apiVersion: v1
kind: Namespace
metadata:
  labels:
    app.kubernetes.io/part-of: cilium
  name: cilium-secrets
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: cilium
  namespace: kube-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: cilium-envoy
  namespace: kube-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: cilium-operator
  namespace: kube-system
---
apiVersion: v1
automountServiceAccountToken: false
kind: ServiceAccount
metadata:
  name: hubble-relay
  namespace: kube-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: hubble-ui
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    app.kubernetes.io/part-of: cilium
  name: cilium-gateway-secrets
  namespace: cilium-secrets
rules:
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - get
  - list
  - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    app.kubernetes.io/part-of: cilium
  name: cilium-ingress-secrets
  namespace: cilium-secrets
rules:
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - get
  - list
  - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    app.kubernetes.io/part-of: cilium
  name: cilium-operator-gateway-secrets
  namespace: cilium-secrets
rules:
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - create
  - delete
  - update
  - patch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    app.kubernetes.io/part-of: cilium
  name: cilium-operator-ingress-secrets
  namespace: cilium-secrets
rules:
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - create
  - delete
  - update
  - patch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    app.kubernetes.io/part-of: cilium
  name: cilium-operator-tlsinterception-secrets
  namespace: cilium-secrets
rules:
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - create
  - delete
  - update
  - patch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    app.kubernetes.io/part-of: cilium
  name: cilium-tlsinterception-secrets
  namespace: cilium-secrets
rules:
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - get
  - list
  - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    app.kubernetes.io/part-of: cilium
  name: cilium-config-agent
  namespace: kube-system
rules:
- apiGroups:
  - ""
  resources:
  - configmaps
  verbs:
  - get
  - list
  - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app.kubernetes.io/part-of: cilium
  name: cilium
rules:
- apiGroups:
  - networking.k8s.io
  resources:
  - networkpolicies
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - discovery.k8s.io
  resources:
  - endpointslices
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - namespaces
  - services
  - pods
  - endpoints
  - nodes
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - coordination.k8s.io
  resources:
  - leases
  verbs:
  - create
  - get
  - update
  - list
  - delete
- apiGroups:
  - apiextensions.k8s.io
  resources:
  - customresourcedefinitions
  verbs:
  - list
  - watch
  - get
- apiGroups:
  - cilium.io
  resources:
  - ciliumloadbalancerippools
  - ciliumbgppeeringpolicies
  - ciliumbgpnodeconfigs
  - ciliumbgpadvertisements
  - ciliumbgppeerconfigs
  - ciliumclusterwideenvoyconfigs
  - ciliumclusterwidenetworkpolicies
  - ciliumegressgatewaypolicies
  - ciliumendpoints
  - ciliumendpointslices
  - ciliumenvoyconfigs
  - ciliumidentities
  - ciliumlocalredirectpolicies
  - ciliumnetworkpolicies
  - ciliumnodes
  - ciliumnodeconfigs
  - ciliumcidrgroups
  - ciliuml2announcementpolicies
  - ciliumpodippools
  verbs:
  - list
  - watch
- apiGroups:
  - cilium.io
  resources:
  - ciliumidentities
  - ciliumendpoints
  - ciliumnodes
  verbs:
  - create
- apiGroups:
  - cilium.io
  resources:
  - ciliumidentities
  verbs:
  - update
- apiGroups:
  - cilium.io
  resources:
  - ciliumendpoints
  verbs:
  - delete
  - get
- apiGroups:
  - cilium.io
  resources:
  - ciliumnodes
  - ciliumnodes/status
  verbs:
  - get
  - update
- apiGroups:
  - cilium.io
  resources:
  - ciliumendpoints/status
  - ciliumendpoints
  - ciliuml2announcementpolicies/status
  - ciliumbgpnodeconfigs/status
  verbs:
  - patch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app.kubernetes.io/part-of: cilium
  name: cilium-operator
rules:
- apiGroups:
  - ""
  resources:
  - pods
  verbs:
  - get
  - list
  - watch
  - delete
- apiGroups:
  - ""
  resourceNames:
  - cilium-config
  resources:
  - configmaps
  verbs:
  - patch
- apiGroups:
  - ""
  resources:
  - nodes
  verbs:
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - nodes
  - nodes/status
  verbs:
  - patch
- apiGroups:
  - discovery.k8s.io
  resources:
  - endpointslices
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - services/status
  verbs:
  - update
  - patch
- apiGroups:
  - ""
  resources:
  - namespaces
  - secrets
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - services
  - endpoints
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - delete
  - patch
- apiGroups:
  - cilium.io
  resources:
  - ciliumnetworkpolicies
  - ciliumclusterwidenetworkpolicies
  verbs:
  - create
  - update
  - deletecollection
  - patch
  - get
  - list
  - watch
- apiGroups:
  - cilium.io
  resources:
  - ciliumnetworkpolicies/status
  - ciliumclusterwidenetworkpolicies/status
  verbs:
  - patch
  - update
- apiGroups:
  - cilium.io
  resources:
  - ciliumendpoints
  - ciliumidentities
  verbs:
  - delete
  - list
  - watch
- apiGroups:
  - cilium.io
  resources:
  - ciliumidentities
  verbs:
  - update
- apiGroups:
  - cilium.io
  resources:
  - ciliumnodes
  verbs:
  - create
  - update
  - get
  - list
  - watch
  - delete
- apiGroups:
  - cilium.io
  resources:
  - ciliumnodes/status
  verbs:
  - update
- apiGroups:
  - cilium.io
  resources:
  - ciliumendpointslices
  - ciliumenvoyconfigs
  - ciliumbgppeerconfigs
  - ciliumbgpadvertisements
  - ciliumbgpnodeconfigs
  verbs:
  - create
  - update
  - get
  - list
  - watch
  - delete
  - patch
- apiGroups:
  - cilium.io
  resources:
  - ciliumbgpclusterconfigs/status
  - ciliumbgppeerconfigs/status
  verbs:
  - update
- apiGroups:
  - apiextensions.k8s.io
  resources:
  - customresourcedefinitions
  verbs:
  - create
  - get
  - list
  - watch
- apiGroups:
  - apiextensions.k8s.io
  resourceNames:
  - ciliumloadbalancerippools.cilium.io
  - ciliumbgppeeringpolicies.cilium.io
  - ciliumbgpclusterconfigs.cilium.io
  - ciliumbgppeerconfigs.cilium.io
  - ciliumbgpadvertisements.cilium.io
  - ciliumbgpnodeconfigs.cilium.io
  - ciliumbgpnodeconfigoverrides.cilium.io
  - ciliumclusterwideenvoyconfigs.cilium.io
  - ciliumclusterwidenetworkpolicies.cilium.io
  - ciliumegressgatewaypolicies.cilium.io
  - ciliumendpoints.cilium.io
  - ciliumendpointslices.cilium.io
  - ciliumenvoyconfigs.cilium.io
  - ciliumidentities.cilium.io
  - ciliumlocalredirectpolicies.cilium.io
  - ciliumnetworkpolicies.cilium.io
  - ciliumnodes.cilium.io
  - ciliumnodeconfigs.cilium.io
  - ciliumcidrgroups.cilium.io
  - ciliuml2announcementpolicies.cilium.io
  - ciliumpodippools.cilium.io
  - ciliumgatewayclassconfigs.cilium.io
  resources:
  - customresourcedefinitions
  verbs:
  - update
- apiGroups:
  - cilium.io
  resources:
  - ciliumloadbalancerippools
  - ciliumpodippools
  - ciliumbgppeeringpolicies
  - ciliumbgpclusterconfigs
  - ciliumbgpnodeconfigoverrides
  - ciliumbgppeerconfigs
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - cilium.io
  resources:
  - ciliumpodippools
  verbs:
  - create
- apiGroups:
  - cilium.io
  resources:
  - ciliumloadbalancerippools/status
  verbs:
  - patch
- apiGroups:
  - coordination.k8s.io
  resources:
  - leases
  verbs:
  - create
  - get
  - update
- apiGroups:
  - networking.k8s.io
  resources:
  - ingresses
  - ingressclasses
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - networking.k8s.io
  resources:
  - ingresses/status
  verbs:
  - update
- apiGroups:
  - gateway.networking.k8s.io
  resources:
  - gatewayclasses
  - gateways
  - tlsroutes
  - httproutes
  - grpcroutes
  - referencegrants
  - referencepolicies
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - gateway.networking.k8s.io
  resources:
  - gatewayclasses
  verbs:
  - patch
- apiGroups:
  - gateway.networking.k8s.io
  resources:
  - gatewayclasses/status
  - gateways/status
  - httproutes/status
  - grpcroutes/status
  - tlsroutes/status
  verbs:
  - update
  - patch
- apiGroups:
  - cilium.io
  resources:
  - ciliumgatewayclassconfigs
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - cilium.io
  resources:
  - ciliumgatewayclassconfigs/status
  verbs:
  - update
  - patch
- apiGroups:
  - multicluster.x-k8s.io
  resources:
  - serviceimports
  verbs:
  - get
