SUJBZ0lRWmM1b1RMUnJHNVBwYTZNN3AvSzc5ekFOQmdrcWhraUc5dzBCQVFzRkFEQVUKTVJJd0VBWURWUVFERXdsRGFXeHBkVzBnUTBFd0hoY05NalV4TURJek1qQTFOek0yV2hjTk1qWXhNREl6TWpBMQpOek0yV2pBak1TRXdId1lEVlFRRERCZ3FMbWgxWW1Kc1pTMXlaV3hoZVM1amFXeHBkVzB1YVc4d2dnRWlNQTBHCkNTcUdTSWIzRFFFQkFRVUFBNElCRHdBd2dnRUtBb0lCQVFDYUk3RG5BMTlGZCtmRmtEdEE5MGpEN2M2ZG1GKzEKTFNvblM4VU5lRlNHUlpBK3pmT3BSM3RKSGhlTGM4QjhtQVNwOFNKS09UbURFaC9Kdkk2QTJZTE8yZ1BlM0lzYwpOZDdYeitmL0tpV3NTZmc3aG4zM0ZkOThGNG9Kc3BwRk9uRE9DMFAxYnRweU1GdUxuYkNtM3ZHZ2FNV3VaM045CnNmVmtRU2dMa2hUQkhaYXlJc2ZSWTlrYVE0dW9NV2luaFNPdzR0bi9sSDYxcEo1U1RjUkY0aDNWa1A0QlVGYVUKaHRrRXRFQVhwZUlHeWR4aDZXWWY3WWU5WTVQeWFaR3M5aFVYbHNkNzIxYm9IcE5qU3JlMFY5RFhlb0F2RDlRSworUzFZWWZjY1kxTWp2dlIyZEpIN3AxRm5LODR3OG8rK0RxQ3lvMVYzbHNyRWh1NnB3UFVxMHBoUkFnTUJBQUdqCmdZWXdnWU13RGdZRFZSMFBBUUgvQkFRREFnV2dNQjBHQTFVZEpRUVdNQlFHQ0NzR0FRVUZCd01CQmdnckJnRUYKQlFjREFqQU1CZ05WSFJNQkFmOEVBakFBTUI4R0ExVWRJd1FZTUJhQUZEMmpKeSsxUEFONUE1bTFEWlA3dmRKNQpNQjNuTUNNR0ExVWRFUVFjTUJxQ0dDb3VhSFZpWW14bExYSmxiR0Y1TG1OcGJHbDFiUzVwYnpBTkJna3Foa2lHCjl3MEJBUXNGQUFPQ0FRRUFuakNmeGl0RlBONG5FSGZVS3dFelg2SWJpQ0xuenpSb0FxbXFTd0tsSDZDNzU3a1UKR2hrUXBYTC9OYWJnSEtQNm8vUnFlVlg4QkFXUGRyS21iRDEyMHZVZFZQWjFRbjJVY2lGYzRWUXJVRWhpN3J4aAoxazBwT081dFU5OTBlaWc2SGlEeE9hckVJZmI5cWpyS212MENBcFBiRXlpckNDczMyaEV4RzRFTVRLSFRBRTd5CnIybUFYWXA2QzdjZEgvRk1ETVpEcXpkdUpOT01nZGxzcHZtS0hEZXJLZlBuMEV4ZFkyaG5pY3U4TGZNUEJJU2QKVFF5bXNvWmJZcjJQbnFtaUZnckVpWnlWOEpHUkRyNnFJU0Y5VUhQOCs5WTI5UmhNT0ErUkVHaDREdGpVZmVJUApaTnlFZzYyUll1NnpjM3h3d2dyZXRteVJnazN6aW1EOFZYQzZrZz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+  tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb2dJQkFBS0NBUUVBbWlPdzV3TmZSWGZueFpBN1FQZEl3KzNPblpoZnRTMHFKMHZGRFhoVWhrV1FQczN6CnFVZDdTUjRYaTNQQWZKZ0VxZkVpU2prNWd4SWZ5YnlPZ05tQ3p0b0QzdHlMSERYZTE4L24veW9sckVuNE80WjkKOXhYZmZCZUtDYkthUlRwd3pndEQ5VzdhY2pCYmk1MndwdDd4b0dqRnJtZHpmYkgxWkVFb0M1SVV3UjJXc2lMSAowV1BaR2tPTHFERm9wNFVqc09MWi81Uit0YVNlVWszRVJlSWQxWkQrQVZCV2xJYlpCTFJBRjZYaUJzbmNZZWxtCkgrMkh2V09UOG1tUnJQWVZGNWJIZTl0VzZCNlRZMHEzdEZmUTEzcUFMdy9VQ3ZrdFdHSDNIR05USTc3MGRuU1IKKzZkUlp5dk9NUEtQdmc2Z3NxTlZkNWJLeElidXFjRDFLdEtZVVFJREFRQUJBb0lCQUVoWklrcDhTYmFJbmxBYgo3OFFCamJUeEpQN1JxM0tWdldodVp4SjRmV3Y4c01UWjFGbUxSTEhBSHhzRWZMKytkc254ZGIvUzlreXdNQjEzCmxJZWtFSUxZeitKR01FRlFnOFZXUDdXRDZlVGhYMU5KUUV5K2hvUnZaQXBETzZmczAwL1M5OVgyYnpBVHhKUlcKc3JqUWdpZGhwZy9EWFBFTm0zbXdINFMyejJrSXFObGdVMnhrWTFzMFQzYkszTG9NOWpsWEczekovZm1HbXlGagpqUndleDZhZTIvYWl2MlpHakp5M1V6bVdVNUdsRmEvZzM4OVdvSEw5Q2xGRUh4NDNwWXJZTHVaTGNzaUovSEpmCk5ucFg5RFZrUFpzdmpiZnhjaDVmNG5laWJzWjFUUjlPM2JweGNCM1V2NE5RcitWcE1LS1JLT0ZMSTdzOUxKRVYKZFo5dS9FVUNnWUVBeVZEbWsvRTRYNjVVbTYrcnRqNU1WVzlsN2w0cythSGxtZTd4RjhFME5rTFFZblhBdXVxUwpjd3dhTk9PMmdTa1FKSW11cDJZb3lZZ3JMT2NZRnBJM2xWUEZvKzVobk96dk4xUUtWZDQwQll5cSt1dndRQ3kyCjdIeDVZOE9BUVo1UytYZ25MSG5iZlN1dTVUUllGOGJJTEdtMHRsSkx3U2p4dXhLUFBIVEhnRjhDZ1lFQXhBSTYKS0RPeGVQbkJVM1pQVzFZWGVROEU3SGFza0IvdThweWxnNkpJU3NkNExLVzZlOTl2Q1J3SHJFV2ZvQXgzU1pFdgpyL2YwOXJnUkRXK3VRUHpQb05NMC85aW4xTHFiUDhMU3NDdEJobHM2QlNWMENtb0hlelVuOFR2MzFEaDNMV1ZoCnEwMk9ZOE41WjFGT0t5OHFwQmI3MjgxMzc0dzJZMVZEN0xlejVVOENnWUFYUUJteFFtM0JWeS84WHhpVXpyTWcKTnVKdDJrQ1ZnQ1kxVmd4UU13Y2xzU2ZDQjFsLy9QRjNDaEhJdy9makNPd05YRDFvcGZyVjg3MFF6WXZScDRkMQozcHYzNStNc0xZMGZOYnlQMkQ3bjJTd3lHS2ZCc2FoYXZiR0RYU1BsOERRakRjWndjNDV1OFdtY25TUURjdmpSCmNFL25zcTkvR294NGo1Y3RZMHRiUHdLQmdESWZlNjNDSWxVVVVScTl1MmRZNmFHOGRIN2ZqaHRBLzBLdFNpb1MKT3JoY3I5K0M5ZUF0YitCOWVYelZSUStSZ0lPZ2kvaE15U2k2UXlvVGNCVVFVU3dJTnBwaVZmQ3hVM2dIb3djSAoyTGE1NTJsZmZZQVlReGQvclZva0Fxa1RVMjZaYVZONy9yaUdTU3BoZ1VMTHlmU3lKKys2YUR3cXQ5SEpBUmlzCmxXVkRBb0dBR0pHUWZwcjNVVHhwelMydmg0NjFUTS9DcnhhZkRWTGtIRFZwUHJrL2VoRU82dzhhRlBIZ1FFRW4KbTc4L2VLS290NUowdnVhaDA1S0tiaFVIS0I3Zm5zaGNqbmhCOVNTUVVERG1nOUp6aDVoblNIUjBvT1lScTcyYwpnYUVvZSs5M1JibEVjZjNXaWlBU1NnWVRqTXVjWFc2enZraHNHQWtVblR6aGJKNWk1Mnc9Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==
 kind: Secret
 metadata:
  name: hubble-relay-client-certs
@@ -991,9 +985,9 @@ type: kubernetes.io/tls
 ---
 apiVersion: v1
 data:
-  ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURFekNDQWZ1Z0F3SUJBZ0lRSUZ3eThzeXlxQ2loRTFRQUZPWkdqVEFOQmdrcWhraUc5dzBCQVFzRkFEQVUKTVJJd0VBWURWUVFERXdsRGFXeHBkVzBnUTBFd0hoY05NalV4TURJeU1qSXlPVE0zV2hjTk1qZ3hNREl4TWpJeQpPVE0zV2pBVU1SSXdFQVlEVlFRREV3bERhV3hwZFcwZ1EwRXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCCkR3QXdnZ0VLQW9JQkFRREY1YjJsR2tZcjJjNm53MVVlS3UvOWkxazU2ZzNITUZnSXZ4MS9TSks1L2VIek1zT1oKQ1FTdUg1QlhoNnpGbDlQTktFaXNNdE1LRjdsSmF1TWFpajFxY1lqcURkVlFQM1F3V2tOa1hPNndtNU02YlQ5agpPUEt5bXljTHNtTFEzLzE5NUtZME5KbkJMNWtLYit2UDdBeHllOGpGeUoxQWFLNHhqZHp0REMwZjM5VHJKaysvCjMxdjZqUnpZczRwL29rN1pyRDd3Yi9Td2dCdzJocGVuLzdhN0Z3akQzVDhxMUF2bDdESkQ5bzBwMm1QZFA0OGgKNnMxUHB3eUUvcWZ4QVovRm85YTBHdWs0dVlMTmJvRjBEVVNZS3dVOVU2SzZLMEp6OXF5Mjh3NUtKaGRDUnRJVgpWdGRGNDJMeUhNaVZmT3pBQzFKQllLSTgvWTdjUndrc3hIOS9BZ01CQUFHallUQmZNQTRHQTFVZER3RUIvd1FFCkF3SUNwREFkQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXcKQXdFQi96QWRCZ05WSFE0RUZnUVV2dHJyVWhScHBuOTE3ZlBLc2JBLzVnZExFVUF3RFFZSktvWklodmNOQVFFTApCUUFEZ2dFQkFKS09WRVpDSzlnQkxLaUxVZ1dTd2dybms4cWp6cHR5YUFlSEtsUUhIS1FNYXBycWdUZkVPRmQ4CkYzRUxwQmZYeHBRNTJBa3N4c0JjZ2ZJRnphclRrRU8yOHNCR0pheEhxbENaQVpBY2ZhSWVJdVR4TlNnQXNtV0UKV2J1bDduWGZmL2FsNXJsRWJnZXdiMVpzSVVaNGF4L3FJZzJFd3l5VGhNQ0lpdi9HZFBmY2NWZ2ZLVlJOdGJ4WQpaOWxXdTlNOVRSU0JsOUVtQTNuWFVsRnBnMmZVYSsxNzNpeWpGa05pRXh0RldzaXVlcUxOd3F4czY5R0pEVFh5CnpUVklWWUFWeWdmcFM1cTJ0eERKdzNlcWNDZUlvREljelI0eU1nSUdkcG1nWTdYZmZYOVI2aTd2UFNEcDYwRjUKZTRHWG54NUhtYjBYK2tueXRxZ1pTNWphV25ZVzNxST0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