  - list
  - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app.kubernetes.io/part-of: cilium
  name: hubble-ui
rules:
- apiGroups:
  - networking.k8s.io
  resources:
  - networkpolicies
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - componentstatuses
  - endpoints
  - namespaces
  - nodes
  - pods
  - services
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - apiextensions.k8s.io
  resources:
  - customresourcedefinitions
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - cilium.io
  resources:
  - '*'
  verbs:
  - get
  - list
  - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app.kubernetes.io/part-of: cilium
  name: cilium-gateway-secrets
  namespace: cilium-secrets
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: cilium-gateway-secrets
subjects:
- kind: ServiceAccount
  name: cilium
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app.kubernetes.io/part-of: cilium
  name: cilium-operator-gateway-secrets
  namespace: cilium-secrets
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: cilium-operator-gateway-secrets
subjects:
- kind: ServiceAccount
  name: cilium-operator
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app.kubernetes.io/part-of: cilium
  name: cilium-operator-ingress-secrets
  namespace: cilium-secrets
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: cilium-operator-ingress-secrets
subjects:
- kind: ServiceAccount
  name: cilium-operator
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app.kubernetes.io/part-of: cilium
  name: cilium-operator-tlsinterception-secrets
  namespace: cilium-secrets
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: cilium-operator-tlsinterception-secrets
subjects:
- kind: ServiceAccount
  name: cilium-operator
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app.kubernetes.io/part-of: cilium
  name: cilium-secrets
  namespace: cilium-secrets
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: cilium-ingress-secrets
subjects:
- kind: ServiceAccount
  name: cilium
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app.kubernetes.io/part-of: cilium
  name: cilium-tlsinterception-secrets
  namespace: cilium-secrets
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: cilium-tlsinterception-secrets
subjects:
- kind: ServiceAccount
  name: cilium
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app.kubernetes.io/part-of: cilium
  name: cilium-config-agent
  namespace: kube-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: cilium-config-agent
subjects:
- kind: ServiceAccount
  name: cilium
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app.kubernetes.io/part-of: cilium
  name: cilium
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cilium
subjects:
- kind: ServiceAccount
  name: cilium
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app.kubernetes.io/part-of: cilium
  name: cilium-operator
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cilium-operator
subjects:
- kind: ServiceAccount
  name: cilium-operator
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app.kubernetes.io/part-of: cilium
  name: hubble-ui
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: hubble-ui
subjects:
- kind: ServiceAccount
  name: hubble-ui
  namespace: kube-system
---
apiVersion: v1
data:
  agent-not-ready-taint-key: node.cilium.io/agent-not-ready
  auto-direct-node-routes: "false"
  bpf-distributed-lru: "false"
  bpf-events-drop-enabled: "true"
  bpf-events-policy-verdict-enabled: "true"
  bpf-events-trace-enabled: "true"
  bpf-lb-acceleration: disabled
  bpf-lb-algorithm: maglev
  bpf-lb-algorithm-annotation: "false"
  bpf-lb-external-clusterip: "false"
  bpf-lb-map-max: "65536"
  bpf-lb-mode-annotation: "false"
  bpf-lb-sock: "false"
  bpf-lb-source-range-all-types: "false"
  bpf-map-dynamic-size-ratio: "0.0025"
  bpf-policy-map-max: "16384"
  bpf-policy-stats-map-max: "65536"
  bpf-root: /sys/fs/bpf
  cgroup-root: /sys/fs/cgroup
  cilium-endpoint-gc-interval: 5m0s
  cluster-id: "1"
  cluster-name: talos
  clustermesh-enable-endpoint-sync: "false"
  clustermesh-enable-mcs-api: "false"
  cni-exclusive: "true"
  cni-log-file: /var/run/cilium/cilium-cni.log
  custom-cni-conf: "false"
  datapath-mode: veth
  debug: "false"
  default-lb-service-ipam: lbipam
  devices: eth+
  direct-routing-skip-unreachable: "false"
  dnsproxy-enable-transparent-mode: "true"
  dnsproxy-socket-linger-timeout: "10"
  egress-gateway-reconciliation-trigger-interval: 1s
  enable-auto-protect-node-port-range: "true"
  enable-bpf-clock-probe: "false"
  enable-endpoint-health-checking: "true"
  enable-endpoint-lockdown-on-policy-overflow: "false"
  enable-envoy-config: "true"
  enable-gateway-api: "true"
  enable-gateway-api-alpn: "true"
  enable-gateway-api-app-protocol: "true"
  enable-gateway-api-proxy-protocol: "false"
  enable-gateway-api-secrets-sync: "true"
  enable-health-check-loadbalancer-ip: "false"
  enable-health-check-nodeport: "true"
  enable-health-checking: "true"
  enable-host-legacy-routing: "true"
  enable-hubble: "true"
  enable-ingress-controller: "true"
  enable-ingress-proxy-protocol: "false"
  enable-ingress-secrets-sync: "true"
  enable-internal-traffic-policy: "true"
  enable-ipv4: "true"
  enable-ipv4-big-tcp: "false"
  enable-ipv4-masquerade: "true"
  enable-ipv6: "false"
  enable-ipv6-big-tcp: "false"
  enable-ipv6-masquerade: "true"
  enable-k8s-networkpolicy: "true"
  enable-l2-announcements: "true"
  enable-l2-neigh-discovery: "true"
  enable-l7-proxy: "true"
  enable-lb-ipam: "true"
  enable-masquerade-to-route-source: "false"
  enable-metrics: "true"
  enable-node-selector-labels: "false"
  enable-non-default-deny-policies: "true"
  enable-policy: default
  enable-policy-secrets-sync: "true"
  enable-sctp: "false"
  enable-source-ip-verification: "true"
  enable-svc-source-range-check: "true"
  enable-tcx: "true"
  enable-vtep: "false"
  enable-well-known-identities: "false"
  enable-xt-socket-fallback: "true"
  enforce-ingress-https: "true"
  envoy-access-log-buffer-size: "4096"
  envoy-base-id: "0"
  envoy-config-retry-interval: 15s
  envoy-keep-cap-netbindservice: "true"
  external-envoy-proxy: "true"
  gateway-api-hostnetwork-enabled: "false"
  gateway-api-hostnetwork-nodelabelselector: ""
  gateway-api-secrets-namespace: cilium-secrets
  gateway-api-service-externaltrafficpolicy: Cluster
  gateway-api-xff-num-trusted-hops: "0"
  health-check-icmp-failure-threshold: "3"
  http-retry-count: "3"
  hubble-disable-tls: "false"
  hubble-listen-address: :4244
  hubble-network-policy-correlation-enabled: "true"
  hubble-socket-path: /var/run/cilium/hubble.sock
  hubble-tls-cert-file: /var/lib/cilium/tls/hubble/server.crt
  hubble-tls-client-ca-files: /var/lib/cilium/tls/hubble/client-ca.crt
  hubble-tls-key-file: /var/lib/cilium/tls/hubble/server.key
  identity-allocation-mode: crd
  identity-gc-interval: 15m0s
  identity-heartbeat-timeout: 30m0s
  identity-management-mode: agent
  ingress-default-lb-mode: shared
  ingress-hostnetwork-enabled: "false"
  ingress-hostnetwork-nodelabelselector: ""
  ingress-hostnetwork-shared-listener-port: "8080"
  ingress-lb-annotation-prefixes: lbipam.cilium.io nodeipam.cilium.io service.beta.kubernetes.io
    service.kubernetes.io cloud.google.com
  ingress-secrets-namespace: cilium-secrets
  ingress-shared-lb-service-name: cilium-ingress
  install-no-conntrack-iptables-rules: "false"
  ipam: kubernetes
  ipam-cilium-node-update-rate: 15s
  iptables-random-fully: "false"
  k8s-require-ipv4-pod-cidr: "false"
  k8s-require-ipv6-pod-cidr: "false"
  kube-proxy-replacement: "true"
  kube-proxy-replacement-healthz-bind-address: ""
  max-connected-clusters: "255"
  mesh-auth-enabled: "true"
  mesh-auth-gc-interval: 5m0s
  mesh-auth-queue-size: "1024"
  mesh-auth-rotated-identities-queue-size: "1024"
  metrics-sampling-interval: 5m
  monitor-aggregation: medium
  monitor-aggregation-flags: all
  monitor-aggregation-interval: 5s
  nat-map-stats-entries: "32"
  nat-map-stats-interval: 30s
  node-port-bind-protection: "true"
  nodes-gc-interval: 5m0s
  operator-api-serve-addr: 127.0.0.1:9234
  operator-prometheus-serve-addr: :9963
  policy-default-local-cluster: "false"
  policy-secrets-namespace: cilium-secrets
  policy-secrets-only-from-secrets-namespace: "true"
  preallocate-bpf-maps: "false"
  procfs: /host/proc
  proxy-connect-timeout: "2"
  proxy-idle-timeout-seconds: "60"
  proxy-initial-fetch-timeout: "30"
  proxy-max-concurrent-retries: "128"
  proxy-max-connection-duration-seconds: "0"
  proxy-max-requests-per-connection: "0"
  proxy-xff-num-trusted-hops-egress: "0"
  proxy-xff-num-trusted-hops-ingress: "0"