-  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURVakNDQWpxZ0F3SUJBZ0lRWGNyL1l0cFFVQS9uTC80Vlc4RjVYakFOQmdrcWhraUc5dzBCQVFzRkFEQVUKTVJJd0VBWURWUVFERXdsRGFXeHBkVzBnUTBFd0hoY05NalV4TURJeU1qSXlPVE0zV2hjTk1qWXhNREl5TWpJeQpPVE0zV2pBb01TWXdKQVlEVlFRRERCMHFMblJoYkc5ekxtaDFZbUpzWlMxbmNuQmpMbU5wYkdsMWJTNXBiekNDCkFTSXdEUVlKS29aSWh2Y05BUUVCQlFBRGdnRVBBRENDQVFvQ2dnRUJBTjJ5RTZuWVNyV2NUTXU4NUpPaEljZzIKSW9FNTZqNmV3MFJOT2F4U0I0VFJhL1NyUW93Vk9jVVUxaEk1NmpzeWVTVWcxOFdUSlJwVWNpd3V6WFNOVEVLUQo3ODNPOFNiczVXcFFDaWJVWUVOTGJQWnUvVDZSelIxaGo4M2g5NWVyODM2Zm4vUWRKOVhuVmZPTkZIaG1USkhGCmJEaFhpME0xdEZoYVBSWmRLc3h2RThXMExkWWIwMTNrVVp6ZWFUWEk1cmhsSzFJZXdTbitiVUJFTEV1dGloNEkKY0xTQzhMd2hqNUdDTFdjR01FNnVRR2F3TnNCdHhaQ21MeXZaL0cvNlRzV0xEOXRka2VpK2JBWWJSVzJ5WGpjdgo0UUtzcDYwKzBhV0ErazBUWW9EZEpFdFowNkovWitUTE9HZ3pES3haaWx6bExpTkl4Y3ArWmdBT2hCVGNHU2tDCkF3RUFBYU9CaXpDQmlEQU9CZ05WSFE4QkFmOEVCQU1DQmFBd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUcKQ0NzR0FRVUZCd01DTUF3R0ExVWRFd0VCL3dRQ01BQXdId1lEVlIwakJCZ3dGb0FVdnRyclVoUnBwbjkxN2ZQSwpzYkEvNWdkTEVVQXdLQVlEVlIwUkJDRXdINElkS2k1MFlXeHZjeTVvZFdKaWJHVXRaM0p3WXk1amFXeHBkVzB1CmFXOHdEUVlKS29aSWh2Y05BUUVMQlFBRGdnRUJBQTl5OFhXdDl5WHFUb2hMZHBVckV1T3hHN1N5Vmlhdm1tQmcKcEhZUi91WlYxa1pNdElJVFVOMXlvNWlwZmgxeVZxTElqSldXcjVjUHRHVFBsTk15cVFCck1BQmpuZzBNYlE1QwowMjd5elg5eDJ6ZTBIYkFnKzdXWWh3WFVIeGNQdGdrK3VmYmt3d3YyaEhYYzgwQUxaN2k3aWh4clBlSHcvcWg0CkJycS9rMEZZY1dDWW9WMk81STNYTHZydE1qQTFSRER6ZWJqY08ydzJJcVBzR3R1TzFUQTdzZUlkZ1pxd1V1aUcKQmhLdkczY1ZrMXhaUit5L3lNNkRVUUtiWmNTSnJTc2JhNnhpdVdNeTYrK0VDb3hLTE9ydmdIYmthd1RlVk9LdQozOTJkMnRSblh5aTVOc0ovRCtVR1ppMDhZZFpyeGErTGNKMG0yNWRucnRQdTJqaHlTUU09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
-  tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBM2JJVHFkaEt0WnhNeTd6a2s2RWh5RFlpZ1RucVBwN0RSRTA1ckZJSGhORnI5S3RDCmpCVTV4UlRXRWpucU96SjVKU0RYeFpNbEdsUnlMQzdOZEkxTVFwRHZ6Yzd4SnV6bGFsQUtKdFJnUTB0czltNzkKUHBITkhXR1B6ZUgzbDZ2emZwK2Y5QjBuMWVkVjg0MFVlR1pNa2NWc09GZUxRelcwV0ZvOUZsMHF6RzhUeGJRdAoxaHZUWGVSUm5ONXBOY2ptdUdVclVoN0JLZjV0UUVRc1M2MktIZ2h3dElMd3ZDR1BrWUl0WndZd1RxNUFackEyCndHM0ZrS1l2SzluOGIvcE94WXNQMjEyUjZMNXNCaHRGYmJKZU55L2hBcXluclQ3UnBZRDZUUk5pZ04wa1MxblQKb245bjVNczRhRE1NckZtS1hPVXVJMGpGeW41bUFBNkVGTndaS1FJREFRQUJBb0lCQUFOS0dUZ1gycE5EY0lhYQpYMzJLOG04ZjBkY1VocWtBcytRdmVDZXZmT2M5TUpWTUN1YW5YdmpSWkdsc3AyWW9TM3RmOTNaUFJyUStEMXYxClRYenovQm5Gd0VVbEU2ekY3dWtyQUZ6a29hYXdvbVhZQTVVYUsrUUtkcUdHLzQ4N2U0SUVEaWNjc3FLemRoeWIKeElpOUl5MkxpTWhLTzVSVzk1TFRDSjBzYXpqbXl2UzE4UFNWUWNiZzUwdTRKUWJSVjNDazBoRTVkcSsvNGZUTQp6bVFWQS9DbEtnRDhmRjdPbTlSVGFBV05UVllHTVFFcDI3Wm8yQktiOVdieG9DZkRqMHpwL2Y5c1N0MURBVE16CjJzM1BTWUw4VkpQZVl4SGhUL0NiVzlGckZLVUtPQkNXV1R0K04rbVJUTjVyMEVoN1VuNTZBVDFYeUw5WW42MnoKZWxPZFNPRUNnWUVBN3ZTQmpZSXZHTURvK3ZhTUNicTRTQlRiQ0RGemFjY3lHUG9vOWRmcU1tZ2grQTcxZEZ5ZAo5YlhJTy9oLy8vWGdLaGV3TGFSQ0J5SWRuUnlkZ2ZvYnV6UUxWWHZXcXBqRXphM1REYVVnVXFIVjhlWWt2b3l0Ckp3bk5BUXEyOVFsRm1pTTdBRDl4MjU1ZjBQYWJZUy9vVVl5aVJmVHgwQWRTTTI0UGtDa1dYemtDZ1lFQTdZSm0KWVJoREVtQVR0Y2xVVGZ2VnBhUWJjaWo1MFJhY0RlUWFsNDh3V1Z1SHZ1QkRRd2xlQWFUK1hZNDBzZXJYbWRMegp5RjFzUlFQQUxud0xNMHlYSmxmM0RYbjVZLzhVRzd3Rm5HcHowVEw2RnhNbWlyNVEwZUNlOUZhQld2d3p0c2xrCkZzMDU0M2lVcWthY1lISFJlTzFEcVdsSU55dW4xaFIzZWJpcm1YRUNnWUJnUlpvOGpRcTBpbVJUV0NtcmNkTDEKRjVIM2h4VGN0U2gxNzdPNCtMaWVmbDNSTnhXbFAvdFVGMTBJN0dHRm1tWXFEMGtuMmxuUHplcm9kYkx2dnZpVgpQNjZoVGpkNm0vb09jODNvWFhMY1Y5OStpaDZidHNtOFJMS1hqTjJSYzU3Ykx2NkNadzFVVWthQVJocnIyUVZjCmRiQ2JSc2gxNjcwdWcxVTUyNVByNFFLQmdRRHBVOFMrT0RhVUU3enBScXRDblZmTERVaEZRNG9BWmVUVEpMY1gKRTMxZEc3Vmt5QzVyNmdUbk9xOEZPOUg2dzRvaFBRTnZZSkFmME1wNUlEVmtwU2FNYmJod0RkYjU3THBWY01aVwpYcUgrNzhTTzdLcGRmUkFxenk5NVBJNkIwdWYrOXlRVDNuT3pTMTlKVkdzRnVHc2dFSDc3TEVuY29VK1YyYTl4CjdnRHVrUUtCZ0QxWEpEckdacjgveGtJa0w4WXJVNmNtS051MjlCZmUxNlR1azdCSGhqeDZHVmhzaHVreXlZV2wKTHEzbWJUcGdWeTF4aXFSVUhaQWxGcThPdEl4ZlNuYk4zanEyZTZ6SW4vM1lMeWpRd1hHSlpaWFdqZkJORU9DZgoyajdreGs4RGxyV1pIYmFJM1J0YlVoTXVpeDN1NFdxVTBCaFdndWJ6ZXc1K0xnSDBHODFqCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==
+  ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURFekNDQWZ1Z0F3SUJBZ0lRSVl0VE1lazQyektUb2pzV0I5Wm05ekFOQmdrcWhraUc5dzBCQVFzRkFEQVUKTVJJd0VBWURWUVFERXdsRGFXeHBkVzBnUTBFd0hoY05NalV4TURJek1qQTFOek0xV2hjTk1qZ3hNREl5TWpBMQpOek0xV2pBVU1SSXdFQVlEVlFRREV3bERhV3hwZFcwZ1EwRXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCCkR3QXdnZ0VLQW9JQkFRQzh2am5vbVJDL3M1VUlQQ0lrV29tcC9nWTJ3UFUwU0hIVjBzYytNRXk5TndqSy92czQKMHhkQkpTblhyai92aFcxY0RqUFZHN2hNeHZONUJtZEZZTUtIYitqREl3d0JmYkR3SVQ0SktVV0dDVi9FMVFkMwp4dHlrYUF0V2doMHFOd05Wb2VHZmZ5UDFnNHhhYStJcGRyTk03K2lSbGZ4ekQyUGx3L2RsVzZLQzFaY2ErK0VyCjdhTS82bnV3cm50ZWM5dmpJWnUxbTZvN3UxNUF0NW9GcmxVUEoyUUloS09sMUdtdUprV0NEVUtaZmRSZXdLYTQKOXpJKzBvVS8xV1RZVFJVV3k4bGFSTXNGL1FlNjZRc3BkM0JOZGxLVlhQWlgvNlgyUjdqZWNsRzdJT2FveVNLTgp2WHZwVkpBbFJFU3A2U2ZFNy9HVzJhbm4zaVBVMWkvYlhXSUJBZ01CQUFHallUQmZNQTRHQTFVZER3RUIvd1FFCkF3SUNwREFkQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXcKQXdFQi96QWRCZ05WSFE0RUZnUVVQYU1uTDdVOEEza0RtYlVOay91OTBua3dIZWN3RFFZSktvWklodmNOQVFFTApCUUFEZ2dFQkFKSlNXd0c3S0VzNzZjSFNkQVJpb2Y5VFVZK1VFK0U0TWJSMytPYmFFWlJ2bXZmMGZ4UlVIQS9RCm1VSW1RTGYvTHRlK2RDRGx5RmxFK0ZSazM0RUErT3V0eDRYczEwRElKRzY4bEFsbGRtTk1xNXRKQU5zV25DVW4KVVZTR0U0eTZwRkFxU3RzVE5neDBNeUQ3Y3cvMnQ1NlpzT2FxSW5TVXNKUXZZZWhYWGwwV1BORGpwZVhFcGNrSgpkb0k5Z3VReERHRTc3SUs5QmNvSXY2d1p2elVrSFRBUndGSWNIaC8zUjJvQ1lzTXZvN29Jd3Z0cHcybFMxU1JwCkFqcTRjejdtRzVxaC9MUE5vd1FZc0QwUDhaUG9XN0UxRTBGU3BCK0pVOTUzVTJNOW16ME5pUzJQa1VPeXl6dXQKYTdWUDZBb09VMjRHb3J3SEVCSWduaWpQMk0rYnNRVT