  remove-cilium-node-taints: "true"
  routing-mode: tunnel
  service-no-backend-response: reject
  set-cilium-is-up-condition: "true"
  set-cilium-node-taints: "true"
  synchronize-k8s-nodes: "true"
  tofqdns-dns-reject-response-code: refused
  tofqdns-enable-dns-compression: "true"
  tofqdns-endpoint-max-ip-per-hostname: "1000"
  tofqdns-idle-connection-grace-period: 0s
  tofqdns-max-deferred-connection-deletes: "10000"
  tofqdns-preallocate-identities: "true"
  tofqdns-proxy-response-max-delay: 100ms
  tunnel-protocol: vxlan
  tunnel-source-port-range: 0-0
  unmanaged-pod-watcher-interval: "15"
  vtep-cidr: ""
  vtep-endpoint: ""
  vtep-mac: ""
  vtep-mask: ""
  write-cni-conf-when-ready: /host/etc/cni/net.d/05-cilium.conflist
kind: ConfigMap
metadata:
  name: cilium-config
  namespace: kube-system
---
apiVersion: v1
data:
  bootstrap-config.json: |
    {"admin":{"address":{"pipe":{"path":"/var/run/cilium/envoy/sockets/admin.sock"}}},"applicationLogConfig":{"logFormat":{"textFormat":"[%Y-%m-%d %T.%e][%t][%l][%n] [%g:%#] %v"}},"bootstrapExtensions":[{"name":"envoy.bootstrap.internal_listener","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.bootstrap.internal_listener.v3.InternalListener"}}],"dynamicResources":{"cdsConfig":{"apiConfigSource":{"apiType":"GRPC","grpcServices":[{"envoyGrpc":{"clusterName":"xds-grpc-cilium"}}],"setNodeOnFirstMessageOnly":true,"transportApiVersion":"V3"},"initialFetchTimeout":"30s","resourceApiVersion":"V3"},"ldsConfig":{"apiConfigSource":{"apiType":"GRPC","grpcServices":[{"envoyGrpc":{"clusterName":"xds-grpc-cilium"}}],"setNodeOnFirstMessageOnly":true,"transportApiVersion":"V3"},"initialFetchTimeout":"30s","resourceApiVersion":"V3"}},"node":{"cluster":"ingress-cluster","id":"host~127.0.0.1~no-id~localdomain"},"overloadManager":{"resourceMonitors":[{"name":"envoy.resource_monitors.global_downstream_max_connections","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig","max_active_downstream_connections":"50000"}}]},"staticResources":{"clusters":[{"circuitBreakers":{"thresholds":[{"maxRetries":128}]},"cleanupInterval":"2.500s","connectTimeout":"2s","lbPolicy":"CLUSTER_PROVIDED","name":"ingress-cluster","type":"ORIGINAL_DST","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","commonHttpProtocolOptions":{"idleTimeout":"60s","maxConnectionDuration":"0s","maxRequestsPerConnection":0},"useDownstreamProtocolConfig":{}}}},{"circuitBreakers":{"thresholds":[{"maxRetries":128}]},"cleanupInterval":"2.500s","connectTimeout":"2s","lbPolicy":"CLUSTER_PROVIDED","name":"egress-cluster-tls","transportSocket":{"name":"cilium.tls_wrapper","typedConfig":{"@type":"type.googleapis.com/cilium.UpstreamTlsWrapperContext"}},"type":"ORIGINAL_DST","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","commonHttpProtocolOptions":{"idleTimeout":"60s","maxConnectionDuration":"0s","maxRequestsPerConnection":0},"upstreamHttpProtocolOptions":{},"useDownstreamProtocolConfig":{}}}},{"circuitBreakers":{"thresholds":[{"maxRetries":128}]},"cleanupInterval":"2.500s","connectTimeout":"2s","lbPolicy":"CLUSTER_PROVIDED","name":"egress-cluster","type":"ORIGINAL_DST","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","commonHttpProtocolOptions":{"idleTimeout":"60s","maxConnectionDuration":"0s","maxRequestsPerConnection":0},"useDownstreamProtocolConfig":{}}}},{"circuitBreakers":{"thresholds":[{"maxRetries":128}]},"cleanupInterval":"2.500s","connectTimeout":"2s","lbPolicy":"CLUSTER_PROVIDED","name":"ingress-cluster-tls","transportSocket":{"name":"cilium.tls_wrapper","typedConfig":{"@type":"type.googleapis.com/cilium.UpstreamTlsWrapperContext"}},"type":"ORIGINAL_DST","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","commonHttpProtocolOptions":{"idleTimeout":"60s","maxConnectionDuration":"0s","maxRequestsPerConnection":0},"upstreamHttpProtocolOptions":{},"useDownstreamProtocolConfig":{}}}},{"connectTimeout":"2s","loadAssignment":{"clusterName":"xds-grpc-cilium","endpoints":[{"lbEndpoints":[{"endpoint":{"address":{"pipe":{"path":"/var/run/cilium/envoy/sockets/xds.sock"}}}}]}]},"name":"xds-grpc-cilium","type":"STATIC","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","explicitHttpConfig":{"http2ProtocolOptions":{}}}}},{"connectTimeout":"2s","loadAssignment":{"clusterName":"/envoy-admin","endpoints":[{"lbEndpoints":[{"endpoint":{"address":{"pipe":{"path":"/var/run/cilium/envoy/sockets/admin.sock"}}}}]}]},"name":"/envoy-admin","type":"STATIC"}],"listeners":[{"address":{"socketAddress":{"address":"0.0.0.0","portValue":9964}},"filterChains":[{"filters":[{"name":"envoy.filters.network.http_connection_manager","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager","httpFilters":[{"name":"envoy.filters.http.router","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"}}],"internalAddressConfig":{"cidrRanges":[{"addressPrefix":"10.0.0.0","prefixLen":8},{"addressPrefix":"172.16.0.0","prefixLen":12},{"addressPrefix":"192.168.0.0","prefixLen":16},{"addressPrefix":"127.0.0.1","prefixLen":32}]},"routeConfig":{"virtualHosts":[{"domains":["*"],"name":"prometheus_metrics_route","routes":[{"match":{"prefix":"/metrics"},"name":"prometheus_metrics_route","route":{"cluster":"/envoy-admin","prefixRewrite":"/stats/prometheus"}}]}]},"statPrefix":"envoy-prometheus-metrics-listener","streamIdleTimeout":"300s"}}]}],"name":"envoy-prometheus-metrics-listener"},{"address":{"socketAddress":{"address":"127.0.0.1","portValue":9878}},"filterChains":[{"filters":[{"name":"envoy.filters.network.http_connection_manager","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager","httpFilters":[{"name":"envoy.filters.http.router","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"}}],"internalAddressConfig":{"cidrRanges":[{"addressPrefix":"10.0.0.0","prefixLen":8},{"addressPrefix":"172.16.0.0","prefixLen":12},{"addressPrefix":"192.168.0.0","prefixLen":16},{"addressPrefix":"127.0.0.1","prefixLen":32}]},"routeConfig":{"virtual_hosts":[{"domains":["*"],"name":"health","routes":[{"match":{"prefix":"/healthz"},"name":"health","route":{"cluster":"/envoy-admin","prefixRewrite":"/ready"}}]}]},"statPrefix":"envoy-health-listener","streamIdleTimeout":"300s"}}]}],"name":"envoy-health-listener"}]}}
kind: ConfigMap
metadata:
  name: cilium-envoy-config
  namespace: kube-system
---
apiVersion: v1
data:
  config.yaml: "cluster-name: talos\npeer-service: \"hubble-peer.kube-system.svc.cluster.local.:443\"\nlisten-address:
    :4245\ngops: true\ngops-port: \"9893\"\nretry-timeout: \nsort-buffer-len-max:
    \nsort-buffer-drain-timeout: \ntls-hubble-client-cert-file: /var/lib/hubble-relay/tls/client.crt\ntls-hubble-client-key-file:
    /var/lib/hubble-relay/tls/client.key\ntls-hubble-server-ca-files: /var/lib/hubble-relay/tls/hubble-server-ca.crt\n\ndisable-server-tls:
    true\n"
kind: ConfigMap
metadata:
  name: hubble-relay-config
  namespace: kube-system
---
apiVersion: v1
data:
  nginx.conf: |-
    server {
        listen       8081;
        listen       [::]:8081;
        server_name  localhost;
        root /app;
        index index.html;
        client_max_body_size 1G;

        location / {
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;

            location /api {
                proxy_http_version 1.1;
                proxy_pass_request_headers on;
                proxy_pass http://127.0.0.1:8090;
            }
            location / {
                if ($http_user_agent ~* "kube-probe") { access_log off; }
                # double `/index.html` is required here
                try_files $uri $uri/ /index.html /index.html;
            }

            # Liveness probe
            location /healthz {
                access_log off;
                add_header Content-Type text/plain;
                return 200 'ok';
            }
        }
    }
kind: ConfigMap
metadata:
  name: hubble-ui-nginx
  namespace: kube-system
---
apiVersion: v1
data:
  ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURFekNDQWZ1Z0F3SUJBZ0lRSlVVd2VOcmJsRFRQYmtIditldTlqakFOQmdrcWhraUc5dzBCQVFzRkFEQVUKTVJJd0VBWURWUVFERXdsRGFXeHBkVzBnUTBFd0hoY05NalV4TWpBMk1UVTBPREEyV2hjTk1qZ3hNakExTVRVMApPREEyV2pBVU1SSXdFQVlEVlFRREV3bERhV3hwZFcwZ1EwRXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCCkR3QXdnZ0VLQW9JQkFRRE84ekVhRDF5NmtFRU1USXo4NDdjQXJXYjJwVlFCcnRJanVld09TWmZETTBNdjAwNHMKWHh6ZWVUVzJaMHFmeEp5Q3QzVG8zRVFjaTlOaWZsRDVFMzQrOEQxV0ZZTDRoZkZwZkZwWXFOQVR4QXUzK0ZmbApLRXAyS0JXQTNza2JQZHkrUUJsK0UyYXF6S3kyRVg2MEdtQjdWc1pjeXc3UWdwemg0Zlo4d1RTU3JEcThXU2twCnhPdmJXbDJFc2hpaXErQ0MvbTEzT3JGelpheGEwT25pbFZ0NUx3aGc3Qk5LTCtVejJTY3lUbTE5RGM3Vy9qRzMKR1l0M2JhamtoZGdqdERDS0dFRmtNS0R1Y0o5VCtCWmFLSVcrMVdmOUwyUjhjZnNqNjNtL3U0a1ZvanZubTFURgprYWhKbGV5YUFzR3N5T3BzK2hLVG5aTXJaQ3QzVGh6QXFleGhBZ01CQUFHallUQmZNQTRHQTFVZER3RUIvd1FFCkF3SUNwREFkQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXcKQXdFQi96QWRCZ05WSFE0RUZnUVVKWGlzVElIWk5LSStwaitTbWtUdFRhL3pkNnN3RFFZSktvWklodmNOQVFFTApCUUFEZ2dFQkFHeEZaYm4vMHovYTRqc3A5aFRRRE1PNGlDWUlhcGlTcWxjM0NmdVBnVWQxWGplaTh4MzJpeTc0CmlOSmFVK1ZSMllCTFVsRURmMDRIcWovOUNMUmE4czQ1ODArNUdNbUJDeFZuMmtnWGpBVi96UHlzb2FlbCtkemYKZTFkdXBzYmVQT3VLTzZnbTRhZHR4RitLWVJMd053VXhJOXdac3Z1ajhaVmVoQTVTTEZJUnB1bWdQeDl3R0dOOQpKdlRqb1hudDZkbFB6UlNlK2pNOTArUWhpcWwxLzZwRUFYaEZ3ZUdMNSsxU0dQUFRqbDc1UEhTT0JIbUw3dXk3CmtwbTZnWGFCUmFJelJqRUVZNTNBNzFFaVRQQlVkbjhWS3pNYzltR0d3aUtXSlFaUjJtYWxwRGI4QUE5Z2lwOUEKWEJFcGZGZ3RUUnlWQlVzNmJBV0xoVlFFcGtid0djbz0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
  ca.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcFFJQkFBS0NBUUVBenZNeEdnOWN1cEJCREV5TS9PTzNBSzFtOXFWVUFhN1NJN25zRGttWHd6TkRMOU5PCkxGOGMzbmsxdG1kS244U2NncmQwNk54RUhJdlRZbjVRK1JOK1B2QTlWaFdDK0lYeGFYeGFXS2pRRThRTHQvaFgKNVNoS2RpZ1ZnTjdKR3ozY3ZrQVpmaE5tcXN5c3RoRit0QnBnZTFiR1hNc08wSUtjNGVIMmZNRTBrcXc2dkZrcApLY1RyMjFwZGhMSVlvcXZnZ3Y1dGR6cXhjMldzV3REcDRwVmJlUzhJWU93VFNpL2xNOWtuTWs1dGZRM08xdjR4CnR4bUxkMjJvNUlYWUk3UXdpaGhCWkRDZzduQ2ZVL2dXV2lpRnZ0Vm4vUzlrZkhIN0krdDV2N3VKRmFJNzU1dFUKeFpHb1NaWHNtZ0xCck1qcWJQb1NrNTJUSzJRcmQwNGN3S25zWVFJREFRQUJBb0lCQUVJMWJjVWZteFFZNkthdApxd0dSUE5BYnFmQkk3bnBuV3RXUk91TkxTaUZxT2htSDZkK3FRa3N1emk5Z0ZuRE03eUdtM2VGTjd3Q08vMzdvCldMR0hPZ0dhekpUSTV4RHBrVldsTWlaaFE4aS9GTnl6dURNWlU5RS9lN215RFBjSk1LRXhVcmFTTUd0K2RkYjkKKytKVStmOGJ3UFNaQmxGUktDM2dKQUsvc1RrbkN4N2RkUWFFYW05bEhOT2daRVVNOFNLaHJyMFdxcisxUUtLSQpyQ09qMTJST2R3MkVGUzNtR0dSeXVKSWErSWwwZ0NGcG95cElIZUpKYzhyQjY5Q1NtZnYva0YvcitqdVNib2ltCjFKSmtrektHSERCOFdpVzZCSkpjWTc3cktxTkUyY0labk9ETElKY05tNGE5OW5JWHJMQlg5L1M5YU16M2daY2EKVk1mZ3pOMENnWUVBMVA5cVdWbnJGeHdNQWdIRVdKSUZlaDRhSk8rUWoxbHp1WHVzZDJJbnVpSEwxTDJKWWlsRApqOWY4cjhCdllhSjR4VnR4NjNBdDFlQkkwOGNQV2dFd2wwRERwTW1IZWdhQlpWZE85aklhanB1N1l5VWhsUEhyCmh1dEZ3Zkl4L1VRV01vUkNHWFJtd2YyQXBnbEFIdllMRXFYQnJXeFZmblBLQXA0U0JlNFFyWDhDZ1lFQStMczAKU1R6QmRnMHNNUzhJa0Y1aTV4YlRTNCtNRFBNYkxUTW5QMDJBZ1lpTG5INjYvdlFHWDRLNUlhK3VvNjBBeDdqdwo0eVhVUUtkT0xHWS9oN0JmZ0EzUVhVUkY2UEtNZkZWUGdRTlRldURQeG9UQXhhL2NQMlhNbEgwZ0lpTjY1L3VvCjJlZEY2amJjUEx1QUZ6U2ZLYVRPTVJ0eUtUbU8zdndoZ3BoRUZoOENnWUVBbWNhSkxsY1h2a2gyZHVCMXRBaEEKUWdrSGtSRVFTaDRueVlyN1dmbVlldTQ1YmE4bFI2Ukk3Y25lMmJoUjhhaE9EeFpWS2NpRW52dmRPR0JudWZCUAo5M00vakhJZkNEODRIa1VwY2Q5OGd1YjJJNzlEL25lbU5uTVhtczFUditqdkthdUkyVDNMamxTS0U5VnI0SzU4CkVndHZ4OWdGNVZTTlROUjRhS1dXanRzQ2dZRUF6SXpueXZMMEJxbCtsbFFmcnRwd2E2c1J5U29iK3VwU2h6RnkKTFZVSFFYK1JrUG1IdnZQZjZkd1BjK3lPcW53MEVBdS96bzNscCtYdkhBUmFhclJaVlc0RzFTeTRjWUpHbGxseQpNSjhUb0JJUnpTaVBnQVBJRlRzYXEyTGJjamZMYzh3NmFEa1Ivak52bTJKM1RKNHg1b1ZxTEdodDBnbEx2WVdMCjZXSmZXL0VDZ1lFQXJpY3JHa1VPZTZyazlnTXBjRmV2NjFhdEhUODZZMmMvUHkxSXRLODdmbjRQaVNVU2pXbWcKaDhDc3RXKzRObUs2SHdKMlJpc2FIOXVFcWZRLzN4NWhYSUc2OXgyZ05pOTB0dnFIQmVnSSt1akFsbWRDUWsvUgpEVURWc1R4ZnB3LzBQV2RQb2JZN0VycmJFQWhjSlM2cXB6NVdMaXNnV0N5QnFZUmhmVGNJSVcwPQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=
kind: Secret
metadata:
  name: cilium-ca
  namespace: kube-system
---
apiVersion: v1
data:
  ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURFekNDQWZ1Z0F3SUJBZ0lRSlVVd2VOcmJsRFRQYmtIditldTlqakFOQmdrcWhraUc5dzBCQVFzRkFEQVUKTVJJd0VBWURWUVFERXdsRGFXeHBkVzBnUTBFd0hoY05NalV4TWpBMk1UVTBPREEyV2hjTk1qZ3hNakExTVRVMApPREEyV2pBVU1SSXdFQVlEVlFRREV3bERhV3hwZFcwZ1EwRXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCCkR3QXdnZ0VLQW9JQkFRRE84ekVhRDF5NmtFRU1USXo4NDdjQXJXYjJwVlFCcnRJanVld09TWmZETTBNdjAwNHMKWHh6ZWVUVzJaMHFmeEp5Q3QzVG8zRVFjaTlOaWZsRDVFMzQrOEQxV0ZZTDRoZkZwZkZwWXFOQVR4QXUzK0ZmbApLRXAyS0JXQTNza2JQZHkrUUJsK0UyYXF6S3kyRVg2MEdtQjdWc1pjeXc3UWdwemg0Zlo4d1RTU3JEcThXU2twCnhPdmJXbDJFc2hpaXErQ0MvbTEzT3JGelpheGEwT25pbFZ0NUx3aGc3Qk5LTCtVejJTY3lUbTE5RGM3Vy9qRzMKR1l0M2JhamtoZGdqdERDS0dFRmtNS0R1Y0o5VCtCWmFLSVcrMVdmOUwyUjhjZnNqNjNtL3U0a1ZvanZubTFURgprYWhKbGV5YUFzR3N5T3BzK2hLVG5aTXJaQ3QzVGh6QXFleGhBZ01CQUFHallUQmZNQTRHQTFVZER3RUIvd1FFCkF3SUNwREFkQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXcKQXdFQi96QWRCZ05WSFE0RUZnUVVKWGlzVElIWk5LSStwaitTbWtUdFRhL3pkNnN3RFFZSktvWklodmNOQVFFTApCUUFEZ2dFQkFHeEZaYm4vMHovYTRqc3A5aFRRRE1PNGlDWUlhcGlTcWxjM0NmdVBnVWQxWGplaTh4MzJpeTc0CmlOSmFVK1ZSMllCTFVsRURmMDRIcWovOUNMUmE4czQ1ODArNUdNbUJDeFZuMmtnWGpBVi96UHlzb2FlbCtkemYKZTFkdXBzYmVQT3VLTzZnbTRhZHR4RitLWVJMd053VXhJOXdac3Z1ajhaVmVoQTVTTEZJUnB1bWdQeDl3R0dOOQpKdlRqb1hudDZkbFB6UlNlK2pNOTArUWhpcWwxLzZwRUFYaEZ3ZUdMNSsxU0dQUFRqbDc1UEhTT0JIbUw3dXk3CmtwbTZnWGFCUmFJelJqRUVZNTNBNzFFaVRQQlVkbjhWS3pNYzltR0d3aUtXSlFaUjJtYWxwRGI4QUE5Z2lwOUEKWEJFcGZGZ3RUUnlWQlVzNmJBV0xoVlFFcGtid0djbz0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURTRENDQWpDZ0F3SUJBZ0lRVzlVNXBNeU5YVjF1QTREaVNCa3VNREFOQmdrcWhraUc5dzBCQVFzRkFEQVUKTVJJd0VBWURWUVFERXdsRGFXeHBkVzBnUTBFd0hoY05NalV4TWpBMk1UVTBPREEyV2hjTk1qWXhNakEyTVRVMApPREEyV2pBak1TRXdId1lEVlFRRERCZ3FMbWgxWW1Kc1pTMXlaV3hoZVM1amFXeHBkVzB1YVc4d2dnRWlNQTBHCkNTcUdTSWIzRFFFQkFRVUFBNElCRHdBd2dnRUtBb0lCQVFEdTJSeHdwdHlrMlFmblFpR1lUUk81cmhJajd1SlcKZ3o4TUo1UHJHRGNBenlkcXljYmJqTm5KWldFSGdDVmErQzRUMzN0b1BkYlc0SGhKb2JBTXRidnI2RytYZVZvdAp3cWNZSE41ZUQwQnJwWnRqa2p0eFNoaEpHN3ljY2VwTWJodFF0TFBvSTdzS3U1UG1acDc2aFJUMkF1dkZHTzlICmxablNhbXQ2YnlENW9Ea2lFZ3lVSlZuVFFseGRtOW83WDFuVzIvZlg4bzdsVThmVW1NNkJEOHVFOU9rbzNuSDYKMG1NajROTjlJa3ZVeWQwVWJoWkJ3RUtJWDB2NW1iNEcyYU16WC9pdUdlVmYrTjZoSnBxSUdEcWt1UHlmMHZucQpGUlFLMXRMTy9mbmN6ZXhDMDRuVjYzVWNMK0NGRjJQN29iSXlja21yeERkWFc0ZkRvTmpiWThXdEFnTUJBQUdqCmdZWXdnWU13RGdZRFZSMFBBUUgvQkFRREFnV2dNQjBHQTFVZEpRUVdNQlFHQ0NzR0FRVUZCd01CQmdnckJnRUYKQlFjREFqQU1CZ05WSFJNQkFmOEVBakFBTUI4R0ExVWRJd1FZTUJhQUZDVjRyRXlCMlRTaVBxWS9rcHBFN1Uydgo4M2VyTUNNR0ExVWRFUVFjTUJxQ0dDb3VhSFZpWW14bExYSmxiR0Y1TG1OcGJHbDFiUzVwYnpBTkJna3Foa2lHCjl3MEJBUXNGQUFPQ0FRRUF5ZmI5S3lsMWFRY1g2ZG5TK29iMU12a1VKWVZid2lST2Fja3o2eE5zWHJQODh4UloKcGNCbk5VNnVLRUJicFh2bHk5bmpNU3N1bXpvVmtkVWxEU0loa2gxOTd2UTJkUEM0OW5McGQvM25PYVpFTTFONAp6YmMycDNleG80WjhwRnRxRjV4T29kbXJsZUJpZmNnMXlGZ2hwTnpmWWlGOU85OWlmeUZ4OHR4YnBSOWtxYTY0CkNPTkJxeVBDN1dGZHhwVXh6S1h6bFdVc0lzcnhsdTI2eXBOcFhReDRnNEtPTUpibmdMOEIzSnRJQ0NYSG1pdysKR25Fb0VFMjh1Z05IRnlNMUxVUG1FM2t0NXVZZlZEK2l3ZXEvNzhtdFpoZ3BzUVMyM2RYbXFURWIvOVdZaUFDdwoxTG8wSjdleFhQaUZPYXB2RXRtbmN3TEVwajdOYTZ4MWRyVDl4UT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
  tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb2dJQkFBS0NBUUVBN3RrY2NLYmNwTmtINTBJaG1FMFR1YTRTSSs3aVZvTS9EQ2VUNnhnM0FNOG5hc25HCjI0elp5V1ZoQjRBbFd2Z3VFOTk3YUQzVzF1QjRTYUd3RExXNzYraHZsM2xhTGNLbkdCemVYZzlBYTZXYlk1STcKY1VvWVNSdThuSEhxVEc0YlVMU3o2Q083Q3J1VDVtYWUrb1VVOWdMcnhSanZSNVdaMG1wcmVtOGcrYUE1SWhJTQpsQ1ZaMDBKY1hadmFPMTlaMXR2MzEvS081VlBIMUpqT2dRL0xoUFRwS041eCt0SmpJK0RUZlNKTDFNbmRGRzRXClFjQkNpRjlMK1ptK0J0bWpNMS80cmhubFgvamVvU2FhaUJnNnBMajhuOUw1NmhVVUN0YlN6djM1M00zc1F0T0oKMWV0MUhDL2doUmRqKzZHeU1uSkpxOFEzVjF1SHc2RFkyMlBGclFJREFRQUJBb0lCQUVsM0lsWk1ITVhmczV5ZwpMTEVwMUExaXkxV2VIcVE1am1Ud3I0QzZYQUMxdHd3VHNFVExtQmxvUTJZSk5uUTZyZ0dTMWVTRVVOYWJDS1N0ClJQZEQxdCtEQ1Avd1pacDVxdWV4eVh2bytRbWpVSjVaMWtyTVhaZnZIaDZJczJaNjM0LzlaUERjUEtYYWVHMS8KMXhwN1lLMGl6TjQ5QXl4amlZSzlGUDM5dklqSzlWOC9WVXFFbUhkUCs1Z2Njd2xMQ0pqZWRQWjJvcUdFKzErNwpXbkkrRzArdU9PV253Um9kOWl2MlVWRlZXVG1vM0lMaXlwUXFQYXYwYnpUdUNSSURtN1QxQitCVXRCaVRkVk50Cno0cHNsTGd3OWx0U0F1MjBGcDJoN3gydEVmMDd3UHF4V2IreGthNmw5VERJem94U085SE5zTXJqS3NGaUhEYmQKbXpmVmo4a0NnWUVBL1JxNUYzcHlyM2VueExMTTl5SzRURkR6aTNrcVJIV2FJVmtFdjdtamhETnU5MjhRbXF0RApaOFRidjVTR3VBWGVuY0EyR1IxcWFaNVFEelI0N01QM0NGOEtiSVpkb2lEZU9QTUxJcDFSaG1iN3dCMnFhSktuClJHOHBzQ3lEajlTbHNPcTlLamNBb1gwWFUvTEo0SUtsK0dRekpqWC9pRVBLS2orNVNhZ204bU1DZ1lFQThaU2kKbFZKRGdXUE5XcTZrbFNZamd0R0lwUC9FdnhGNUgraHVRdURRdHBoK3NyWXA1M0RrOUgwcG92WlFuZWVIb1FTZwpRb3ZUeDROazNvVnBMaDdpdkQ5dkVEQnFKQ1EyTzJ4aWY0SXVIWno5cEdOZXFrbU1TVC9HUldsTlNLYzhqSEJECmJTVTJXTW1YOUVzQndYdkViZnoyVmgvWHcyb1JKNDM5aDF2ZDNLOENnWUJ4M0JXcjFDL0hjOEtMSUF4SW1OdmoKcVA4R25VbEFaczhoZFZSSGs1RlZwWFdqNWRqSVc0Y0ZKVy9kclVrMWU1NTd4TDRSYWtRMm96dE11OFF5YnEydwpuR0NxRllBRnNWZUdzdjh0WVN3TmxFSm9XSEFTZnZhME9IVytoU2ZpQ2oxSGF6SVJ6WkNCRlM3cld1c3FEbHZ2CmM5UDJ1by9ya3VOZFFqRnVTekRLRlFLQmdEWURjcHFLU3hlWjllY3BseGpWN3lpbnFyS2hrUjdiVEVhckZFUVYKdWZTcGdlSjVRa05DQlo3NGdSK3pqUERSUEl6dTJOb29JMUMvZXdVWnRSdWZ3amd1d3FsTytkeGMwRmRXODJybwo4MkNob2tCb0MxbHRtbFVpVWpWZ3h1dlFvSVFSOGJGc21Zc2VmOEFhS1NsV2YrUExwRlE3U0dXanlIUWNsaXYyCmlWTjNBb0dBYmpiRHJKUVZSZDh6TndZSjQ2UkMrWEFNUzBkVnN6eTZ3enIyOHBhdklUYXd2M0ZGOEMxbk9tZ2gKK2cvemZBSXI3bW1idnp2bUdoNENHVEVMM0ZMV2EzUEcwRmlLQmlDayt3RVZURnVodDdjOU05QzMvZVRsTHFacwoyRUp6eGFCUzFEaEQ2VjNmY1VtVjZ2UkVYRHVZZjB3VkY0K3RBeFUxOWNRS1Mrc2lxQVU9Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==
kind: Secret
metadata:
  name: hubble-relay-client-certs
  namespace: kube-system
type: kubernetes.io/tls
---
apiVersion: v1