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURVakNDQWpxZ0F3SUJBZ0lRTzN5WUZQenNlajFVNEVMZjZhK2JZekFOQmdrcWhraUc5dzBCQVFzRkFEQVUKTVJJd0VBWURWUVFERXdsRGFXeHBkVzBnUTBFd0hoY05NalV4TURJek1qQTFOek0yV2hjTk1qWXhNREl6TWpBMQpOek0yV2pBb01TWXdKQVlEVlFRRERCMHFMblJoYkc5ekxtaDFZbUpzWlMxbmNuQmpMbU5wYkdsMWJTNXBiekNDCkFTSXdEUVlKS29aSWh2Y05BUUVCQlFBRGdnRVBBRENDQVFvQ2dnRUJBUFNublFOckN2YWJCQ253blVyWWQ0U2UKcnVnTThrZVlrVkFFT04yRXMrMXp0Yzg5RDBETm9HdW9sN0NlZ3NROWo2OUR5Y1owZTRWZDJJZXRtbjZJRDlSZApaakIyVzlvOGV3NTJIRFByMTFKN2RVRjBXUjBUYThOWEcwNzZJbDZlanNRaHp6M1pqZmdDR0t3UDNzOEdvMkdBCm5YejBxNUZZMU1tcm9ULzVFVEZPMFRROVZCTHU0cjZReEk1dk1QTnFJZVAvSjJ1MGVrWlhDNXVpRS9uVzFjbCsKK1NxYnVJNEZPRkhBeHE4SlRuNWlSQnJzN3hWL09HZ0twdjVIcC9TZWE0ZzdJYlhXOWRkWmt2YnFXZWkrUWRPUwpycW9odmpzdGtNUHpYdWJ3V0I5YkxTdXl3T3gwQWw3ZGVPT3J5Qmd1eEpsN0ErTzhoVGlLNEg1bkRNUytXMmtDCkF3RUFBYU9CaXpDQmlEQU9CZ05WSFE4QkFmOEVCQU1DQmFBd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUcKQ0NzR0FRVUZCd01DTUF3R0ExVWRFd0VCL3dRQ01BQXdId1lEVlIwakJCZ3dGb0FVUGFNbkw3VThBM2tEbWJVTgprL3U5MG5rd0hlY3dLQVlEVlIwUkJDRXdINElkS2k1MFlXeHZjeTVvZFdKaWJHVXRaM0p3WXk1amFXeHBkVzB1CmFXOHdEUVlKS29aSWh2Y05BUUVMQlFBRGdnRUJBSDdZSFJobkZ2T0paWEZTUGlRMGVPSzVLZEFSU0ZsQi9OQjUKc0tvZWROUHowMEk3bUdvNnl4bktqYTA2ZHRvRmVHVHJIUWVWOHNqRFRnWkQrZzhmU3BMSjhrZ0FVSk4zZ0tlawo5dDdCYnVKUHNWRzEwSHBkeStUeDBVMnN0TTcyM3d0NWRSaDkxN2xzL0R2Tkl5Z0FKMndKZm1kK1Arc2x3UFJDCmU5dHZkd0lnTTMvalRZRGxIOWh2bW5EYnpnamZ5LzNlUEJJSDVRWW9JcDQwb2orOEhSN3M2anp3OG9RZWN4OFcKWStLaXY0d1FZK3c3OTdDYUNOSGJkVXlRZGtQcEpsdHBKOXQrSVU4YlZBQnU2dDlmK3NvRUFkdVMyR2FEYXlsdgoxWlpoWE55THhVdUdRSklGTWx5dGdSRU9OdEFwZXp5U0ltNFZPc3hicGkzaGt0c0U2SWM9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+  tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBOUtlZEEyc0s5cHNFS2ZDZFN0aDNoSjZ1NkF6eVI1aVJVQVE0M1lTejdYTzF6ejBQClFNMmdhNmlYc0o2Q3hEMlByMFBKeG5SN2hWM1loNjJhZm9nUDFGMW1NSFpiMmp4N0RuWWNNK3ZYVW50MVFYUloKSFJOcncxY2JUdm9pWHA2T3hDSFBQZG1OK0FJWXJBL2V6d2FqWVlDZGZQU3JrVmpVeWF1aFAva1JNVTdSTkQxVQpFdTdpdnBERWptOHc4Mm9oNC84bmE3UjZSbGNMbTZJVCtkYlZ5WDc1S3B1NGpnVTRVY0RHcndsT2ZtSkVHdXp2CkZYODRhQXFtL2tlbjlKNXJpRHNodGRiMTExbVM5dXBaNkw1QjA1S3VxaUcrT3kyUXcvTmU1dkJZSDFzdEs3TEEKN0hRQ1h0MTQ0NnZJR0M3RW1Yc0Q0N3lGT0lyZ2ZtY014TDViYVFJREFRQUJBb0lCQUFGTjJNQnBQdjIyMnliVAphWU01OUNramVoQ0g2ODFiT3RXNldyTStQeXljMlVpVUxXaWpCVXFObml3SzF1enZoeEhnRi9YcGc3UmZubHFGCmRRcXlTYU5RSnMzMS9qZFk2eThBak5YdldUa2txZjRCL2hlY1FEbDNxcnJ1WDdzeFlvRnVkMTcvc2Q5ZDQzNXgKOXpZVFN2dW5ab1RXcVFqS294ZTZ4U1B2ZlVWT0FPbXlkNG16Vk5uOGRpS3lQVzhYcVFwVk9selI4RHdmbUNKOApvYWFwN2NwbTBFclA5MEFaMXRFZEltUXZmaXdmdFMrSDVTdHlha2ZBRUlLalhiclZtd1NiZmI3YVNuMGRsL2wzCklKUkRCemtCcU9vdHkzeTBEVTUzVTdKeUl3YzNHRjY2VlVWblBLZnArTXgzVG44d1REZ1cvbUxHY2NpYnEyWjIKc2VCTkdxRUNnWUVBL3BGVjhBUnpDS1grNTR3NzlUclVFOWZIYUFlN1hqclFtcXB2bkRCOVVsZG9obld3bFhLUgpBRC9DK3BwTDhDaDI3UHFEZVByM3lmZVNnSlY0TTI4VGtUUnFza0UrZFI2eFlvWEpzR2lPZjdjQWR3UDZIaGdWCllTN1E0RWUxTFhIaWFVdTRIZDEwWHZrcDJ2QnM3WlJESzJYMWdONktrdzcwMWxDS3Exd1NicWNDZ1lFQTlnZi8KNCs4UmJxQm15Q0V4THdUNW55YmtMenV4QWh0SXNkd2QyUWtyUWJ6aHFpL1lDYWRibTRaTlRndUt5UjdORVZWYwpQdVFkbmJVYUtGWldCbk4yN2pPdmNhVnNod1RQYzVNQjJkT0hHUXhLZFZNUjRyUUsvT0hjZ3k5NW1STjgranZNCnRzczAyTWhxeWhaWUNvVE52Z3dKajJkR0RqY3RlK25oL25zQnQyOENnWUVBK0tQbGh6QWhWMElpemZBWG8vZFkKcXlUbjNFRXBEZWx1VkpMQnZwRlI1bm4vV3MxYXN5MmFXTjd1Unkwcm5KODVRVStSMkRsd2luRG9RL1U1MlNyVgp0czYyby9LNzJWTW9PSzJxQ0VhbllERFRJR3ZmQVVQT3BnUSsrY0N3UW5ub2hhWHlhQ0VrQjV0ZitUczVlWGVGCmY3N3ZZblo2YlJaL3AxQTFrUmUxM1NNQ2dZQjRLd3dYUG91Ykp3bE1zcm1kSjZic3owZ2dzZDBSRkZaN1dQSFQKTWlGSXFJTG9aeG4wRFNRM1lHK2RzUkdHamw3SEdwUkZ1NUdqbC9OQXhIcWNDQVdNN3YzQVduWVp0SVhIQTRTaAo2aWxRV0twOWg2ZHl2VkdvbG9Eb0ttWVFHRzZ3b2tpbzk3UEdObzNDU3d1Umg3QWVKUzcrTmdrSHBIZTQwRkdyCnhGVGdUUUtCZ0ZxVHhBMzczbm05VFFleG9IRHRWVjBRS1ZYd21KL25RR3dRUW51MXB4cnl6aGVpWWhxWUlJVXMKQ1NJMkRwOExsdHNtTUpJcG9ib28vQVIvemtTWjNGUTMrSnJSd1hYdXNDZHNHdnVkd25MYXZid2xQejNEdytnNgo3T0FoUHFrdTRLa0tCbjVwZXNmeVMxTlRSQjhjVk5wMlRBdW92aGoxMGJRVUoxeWZUUjVLCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==
 kind: Secret
 metadata:
  name: hubble-server-certs
@@ -1140,7 +1134,7 @@ spec:
  template:
    metadata:
      annotations:
-        cilium.io/cilium-configmap-checksum: f162e92ee476cd3ae4b3a7fe5a589516559c51f2708f29181b1dead6b1d2381b
+        cilium.io/cilium-configmap-checksum: 4f10952e95a86affe22cdebe32cd6f453b5a2a05d34475f5ada1d7ad133fc193
        prometheus.io/port: "9963"
        prometheus.io/scrape: "true"
      labels:
@@ -1211,13 +1205,6 @@ spec:
          initialDelaySeconds: 0
          periodSeconds: 5
          timeoutSeconds: 3
-        resources:
-          limits:
-            cpu: 500m
-            memory: 256Mi
-          requests:
-            cpu: 50m
-            memory: 128Mi
        terminationMessagePolicy: FallbackToLogsOnError
        volumeMounts:
        - mountPath: /tmp/cilium/config-map
@@ -1438,7 +1425,7 @@ spec:
  template:
    metadata:
      annotations:
-        cilium.io/cilium-configmap-checksum: f162e92ee476cd3ae4b3a7fe5a589516559c51f2708f29181b1dead6b1d2381b
+        cilium.io/cilium-configmap-checksum: 4f10952e95a86affe22cdebe32cd6f453b5a2a05d34475f5ada1d7ad133fc193
      labels:
        app.kubernetes.io/name: cilium-agent
        app.kubernetes.io/part-of: cilium
@@ -1540,13 +1527,6 @@ spec:
          periodSeconds: 30
          successThreshold: 1
          timeoutSeconds: 5
-        resources:
-          limits:
-            cpu: 1000m
-            memory: 1Gi
-          requests:
-            cpu: 200m
-            memory: 512Mi
        securityContext:
          capabilities:
            add:
--- a/cilium/src/values.yaml
+++ b/cilium/src/values.yaml
--- a/cilium/src/values1.17.8.yaml
+++ b/cilium/src/values1.17.8.yaml
@@ -20,7 +20,7 @@ commonLabels: {}
 # Cilium will not change critical values to ensure continued operation
 # This flag is not required for new installations.
 # For example: '1.7', '1.8', '1.9'
-upgradeCompatibility: null
+upgradeCompatibility: 1.17.1
 debug:
  # -- Enable debug logging
  enabled: false
@@ -53,12 +53,12 @@ iptablesRandomFully: false
 # @default -- `"~/.kube/config"`
 kubeConfigPath: ""
 # -- (string) Kubernetes service host - use "auto" for automatic lookup from the cluster-info ConfigMap
-k8sServiceHost: ""
+k8sServiceHost: localhost
 # @schema
 # type: [string, integer]
 # @schema
 # -- (string) Kubernetes service port
-k8sServicePort: ""
+k8sServicePort: 7445
 # @schema
 # type: [null, string]
 # @schema
@@ -80,14 +80,14 @@ k8sClientRateLimit:
  # @schema
  # -- (int) The sustained request rate in requests per second.
  # @default -- 10
-  qps:
+  qps: 20
  # @schema
  # type: [null, integer]
  # @schema
  # -- (int) The burst request rate in requests per second.
  # The rate limiter will allow short bursts with a higher rate.
  # @default -- 20
-  burst:
+  burst: 100
  # -- Configure the client side rate limit for the Cilium Operator
  operator:
    # @schema
@@ -110,11 +110,11 @@ cluster:
  # * It must begin and end with a lower case alphanumeric character;
  # * It may contain lower case alphanumeric characters and dashes between.
  # The "default" name cannot be used if the Cluster ID is different from 0.
-  name: default
+  name: talos
  # -- (int) Unique ID of the cluster. Must be unique across all connected
  # clusters and in the range of 1 to 255. Only required for Cluster Mesh,
  # may be 0 if Cluster Mesh is not used.
-  id: 0
+  id: 1
 # -- Define serviceAccount names for components.
 # @default -- Component's fully qualified name.
 serviceAccounts:
@@ -183,7 +183,7 @@ agent: true
 # -- Agent container name.
 name: cilium
 # -- Roll out cilium agent pods automatically when configmap is updated.
-rollOutCiliumPods: false
+rollOutCiliumPods: true
 # -- Agent container image.
 image:
  # @schema
@@ -314,7 +314,7 @@ securityContext:
      # Used since cilium monitor uses mmap
      - IPC_LOCK
      # Used in iptables. Consider removing once we are iptables-free
-      - SYS_MODULE
+      #- SYS_MODULE
      # Needed to switch network namespaces (used for health endpoint, socket-LB).
      # We need it for now but might not need it for >= 5.11 specially
      # for the 'SYS_RESOURCE'.
@@ -358,7 +358,7 @@ securityContext:
      # Used since cilium modifies routing tables, etc...
      - NET_ADMIN
      # Used in iptables. Consider removing once we are iptables-free
-      - SYS_MODULE
+      #- SYS_MODULE
      # We need it for now but might not need it for >= 5.11 specially
      # for the 'SYS_RESOURCE'.
      # In >= 5.8 there's already BPF and PERMON capabilities
@@ -431,7 +431,7 @@ highScaleIPcache:
 # -- Configure L2 announcements
 l2announcements:
  # -- Enable L2 announcements
-  enabled: false
+  enabled: true
  # -- If a lease is not renewed for X duration, the current leader is considered dead, a new leader is picked
  # leaseDuration: 15s
  # -- The interval at which the leader will renew the lease
@@ -619,7 +619,7 @@ bpf:
  # the kernel supports it. The latter has the implication that it will also
  # bypass netfilter in the host namespace.
  # @default -- `false`
-  hostLegacyRouting: ~
+  hostLegacyRouting: true
  # @schema
  # type: [null, boolean]
  # @schema
@@ -793,7 +793,7 @@ daemon:
 # masqueraded (to an output device IPv4 address), if the output device runs the
 # program. When not specified, probing will automatically detect devices that have
 # a non-local route. This should be used only when autodetection is not suitable.
-# devices: ""
+devices: eth+

 # -- Enables experimental support for the detection of new and removed datapath
 # devices. When devices change the eBPF datapath is reloaded and services updated.
@@ -855,15 +855,15 @@ envoyConfig:
 ingressController:
  # -- Enable cilium ingress controller
  # This will automatically set enable-envoy-config as well.
-  enabled: false
+  enabled: true
  # -- Set cilium ingress controller to be the default ingress controller
  # This will let cilium ingress controller route entries without ingress class set
-  default: false
+  default: true
  # -- Default ingress load balancer mode
  # Supported values: shared, dedicated
  # For granular control, use the following annotations on the ingress resource:
  # "ingress.cilium.io/loadbalancer-mode: dedicated" (or "shared").
-  loadbalancerMode: dedicated
+  loadbalancerMode: shared
  # -- Enforce https for host having matching TLS host in Ingress.
  # Incoming traffic to http listener will return 308 http error code with respective location in header.
  enforceHttps: true
@@ -898,7 +898,8 @@ ingressController:
    # -- Labels to be added for the shared LB service
    labels: {}
    # -- Annotations to be added for the shared LB service
-    annotations: {}
+    annotations:
+      io.cilium/lb-ipam-ips: 192.168.0.180
    # -- Service type for the shared LB service
    type: LoadBalancer
    # @schema
@@ -948,7 +949,7 @@ ingressController:
 gatewayAPI:
  # -- Enable support for Gateway API in cilium
  # This will automatically set enable-envoy-config as well.
-  enabled: false
+  enabled: true
  # -- Enable proxy protocol for all GatewayAPI listeners. Note that _only_ Proxy protocol traffic will be accepted once this is enabled.