data:
  ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURFekNDQWZ1Z0F3SUJBZ0lRSlVVd2VOcmJsRFRQYmtIditldTlqakFOQmdrcWhraUc5dzBCQVFzRkFEQVUKTVJJd0VBWURWUVFERXdsRGFXeHBkVzBnUTBFd0hoY05NalV4TWpBMk1UVTBPREEyV2hjTk1qZ3hNakExTVRVMApPREEyV2pBVU1SSXdFQVlEVlFRREV3bERhV3hwZFcwZ1EwRXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCCkR3QXdnZ0VLQW9JQkFRRE84ekVhRDF5NmtFRU1USXo4NDdjQXJXYjJwVlFCcnRJanVld09TWmZETTBNdjAwNHMKWHh6ZWVUVzJaMHFmeEp5Q3QzVG8zRVFjaTlOaWZsRDVFMzQrOEQxV0ZZTDRoZkZwZkZwWXFOQVR4QXUzK0ZmbApLRXAyS0JXQTNza2JQZHkrUUJsK0UyYXF6S3kyRVg2MEdtQjdWc1pjeXc3UWdwemg0Zlo4d1RTU3JEcThXU2twCnhPdmJXbDJFc2hpaXErQ0MvbTEzT3JGelpheGEwT25pbFZ0NUx3aGc3Qk5LTCtVejJTY3lUbTE5RGM3Vy9qRzMKR1l0M2JhamtoZGdqdERDS0dFRmtNS0R1Y0o5VCtCWmFLSVcrMVdmOUwyUjhjZnNqNjNtL3U0a1ZvanZubTFURgprYWhKbGV5YUFzR3N5T3BzK2hLVG5aTXJaQ3QzVGh6QXFleGhBZ01CQUFHallUQmZNQTRHQTFVZER3RUIvd1FFCkF3SUNwREFkQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXcKQXdFQi96QWRCZ05WSFE0RUZnUVVKWGlzVElIWk5LSStwaitTbWtUdFRhL3pkNnN3RFFZSktvWklodmNOQVFFTApCUUFEZ2dFQkFHeEZaYm4vMHovYTRqc3A5aFRRRE1PNGlDWUlhcGlTcWxjM0NmdVBnVWQxWGplaTh4MzJpeTc0CmlOSmFVK1ZSMllCTFVsRURmMDRIcWovOUNMUmE4czQ1ODArNUdNbUJDeFZuMmtnWGpBVi96UHlzb2FlbCtkemYKZTFkdXBzYmVQT3VLTzZnbTRhZHR4RitLWVJMd053VXhJOXdac3Z1ajhaVmVoQTVTTEZJUnB1bWdQeDl3R0dOOQpKdlRqb1hudDZkbFB6UlNlK2pNOTArUWhpcWwxLzZwRUFYaEZ3ZUdMNSsxU0dQUFRqbDc1UEhTT0JIbUw3dXk3CmtwbTZnWGFCUmFJelJqRUVZNTNBNzFFaVRQQlVkbjhWS3pNYzltR0d3aUtXSlFaUjJtYWxwRGI4QUE5Z2lwOUEKWEJFcGZGZ3RUUnlWQlVzNmJBV0xoVlFFcGtid0djbz0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURVekNDQWp1Z0F3SUJBZ0lSQU4vYWdsMjFvV3BTcXg3RUNoN1FVQ2t3RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEkxTVRJd05qRTFORGd3TmxvWERUSTJNVEl3TmpFMQpORGd3Tmxvd0tERW1NQ1FHQTFVRUF3d2RLaTUwWVd4dmN5NW9kV0ppYkdVdFozSndZeTVqYVd4cGRXMHVhVzh3CmdnRWlNQTBHQ1NxR1NJYjNEUUVCQVFVQUE0SUJEd0F3Z2dFS0FvSUJBUUN0SWRSWWJ2eXZndnlTaGY4LzlOaUsKMU1VWkhvamk0ZnVXOXFKZ3hwNnVVN3RWOFJvK1N5V1JtOTZIdzZkT3NXVHg0TmU1Q0tPL3FuMjBXSSs2K1h1eQoxeGQ1VmFyZCtMUDhZdGZCSGxTM1FMQzRVVG1GWE01aHRyRlpkVGdWdDJmSzllYlB2ak9vODdQU0dZMEFuYXJhCm5kZGtYdmhFQWpQZmRORU16SVo0azlod2FFaUZQVVZFN0ZqOEs1WDk5YjdyWXZHbE5Qb2VVYTY4OXhDcVZYQnkKQWd0dER0UUVVL2ZlQ2lsRTZYMFRNUDBySlUvV1BIS2lmTVBqT1RMMC9LUTJ6YzU0OUl2OWpTM3VpOVZWcmVWRgpNeE1lSEF4ajhZL2diV2ZabDQwVXowUjRnVFp0ZmtnK1VRcDFtMkdhRUpYWU1TRE82d2d5b3ZUWDMxYmE5azRwCkFnTUJBQUdqZ1lzd2dZZ3dEZ1lEVlIwUEFRSC9CQVFEQWdXZ01CMEdBMVVkSlFRV01CUUdDQ3NHQVFVRkJ3TUIKQmdnckJnRUZCUWNEQWpBTUJnTlZIUk1CQWY4RUFqQUFNQjhHQTFVZEl3UVlNQmFBRkNWNHJFeUIyVFNpUHFZLwprcHBFN1UydjgzZXJNQ2dHQTFVZEVRUWhNQitDSFNvdWRHRnNiM011YUhWaVlteGxMV2R5Y0dNdVkybHNhWFZ0CkxtbHZNQTBHQ1NxR1NJYjNEUUVCQ3dVQUE0SUJBUUE1OGxuRmk2eStrM2JmMnkvTlpRellPRmV3bnMyTjFmR2oKWVllODNQTXlBa3RnWEFES0lEMWw2YmhUY24zWncxTThFVXhNM0JSVHM2VlFyK3RrZmdqWGprQm9pSHE4eVdVUwpSbWdoSWJSQWI0Q250MDkyZGE4QVhEVnBycUVWNTJ3UmZXdFBXajc1cnozQnA5ZmVabTRuRDM2MkZyalhOZ1pFCno3SkFDWXFvZm9naFdPZ3d4dzR0TVRmdjVyd0VhU1hEMy9GcnBFa2ZvSndiTnlzblVQUkNvM0M3WWlUUzlmMFUKRC9jcFNFcndGUFA1cWh3RWtpaEIvOHVtMTRMRW5kK1huL2tMSzk1Z2NvMGFMS1gzMmxVbUc5eERHQnJMWTZsbQo0YnNHRE5jbmJOc0xlOG1tclRmQlFBQXA2Qk4vRGZaT05WbFYwYlVXZlVDVlBMQkZONGgxCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
  tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBclNIVVdHNzhyNEw4a29YL1AvVFlpdFRGR1I2STR1SDdsdmFpWU1hZXJsTzdWZkVhClBrc2xrWnZlaDhPblRyRms4ZURYdVFpanY2cDl0RmlQdXZsN3N0Y1hlVldxM2Zpei9HTFh3UjVVdDBDd3VGRTUKaFZ6T1liYXhXWFU0RmJkbnl2WG16NzR6cVBPejBobU5BSjJxMnAzWFpGNzRSQUl6MzNUUkRNeUdlSlBZY0doSQpoVDFGUk94WS9DdVYvZlcrNjJMeHBUVDZIbEd1dlBjUXFsVndjZ0lMYlE3VUJGUDMzZ29wUk9sOUV6RDlLeVZQCjFqeHlvbnpENHpreTlQeWtOczNPZVBTTC9ZMHQ3b3ZWVmEzbFJUTVRIaHdNWS9HUDRHMW4yWmVORk05RWVJRTIKYlg1SVBsRUtkWnRobWhDVjJERWd6dXNJTXFMMDE5OVcydlpPS1FJREFRQUJBb0lCQUFPTlFIOHgyVGV5Y3kyOQpNdko2OFdwL1V5R0ZkV29GTUo2QlJHY2plQ3p5eTE3Z1JQckxncmp3TDNtUGNlTzAwczBKL0hoTEJBaVdxaVBOCnJiQ2FGWFZmbUVJUmMxNTlvZHA4VDBvaXArdVgxS0NvdHQvQ01hV0EzWDlQcUFWMis1Q0E3V25WYnVPWGtON1QKeUZCMDY1Y2tqYUNuNDBGTldGeHEwY0Q4bTIvbXZOZDVHT3IrNVdySzFiR1d5U0MweC9lWSs3NFNIaHdSQk1YagpmQzlCbnQvQzd1R0FycXkvdndKL2tCUXlROTFZa2xwclcyaERWMWEvYmtGRGRaTXJGcjNCZVlxUm5oYzZYdEhDCkxDYTdOWjhwTVYwU2ZNUUZod096M01kUXN3UkRQL25KU0hkK29kNjhCODZJSUx0RXVMS2dUbzhaOVlIYnF5d3kKVDZMb1dJa0NnWUVBNW1GTW1EUXRaTGhLOHR2Y2VJR3lpZ2E0Wkxnekg2YVNGY0hNMk40OHNFSHIwYmJBT1B3OApCdVF3YVhGczZROEVKdnJFNEZKblIvZXlsSytUVG1pV2U2TFZhWWtzRHdSK2VEamtNRTdoU1dhRG85QjVQL1M2ClVFRy9Pb1B4UEhjQXhxdWZObHFIODRUQzN0a1pwdENkakZZLzVqUkY1Kzl5OHpXM2Raa29LUHNDZ1lFQXdHSzgKaE11S0R4OXUxc2tlajN1YjRhUERydVBOdURhcTdaRkVRMGV6TVZYempydVlRRHU3Wk9waHhjaWhuVnRmTGhQeApidUZNZVg5Z0NSaThwNXRnNFd3RUQ3dnFtWkthTUZPUFJYZ0JjR0xhN2ZBbGZIQTYzQUtySElra0xPUHF2RDBKCjV0UUxoaGtJVSt6ankxNGdjVVMvYUFRUnNDeDZMYWNQUkhSaWhDc0NnWUVBeDRwbkNUM0lRNERNaWVXYzVGT1MKRExNZGF6K1FLRTNpSWk0bCs0RWlGNWhCWlBkaEx2cHFFNTM1d0pxWnRwTm5DVXdTMGlrTmcrd3JKVldkeFVBWgpkeVRtcSs0LzF4SVJhSmYrTFVsbElHcEdndERDOUg1SUVkT2dpbEpWMUFWUENzVUR0ZFJjQkxSdEJSQU5nOHNWCmFzUVp2STV5TGgzYjlvUUVUenRFNlprQ2dZQUtNSENKbS9vWTZQSkczK29GY1dlRklOWkpXZmxZUzFUc05paG0KWTlMQ3h5bWFJcWRpcDRjNlJndWRuUTJxTnQrb29oZkVacHhWUndEQUdwWkxUamhvVi84ekVpSFB0bXNDS2pySgpWQnpIWmdUd1d5cXhGNFNXaUhHbGxrSGJPc3NBNHo2MkFmOEdRQ2Nud3NFaDBUOW9vRnArMk5CVEExZ0pPUExmCkRrYjFkd0tCZ1FDTzQyVitkdGZ3dWFtaFN3WWUvM1NmdG5Yd3dIV2poL0VxWENnQTVpM0JPRVBHWmFTQk4xVE8KSlBSdUJrZ3I0NjhYV2hRVUZhRU9YekcwRkk5ejJMQzRQcDNYRWJqNzhlcTdGTkR5QXY1aUhYTmxrQUlPdjBUVAp3MDhHR1ZMWWc2bWpRQ1F1V0hKT2E0aUdva1hjOUdyOVIzaVZJTHJBNjEvT1lmV2hlOG52REE9PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=
kind: Secret
metadata:
  name: hubble-server-certs
  namespace: kube-system
type: kubernetes.io/tls
---
apiVersion: v1
kind: Endpoints
metadata:
  annotations:
    io.cilium/lb-ipam-ips: 192.168.0.180
  labels: null
  name: cilium-ingress
  namespace: kube-system
subsets:
- addresses:
  - ip: 192.192.192.192
  ports:
  - port: 9999
---
apiVersion: v1
kind: Service
metadata:
  annotations:
    prometheus.io/port: "9964"
    prometheus.io/scrape: "true"
  labels:
    app.kubernetes.io/name: cilium-envoy
    app.kubernetes.io/part-of: cilium
    io.cilium/app: proxy
    k8s-app: cilium-envoy
  name: cilium-envoy
  namespace: kube-system
spec:
  clusterIP: None
  ports:
  - name: envoy-metrics
    port: 9964
    protocol: TCP
    targetPort: envoy-metrics
  selector:
    k8s-app: cilium-envoy
  type: ClusterIP
---
apiVersion: v1
kind: Service
metadata:
  annotations:
    io.cilium/lb-ipam-ips: 192.168.0.180
  labels:
    app.kubernetes.io/part-of: cilium
    cilium.io/ingress: "true"
  name: cilium-ingress
  namespace: kube-system
spec:
  externalTrafficPolicy: Cluster
  ports:
  - name: http
    port: 80
    protocol: TCP
  - name: https
    port: 443
    protocol: TCP
  type: LoadBalancer
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/name: hubble-peer
    app.kubernetes.io/part-of: cilium
    k8s-app: cilium
  name: hubble-peer
  namespace: kube-system
spec:
  internalTrafficPolicy: Local
  ports:
  - name: peer-service
    port: 443
    protocol: TCP
    targetPort: 4244
  selector:
    k8s-app: cilium
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/name: hubble-relay
    app.kubernetes.io/part-of: cilium
    k8s-app: hubble-relay
  name: hubble-relay
  namespace: kube-system
spec:
  ports:
  - port: 80
    protocol: TCP
    targetPort: grpc
  selector:
    k8s-app: hubble-relay
  type: ClusterIP
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/name: hubble-ui
    app.kubernetes.io/part-of: cilium
    k8s-app: hubble-ui
  name: hubble-ui
  namespace: kube-system
spec:
  ports:
  - name: http
    port: 80
    targetPort: 8081
  selector:
    k8s-app: hubble-ui
  type: ClusterIP
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/name: cilium-operator
    app.kubernetes.io/part-of: cilium
    io.cilium/app: operator
    name: cilium-operator
  name: cilium-operator
  namespace: kube-system
spec:
  replicas: 2
  selector:
    matchLabels:
      io.cilium/app: operator
      name: cilium-operator
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 50%
    type: RollingUpdate
  template:
    metadata:
      annotations:
        cilium.io/cilium-configmap-checksum: a1962ff53b839336718d7f671a045ab8f0b33c379cda555fd50836411d172a5d
        prometheus.io/port: "9963"
        prometheus.io/scrape: "true"
      labels:
        app.kubernetes.io/name: cilium-operator
        app.kubernetes.io/part-of: cilium
        io.cilium/app: operator
        name: cilium-operator
    spec:
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchLabels:
                io.cilium/app: operator
            topologyKey: kubernetes.io/hostname
      automountServiceAccountToken: true
      containers:
      - args:
        - --config-dir=/tmp/cilium/config-map
        - --debug=$(CILIUM_DEBUG)
        command:
        - cilium-operator-generic
        env:
        - name: K8S_NODE_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: spec.nodeName
        - name: CILIUM_K8S_NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        - name: CILIUM_DEBUG
          valueFrom:
            configMapKeyRef:
              key: debug
              name: cilium-config
              optional: true
        - name: KUBERNETES_SERVICE_HOST
          value: localhost
        - name: KUBERNETES_SERVICE_PORT
          value: "7445"
        image: quay.io/cilium/operator-generic:v1.18.3@sha256:b5a0138e1a38e4437c5215257ff4e35373619501f4877dbaf92c89ecfad81797
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
            host: 127.0.0.1
            path: /healthz
            port: 9234
            scheme: HTTP
          initialDelaySeconds: 60
          periodSeconds: 10
          timeoutSeconds: 3
        name: cilium-operator
        ports:
        - containerPort: 9963
          hostPort: 9963
          name: prometheus
          protocol: TCP
        readinessProbe:
          failureThreshold: 5
          httpGet:
            host: 127.0.0.1
            path: /healthz
            port: 9234
            scheme: HTTP
          initialDelaySeconds: 0
          periodSeconds: 5
          timeoutSeconds: 3
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
        terminationMessagePolicy: FallbackToLogsOnError
        volumeMounts:
        - mountPath: /tmp/cilium/config-map
          name: cilium-config-path
          readOnly: true
      hostNetwork: true
      nodeSelector:
        kubernetes.io/os: linux
      priorityClassName: system-cluster-critical
      restartPolicy: Always
      securityContext:
        seccompProfile:
          type: RuntimeDefault
      serviceAccountName: cilium-operator
      tolerations:
      - key: node-role.kubernetes.io/control-plane
        operator: Exists
      - key: node-role.kubernetes.io/master
        operator: Exists
      - key: node.kubernetes.io/not-ready
        operator: Exists
      - key: node.cloudprovider.kubernetes.io/uninitialized
        operator: Exists
      - key: node.cilium.io/agent-not-ready
        operator: Exists
      volumes:
      - configMap:
          name: cilium-config
        name: cilium-config-path
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/name: hubble-relay
    app.kubernetes.io/part-of: cilium
    k8s-app: hubble-relay
  name: hubble-relay
  namespace: kube-system
spec:
  replicas: 1
  selector:
    matchLabels:
      k8s-app: hubble-relay
  strategy:
    rollingUpdate:
      maxUnavailable: 1
    type: RollingUpdate
  template:
    metadata:
      annotations:
        cilium.io/hubble-relay-configmap-checksum: 69f595f2f91fc6f0dc9862ad571cf49ecfde4f5581de95d2512ca3c3d35832c9
      labels:
        app.kubernetes.io/name: hubble-relay
        app.kubernetes.io/part-of: cilium
        k8s-app: hubble-relay
    spec:
      affinity:
        podAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchLabels:
                k8s-app: cilium
            topologyKey: kubernetes.io/hostname
      automountServiceAccountToken: false
      containers:
      - args:
        - serve
        command:
        - hubble-relay
        image: quay.io/cilium/hubble-relay:v1.18.3@sha256:e53e00c47fe4ffb9c086bad0c1c77f23cb968be4385881160683d9e15aa34dc3
        imagePullPolicy: IfNotPresent
        livenessProbe:
          failureThreshold: 12
          grpc:
            port: 4222
          initialDelaySeconds: 10
          periodSeconds: 10
          timeoutSeconds: 10
        name: hubble-relay
        ports:
        - containerPort: 4245
          name: grpc
        readinessProbe:
          grpc:
            port: 4222
          timeoutSeconds: 3
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          runAsGroup: 65532
          runAsNonRoot: true
          runAsUser: 65532
          seccompProfile:
            type: RuntimeDefault
        startupProbe:
          failureThreshold: 20
          grpc:
            port: 4222
          initialDelaySeconds: 10
          periodSeconds: 3
        terminationMessagePolicy: FallbackToLogsOnError
        volumeMounts:
        - mountPath: /etc/hubble-relay
          name: config
          readOnly: true
        - mountPath: /var/lib/hubble-relay/tls
          name: tls
          readOnly: true
      nodeSelector:
        kubernetes.io/os: linux
      priorityClassName: null
      restartPolicy: Always
      securityContext:
        fsGroup: 65532
        seccompProfile:
          type: RuntimeDefault
      serviceAccountName: hubble-relay
      terminationGracePeriodSeconds: 1
      volumes:
      - configMap:
          items:
          - key: config.yaml
            path: config.yaml
          name: hubble-relay-config
        name: config
      - name: tls
        projected:
          defaultMode: 256
          sources:
          - secret:
              items:
              - key: tls.crt
                path: client.crt
              - key: tls.key
                path: client.key
              - key: ca.crt
                path: hubble-server-ca.crt
              name: hubble-relay-client-certs
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/name: hubble-ui
    app.kubernetes.io/part-of: cilium
    k8s-app: hubble-ui
  name: hubble-ui
  namespace: kube-system
spec:
  replicas: 1
  selector:
    matchLabels:
      k8s-app: hubble-ui
  strategy:
    rollingUpdate:
      maxUnavailable: 1
    type: RollingUpdate
  template:
    metadata:
      annotations:
        cilium.io/hubble-ui-nginx-configmap-checksum: 76283720d1bb70050debf51116121fa9a67ebc9d1cd9167c3dd9bdbfb613df37
      labels:
        app.kubernetes.io/name: hubble-ui
        app.kubernetes.io/part-of: cilium
        k8s-app: hubble-ui
    spec:
      automountServiceAccountToken: true
      containers:
      - image: quay.io/cilium/hubble-ui:v0.13.3@sha256:661d5de7050182d495c6497ff0b007a7a1e379648e60830dd68c4d78ae21761d
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
            path: /healthz
            port: 8081
        name: frontend
        ports:
        - containerPort: 8081
          name: http
        readinessProbe:
          httpGet:
            path: /
            port: 8081
        securityContext:
          allowPrivilegeEscalation: false
        terminationMessagePolicy: FallbackToLogsOnError
        volumeMounts:
        - mountPath: /etc/nginx/conf.d/default.conf
          name: hubble-ui-nginx-conf
          subPath: nginx.conf
        - mountPath: /tmp
          name: tmp-dir
      - env:
        - name: EVENTS_SERVER_PORT
          value: "8090"
        - name: FLOWS_API_ADDR
          value: hubble-relay:80
        image: quay.io/cilium/hubble-ui-backend:v0.13.3@sha256:db1454e45dc39ca41fbf7cad31eec95d99e5b9949c39daaad0fa81ef29d56953
        imagePullPolicy: IfNotPresent
        name: backend
        ports:
        - containerPort: 8090
          name: grpc
        securityContext:
          allowPrivilegeEscalation: false
        terminationMessagePolicy: FallbackToLogsOnError
        volumeMounts: null
      nodeSelector:
        kubernetes.io/os: linux
      priorityClassName: null
      securityContext:
        fsGroup: 1001
        runAsGroup: 1001
        runAsUser: 1001
      serviceAccountName: hubble-ui
      volumes:
      - configMap:
          defaultMode: 420
          name: hubble-ui-nginx
        name: hubble-ui-nginx-conf
      - emptyDir: {}
        name: tmp-dir
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  labels:
    app.kubernetes.io/name: cilium-agent
    app.kubernetes.io/part-of: cilium
    k8s-app: cilium
  name: cilium
  namespace: kube-system
spec:
  selector:
    matchLabels:
      k8s-app: cilium
  template:
    metadata:
      annotations:
        cilium.io/cilium-configmap-checksum: a1962ff53b839336718d7f671a045ab8f0b33c379cda555fd50836411d172a5d
        kubectl.kubernetes.io/default-container: cilium-agent
      labels:
        app.kubernetes.io/name: cilium-agent
        app.kubernetes.io/part-of: cilium
        k8s-app: cilium
    spec:
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchLabels:
                k8s-app: cilium
            topologyKey: kubernetes.io/hostname
      automountServiceAccountToken: true
      containers:
      - args:
        - --config-dir=/tmp/cilium/config-map
        command:
        - cilium-agent
        env:
        - name: K8S_NODE_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: spec.nodeName
        - name: CILIUM_K8S_NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        - name: CILIUM_CLUSTERMESH_CONFIG