  enableProxyProtocol: false
  # -- Enable Backend Protocol selection support (GEP-1911) for Gateway API via appProtocol.
@@ -1439,9 +1440,9 @@ hubble:
      extraIpAddresses: []
  relay:
    # -- Enable Hubble Relay (requires hubble.enabled=true)
-    enabled: false
+    enabled: true
    # -- Roll out Hubble Relay pods automatically when configmap is updated.
-    rollOutPods: false
+    rollOutPods: true
    # -- Hubble-relay container image.
    image:
      # @schema
@@ -1656,7 +1657,7 @@ hubble:
      port: 6062
  ui:
    # -- Whether to enable the Hubble UI.
-    enabled: false
+    enabled: true
    standalone:
      # -- When true, it will allow installing the Hubble UI only, without checking dependencies.
      # It is useful if a cluster already has cilium and Hubble relay installed and you just
@@ -1680,7 +1681,7 @@ hubble:
        #         - key: ca.crt
        #           path: hubble-relay-ca.crt
    # -- Roll out Hubble-ui pods automatically when configmap is updated.
-    rollOutPods: false
+    rollOutPods: true
    tls:
      client:
        # -- Name of the Secret containing the client certificate and key for Hubble UI
@@ -1912,7 +1913,7 @@ installNoConntrackIptablesRules: false
 ipam:
  # -- Configure IP Address Management mode.
  # ref: https://docs.cilium.io/en/stable/network/concepts/ipam/
-  mode: "cluster-pool"
+  mode: kubernetes
  # -- Maximum rate at which the CiliumNode custom resource is updated.
  ciliumNodeUpdateRate: "15s"
  # -- Pre-allocation settings for IPAM in Multi-Pool mode
@@ -2026,7 +2027,7 @@ readinessProbe:
 # -- Configure the kube-proxy replacement in Cilium BPF datapath
 # Valid options are "true" or "false".
 # ref: https://docs.cilium.io/en/stable/network/kubernetes/kubeproxy-free/
-#kubeProxyReplacement: "false"
+kubeProxyReplacement: true

 # -- healthz server bind address for the kube-proxy replacement.
 # To enable set the value to '0.0.0.0:10256' for all ipv4
@@ -2129,7 +2130,7 @@ loadBalancer:

  # -- algorithm is the name of the load balancing algorithm for backend
  # selection e.g. random or maglev
-  # algorithm: random
+  algorithm: maglev

  # -- mode is the operation mode of load balancing for remote backends
  # e.g. snat, dsr, hybrid
@@ -2472,14 +2473,14 @@ envoy:
        # We need it for now but might not need it for >= 5.11 specially
        # for the 'SYS_RESOURCE'.
        # In >= 5.8 there's already BPF and PERMON capabilities
-        - SYS_ADMIN
+        #- SYS_ADMIN
        # Both PERFMON and BPF requires kernel 5.8, container runtime
        # cri-o >= v1.22.0 or containerd >= v1.5.0.
        # If available, SYS_ADMIN can be removed.
-        #- PERFMON
-        #- BPF
+        - PERFMON
+        - BPF
      # -- Keep capability `NET_BIND_SERVICE` for Envoy process.
-      keepCapNetBindService: false
+      keepCapNetBindService: true
  # -- Affinity for cilium-envoy.
  affinity:
    podAntiAffinity:
@@ -2711,7 +2712,7 @@ operator:
  # -- Enable the cilium-operator component (required).
  enabled: true
  # -- Roll out cilium-operator pods automatically when configmap is updated.
-  rollOutPods: false
+  rollOutPods: true
  # -- cilium-operator image.
  image:
    # @schema
@@ -3565,7 +3566,7 @@ cgroup:
    # If users disable `autoMount`, it's expected that users have mounted
    # cgroup2 filesystem at the specified `cgroup.hostRoot` volume, and then the
    # volume will be mounted inside the cilium agent pod at the same path.
-    enabled: true
+    enabled: false
    # -- Init Container Cgroup Automount resource limits & requests
    resources: {}
    #   limits:
@@ -3575,7 +3576,7 @@ cgroup:
    #     cpu: 100m
    #     memory: 128Mi
  # -- Configure cgroup root where cgroup2 filesystem is mounted on the host (see also: `cgroup.autoMount`)
-  hostRoot: /run/cilium/cgroupv2
+  hostRoot: /sys/fs/cgroup
 # -- Configure sysctl override described in #20072.
 sysctlfix:
  # -- Enable the sysctl override. When enabled, the init container will mount the /proc of the host so that the `sysctlfix` utility can execute.
--- a/cilium/src/values1.18.2.yaml
+++ b/cilium/src/values1.18.2.yaml
@@ -20,7 +20,7 @@ commonLabels: {}
 # Cilium will not change critical values to ensure continued operation
 # This flag is not required for new installations.
 # For example: '1.7', '1.8', '1.9'
-upgradeCompatibility: null
+upgradeCompatibility: 1.17.8
 debug:
  # -- Enable debug logging
  enabled: false