          value: /var/lib/cilium/clustermesh/
        - name: GOMEMLIMIT
          valueFrom:
            resourceFieldRef:
              divisor: "1"
              resource: limits.memory
        - name: KUBERNETES_SERVICE_HOST
          value: localhost
        - name: KUBERNETES_SERVICE_PORT
          value: "7445"
        - name: KUBE_CLIENT_BACKOFF_BASE
          value: "1"
        - name: KUBE_CLIENT_BACKOFF_DURATION
          value: "120"
        image: quay.io/cilium/cilium:v1.18.3@sha256:5649db451c88d928ea585514746d50d91e6210801b300c897283ea319d68de15
        imagePullPolicy: IfNotPresent
        lifecycle:
          postStart:
            exec:
              command:
              - bash
              - -c
              - |
                set -o errexit
                set -o pipefail
                set -o nounset

                # When running in AWS ENI mode, it's likely that 'aws-node' has
                # had a chance to install SNAT iptables rules. These can result
                # in dropped traffic, so we should attempt to remove them.
                # We do it using a 'postStart' hook since this may need to run
                # for nodes which might have already been init'ed but may still
                # have dangling rules. This is safe because there are no
                # dependencies on anything that is part of the startup script
                # itself, and can be safely run multiple times per node (e.g. in
                # case of a restart).
                if [[ "$(iptables-save | grep -E -c 'AWS-SNAT-CHAIN|AWS-CONNMARK-CHAIN')" != "0" ]];
                then
                    echo 'Deleting iptables rules created by the AWS CNI VPC plugin'
                    iptables-save | grep -E -v 'AWS-SNAT-CHAIN|AWS-CONNMARK-CHAIN' | iptables-restore
                fi
                echo 'Done!'
          preStop:
            exec:
              command:
              - /cni-uninstall.sh
        livenessProbe:
          failureThreshold: 10
          httpGet:
            host: 127.0.0.1
            httpHeaders:
            - name: brief
              value: "true"
            - name: require-k8s-connectivity
              value: "false"
            path: /healthz
            port: 9879
            scheme: HTTP
          periodSeconds: 30
          successThreshold: 1
          timeoutSeconds: 5
        name: cilium-agent
        readinessProbe:
          failureThreshold: 3
          httpGet:
            host: 127.0.0.1
            httpHeaders:
            - name: brief
              value: "true"
            path: /healthz
            port: 9879
            scheme: HTTP
          periodSeconds: 30
          successThreshold: 1
          timeoutSeconds: 5
        securityContext:
          capabilities:
            add:
            - CHOWN
            - KILL
            - NET_ADMIN
            - NET_RAW
            - IPC_LOCK
            - SYS_ADMIN
            - SYS_RESOURCE
            - DAC_OVERRIDE
            - FOWNER
            - SETGID
            - SETUID
            drop:
            - ALL
          seLinuxOptions:
            level: s0
            type: spc_t
        startupProbe:
          failureThreshold: 300
          httpGet:
            host: 127.0.0.1
            httpHeaders:
            - name: brief
              value: "true"
            path: /healthz
            port: 9879
            scheme: HTTP
          initialDelaySeconds: 5
          periodSeconds: 2
          successThreshold: 1
        terminationMessagePolicy: FallbackToLogsOnError
        volumeMounts:
        - mountPath: /var/run/cilium/envoy/sockets
          name: envoy-sockets
          readOnly: false
        - mountPath: /host/proc/sys/net
          name: host-proc-sys-net
        - mountPath: /host/proc/sys/kernel
          name: host-proc-sys-kernel
        - mountPath: /sys/fs/bpf
          mountPropagation: HostToContainer
          name: bpf-maps
        - mountPath: /sys/fs/cgroup
          name: cilium-cgroup
        - mountPath: /var/run/cilium
          name: cilium-run
        - mountPath: /var/run/cilium/netns
          mountPropagation: HostToContainer
          name: cilium-netns
        - mountPath: /host/etc/cni/net.d
          name: etc-cni-netd
        - mountPath: /var/lib/cilium/clustermesh
          name: clustermesh-secrets
          readOnly: true
        - mountPath: /lib/modules
          name: lib-modules
          readOnly: true
        - mountPath: /run/xtables.lock
          name: xtables-lock
        - mountPath: /var/lib/cilium/tls/hubble
          name: hubble-tls
          readOnly: true
        - mountPath: /tmp
          name: tmp
      hostNetwork: true
      initContainers:
      - command:
        - cilium-dbg
        - build-config
        env:
        - name: K8S_NODE_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: spec.nodeName
        - name: CILIUM_K8S_NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        - name: KUBERNETES_SERVICE_HOST
          value: localhost
        - name: KUBERNETES_SERVICE_PORT
          value: "7445"
        image: quay.io/cilium/cilium:v1.18.3@sha256:5649db451c88d928ea585514746d50d91e6210801b300c897283ea319d68de15
        imagePullPolicy: IfNotPresent
        name: config
        terminationMessagePolicy: FallbackToLogsOnError
        volumeMounts:
        - mountPath: /tmp
          name: tmp
      - command:
        - sh
        - -ec
        - |
          cp /usr/bin/cilium-sysctlfix /hostbin/cilium-sysctlfix;
          nsenter --mount=/hostproc/1/ns/mnt "${BIN_PATH}/cilium-sysctlfix";
          rm /hostbin/cilium-sysctlfix
        env:
        - name: BIN_PATH
          value: /opt/cni/bin
        image: quay.io/cilium/cilium:v1.18.3@sha256:5649db451c88d928ea585514746d50d91e6210801b300c897283ea319d68de15
        imagePullPolicy: IfNotPresent
        name: apply-sysctl-overwrites
        securityContext:
          capabilities:
            add:
            - SYS_ADMIN
            - SYS_CHROOT
            - SYS_PTRACE
            drop:
            - ALL
          seLinuxOptions:
            level: s0
            type: spc_t
        terminationMessagePolicy: FallbackToLogsOnError
        volumeMounts:
        - mountPath: /hostproc
          name: hostproc
        - mountPath: /hostbin
          name: cni-path
      - args:
        - mount | grep "/sys/fs/bpf type bpf" || mount -t bpf bpf /sys/fs/bpf
        command:
        - /bin/bash
        - -c
        - --
        image: quay.io/cilium/cilium:v1.18.3@sha256:5649db451c88d928ea585514746d50d91e6210801b300c897283ea319d68de15
        imagePullPolicy: IfNotPresent
        name: mount-bpf-fs
        securityContext:
          privileged: true
        terminationMessagePolicy: FallbackToLogsOnError
        volumeMounts:
        - mountPath: /sys/fs/bpf
          mountPropagation: Bidirectional
          name: bpf-maps
      - command:
        - /init-container.sh
        env:
        - name: CILIUM_ALL_STATE
          valueFrom:
            configMapKeyRef:
              key: clean-cilium-state
              name: cilium-config
              optional: true
        - name: CILIUM_BPF_STATE
          valueFrom:
            configMapKeyRef:
              key: clean-cilium-bpf-state
              name: cilium-config
              optional: true
        - name: WRITE_CNI_CONF_WHEN_READY
          valueFrom:
            configMapKeyRef:
              key: write-cni-conf-when-ready
              name: cilium-config
              optional: true
        - name: KUBERNETES_SERVICE_HOST
          value: localhost
        - name: KUBERNETES_SERVICE_PORT
          value: "7445"
        image: quay.io/cilium/cilium:v1.18.3@sha256:5649db451c88d928ea585514746d50d91e6210801b300c897283ea319d68de15
        imagePullPolicy: IfNotPresent
        name: clean-cilium-state
        securityContext:
          capabilities:
            add:
            - NET_ADMIN
            - SYS_ADMIN
            - SYS_RESOURCE
            drop:
            - ALL
          seLinuxOptions:
            level: s0
            type: spc_t
        terminationMessagePolicy: FallbackToLogsOnError
        volumeMounts:
        - mountPath: /sys/fs/bpf
          name: bpf-maps
        - mountPath: /sys/fs/cgroup
          mountPropagation: HostToContainer
          name: cilium-cgroup
        - mountPath: /var/run/cilium
          name: cilium-run
      - command:
        - /install-plugin.sh
        image: quay.io/cilium/cilium:v1.18.3@sha256:5649db451c88d928ea585514746d50d91e6210801b300c897283ea319d68de15
        imagePullPolicy: IfNotPresent
        name: install-cni-binaries
        resources:
          requests:
            cpu: 100m
            memory: 10Mi
        securityContext:
          capabilities:
            drop:
            - ALL
          seLinuxOptions:
            level: s0
            type: spc_t
        terminationMessagePolicy: FallbackToLogsOnError
        volumeMounts:
        - mountPath: /host/opt/cni/bin
          name: cni-path
      nodeSelector:
        kubernetes.io/os: linux
      priorityClassName: system-node-critical
      restartPolicy: Always
      securityContext:
        appArmorProfile:
          type: Unconfined
        seccompProfile:
          type: Unconfined
      serviceAccountName: cilium
      terminationGracePeriodSeconds: 1
      tolerations:
      - operator: Exists
      volumes:
      - emptyDir: {}
        name: tmp
      - hostPath:
          path: /var/run/cilium
          type: DirectoryOrCreate
        name: cilium-run
      - hostPath:
          path: /var/run/netns
          type: DirectoryOrCreate
        name: cilium-netns
      - hostPath:
          path: /sys/fs/bpf
          type: DirectoryOrCreate
        name: bpf-maps
      - hostPath:
          path: /proc
          type: Directory
        name: hostproc
      - hostPath:
          path: /sys/fs/cgroup
          type: DirectoryOrCreate
        name: cilium-cgroup
      - hostPath:
          path: /opt/cni/bin
          type: DirectoryOrCreate
        name: cni-path
      - hostPath:
          path: /etc/cni/net.d
          type: DirectoryOrCreate
        name: etc-cni-netd
      - hostPath:
          path: /lib/modules
        name: lib-modules
      - hostPath:
          path: /run/xtables.lock
          type: FileOrCreate
        name: xtables-lock
      - hostPath:
          path: /var/run/cilium/envoy/sockets
          type: DirectoryOrCreate
        name: envoy-sockets
      - name: clustermesh-secrets
        projected:
          defaultMode: 256
          sources:
          - secret:
              name: cilium-clustermesh
              optional: true
          - secret:
              items:
              - key: tls.key
                path: common-etcd-client.key
              - key: tls.crt
                path: common-etcd-client.crt
              - key: ca.crt
                path: common-etcd-client-ca.crt
              name: clustermesh-apiserver-remote-cert
              optional: true
          - secret:
              items:
              - key: tls.key
                path: local-etcd-client.key
              - key: tls.crt
                path: local-etcd-client.crt
              - key: ca.crt
                path: local-etcd-client-ca.crt
              name: clustermesh-apiserver-local-cert
              optional: true
      - hostPath:
          path: /proc/sys/net
          type: Directory
        name: host-proc-sys-net
      - hostPath:
          path: /proc/sys/kernel
          type: Directory
        name: host-proc-sys-kernel
      - name: hubble-tls
        projected:
          defaultMode: 256
          sources:
          - secret:
              items:
              - key: tls.crt
                path: server.crt
              - key: tls.key
                path: server.key
              - key: ca.crt
                path: client-ca.crt
              name: hubble-server-certs
              optional: true
  updateStrategy:
    rollingUpdate:
      maxUnavailable: 2
    type: RollingUpdate
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  labels:
    app.kubernetes.io/name: cilium-envoy
    app.kubernetes.io/part-of: cilium
    k8s-app: cilium-envoy
    name: cilium-envoy
  name: cilium-envoy
  namespace: kube-system
spec:
  selector:
    matchLabels:
      k8s-app: cilium-envoy
  template:
    metadata:
      annotations: null
      labels:
        app.kubernetes.io/name: cilium-envoy
        app.kubernetes.io/part-of: cilium
        k8s-app: cilium-envoy
        name: cilium-envoy
    spec:
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: cilium.io/no-schedule
                operator: NotIn
                values:
                - "true"
        podAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchLabels:
                k8s-app: cilium
            topologyKey: kubernetes.io/hostname
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchLabels:
                k8s-app: cilium-envoy
            topologyKey: kubernetes.io/hostname
      automountServiceAccountToken: true
      containers:
      - args:
        - --keep-cap-net-bind-service
        - --
        - -c /var/run/cilium/envoy/bootstrap-config.json
        - --base-id 0
        - --log-level info
        command:
        - /usr/bin/cilium-envoy-starter
        env:
        - name: K8S_NODE_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: spec.nodeName
        - name: CILIUM_K8S_NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        - name: KUBERNETES_SERVICE_HOST
          value: localhost
        - name: KUBERNETES_SERVICE_PORT
          value: "7445"
        image: quay.io/cilium/cilium-envoy:v1.34.10-1761014632-c360e8557eb41011dfb5210f8fb53fed6c0b3222@sha256:ca76eb4e9812d114c7f43215a742c00b8bf41200992af0d21b5561d46156fd15
        imagePullPolicy: IfNotPresent
        livenessProbe:
          failureThreshold: 10
          httpGet:
            host: 127.0.0.1
            path: /healthz
            port: 9878
            scheme: HTTP
          periodSeconds: 30
          successThreshold: 1
          timeoutSeconds: 5
        name: cilium-envoy
        ports:
        - containerPort: 9964
          hostPort: 9964
          name: envoy-metrics
          protocol: TCP
        readinessProbe:
          failureThreshold: 3
          httpGet:
            host: 127.0.0.1
            path: /healthz
            port: 9878
            scheme: HTTP
          periodSeconds: 30
          successThreshold: 1
          timeoutSeconds: 5
        securityContext:
          capabilities:
            add:
            - NET_ADMIN
            - PERFMON
            - BPF
            drop:
            - ALL
          seLinuxOptions:
            level: s0
            type: spc_t
        startupProbe:
          failureThreshold: 105
          httpGet:
            host: 127.0.0.1
            path: /healthz
            port: 9878
            scheme: HTTP
          initialDelaySeconds: 5
          periodSeconds: 2
          successThreshold: 1
        terminationMessagePolicy: FallbackToLogsOnError
        volumeMounts:
        - mountPath: /var/run/cilium/envoy/sockets
          name: envoy-sockets
          readOnly: false
        - mountPath: /var/run/cilium/envoy/artifacts
          name: envoy-artifacts
          readOnly: true
        - mountPath: /var/run/cilium/envoy/
          name: envoy-config
          readOnly: true
        - mountPath: /sys/fs/bpf
          mountPropagation: HostToContainer
          name: bpf-maps
      hostNetwork: true
      nodeSelector:
        kubernetes.io/os: linux
      priorityClassName: system-node-critical
      restartPolicy: Always
      securityContext:
        appArmorProfile:
          type: Unconfined
      serviceAccountName: cilium-envoy
      terminationGracePeriodSeconds: 1
      tolerations:
      - operator: Exists
      volumes:
      - hostPath:
          path: /var/run/cilium/envoy/sockets
          type: DirectoryOrCreate
        name: envoy-sockets
      - hostPath:
          path: /var/run/cilium/envoy/artifacts
          type: DirectoryOrCreate
        name: envoy-artifacts
      - configMap:
          defaultMode: 256
          items:
          - key: bootstrap-config.json
            path: bootstrap-config.json
          name: cilium-envoy-config
        name: envoy-config
      - hostPath:
          path: /sys/fs/bpf
          type: DirectoryOrCreate
        name: bpf-maps
  updateStrategy:
    rollingUpdate:
      maxUnavailable: 2
    type: RollingUpdate
---
apiVersion: cilium.io/v2alpha1
kind: CiliumL2AnnouncementPolicy
metadata:
  name: default-l2-announcement-policy
  namespace: kube-system
spec:
  externalIPs: true
  loadBalancerIPs: true
---
apiVersion: cilium.io/v2alpha1
kind: CiliumLoadBalancerIPPool
metadata:
  name: ip-pool
spec:
  blocks:
  - start: 192.168.0.129
    stop: 192.168.0.190
---
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: cilium
spec:
  controllerName: io.cilium/gateway-controller
---
apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata:
  annotations:
    ingressclass.kubernetes.io/is-default-class: "true"
  name: cilium
spec:
  controller: cilium.io/ingress-controller