chore(cilium): bump to v1.19.3 - #2464
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✅ Files skipped from review due to trivial changes (1)
📝 WalkthroughWalkthroughThis pull request upgrades the Cilium Helm chart from version 1.19.1 to 1.19.3, introducing ztunnel-based encryption support with new DaemonSet, ServiceAccount, and Secret templates. It adds configDriftDetection and endpointPolicyUpdateTimeoutDuration configuration options, updates container images across multiple components, modifies init container shells from sh to bash, grants additional RBAC permissions for ServiceImport finalizers, and extends the Envoy bootstrap configuration with cluster circuit breakers. Changes
Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes Possibly related PRs
Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request performs a routine maintenance update of the Cilium networking stack to the latest stable patch release. The primary driver for this change is to incorporate critical upstream fixes for Gateway API compatibility, ensuring robust certificate management within the cluster. The update also refreshes the underlying chart definitions and configuration templates to align with the latest upstream release. Highlights
🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Ignored Files
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on Gemini (@gemini-code-assist) comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
There was a problem hiding this comment.
Code Review
This pull request updates the Cilium version from v1.19.1 to v1.19.3 in the Dockerfile and updates the image tag and digest in the values.yaml file. Feedback indicates that the image digest should not be manually updated as per the style guide, and the image tag should use a specific version instead of 'latest' to maintain consistency with the Dockerfile.
| tag: 1.19.1 | ||
| digest: "sha256:ab3acf270821df4614a8456348a4e0d3098aed72a4b2016a0edfa30d91428c3d" | ||
| tag: latest | ||
| digest: "sha256:8f5ab52982fc848ee098ff89919e3528aa8f3a553b82106a25149dcd0b87ea7e" |
There was a problem hiding this comment.
Manual updates to the image digest are discouraged. According to the repository style guide (line 31), this field should be set by CI via make image rather than being manually edited. This is listed under the Critical Rules section of the project guidelines.
References
- Image digest values in values.yaml should be set by CI via make image, not by humans. (link)
There was a problem hiding this comment.
Thanks for the flag. The digest here was generated by make -C packages/system/cilium image, not hand-edited — see the second commit chore(cilium): refresh image digest for v1.19.3. The Makefile image target pushes the freshly built image to ghcr.io/cozystack/cozystack/cilium and then runs yq -i on values.yaml to populate repository, tag, and digest from the build metadata. That matches the "generated by build" clause in docs/agents/overview.md:101.
| repository: ghcr.io/cozystack/cozystack/cilium | ||
| tag: 1.19.1 | ||
| digest: "sha256:ab3acf270821df4614a8456348a4e0d3098aed72a4b2016a0edfa30d91428c3d" | ||
| tag: latest |
There was a problem hiding this comment.
It is recommended to use a specific version tag (e.g., 1.19.3) instead of latest to maintain consistency with the version defined in the Dockerfile and to improve traceability of the image being used.
tag: 1.19.3There was a problem hiding this comment.
This follows the prior Cilium bump commit 181356c (v1.19.0), which also set tag: latest + a concrete digest. The latest value is emitted by settag in hack/common-envs.mk when make image runs on a commit that has no matching v* git tag. The effective image is pinned by digest (chart default useDigest=true), so there is no runtime ambiguity — the 1.19.3 digest is what actually gets pulled. On the next release-tag CI run, make build rebuilds with TAG=vX.Y.Z and overwrites tag: with the concrete version — same pattern the repo has used for every previous Cilium bump.
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@packages/system/cilium/charts/cilium/templates/ztunnel/secret.yaml`:
- Around line 20-21: The template is double-encoding the bootstrap certificate:
remove the Helm b64enc call so the data key "bootstrap-root.crt" uses the
pre-Base64-encoded value provided in
.Values.encryption.ztunnel.secrets.bootstrapRootCert (i.e., stop wrapping with
b64enc), or alternatively update the README to require raw PEM if you prefer to
keep b64enc; implement the first option by editing the ztunnel secret template
to reference .Values.encryption.ztunnel.secrets.bootstrapRootCert directly
instead of calling b64enc so the mounted certificate is valid.
In `@packages/system/cilium/charts/cilium/values.yaml.tmpl`:
- Around line 1177-1190: The ztunnel image block currently hardcodes
repository/tag/digest and disables digests; update the ztunnel image block (the
image: override/repository/tag/digest/useDigest fields) to use the standard
template variables so mirroring and digest-pinning work: set repository to
"${ZTUNNEL_REPO}", tag to "${ZTUNNEL_VERSION}", digest to "${ZTUNNEL_DIGEST}"
and useDigest to ${USE_DIGESTS}; also ensure these ZTUNNEL_* variables are wired
into the same build metadata location where other Cilium component variables
(e.g., ${REPO_NAME}, ${REPO_NAME_VERSION}, ${REPO_NAME_DIGEST}) are defined so
private-registry and air-gapped installs work when encryption.type=ztunnel.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 94de6f63-560d-4c51-acac-511c1fe9fa9b
📒 Files selected for processing (14)
packages/system/cilium/charts/cilium/Chart.yamlpackages/system/cilium/charts/cilium/README.mdpackages/system/cilium/charts/cilium/files/cilium-envoy/configmap/bootstrap-config.yamlpackages/system/cilium/charts/cilium/templates/cilium-agent/daemonset.yamlpackages/system/cilium/charts/cilium/templates/cilium-configmap.yamlpackages/system/cilium/charts/cilium/templates/cilium-operator/clusterrole.yamlpackages/system/cilium/charts/cilium/templates/ztunnel/daemonset.yamlpackages/system/cilium/charts/cilium/templates/ztunnel/secret.yamlpackages/system/cilium/charts/cilium/templates/ztunnel/serviceaccount.yamlpackages/system/cilium/charts/cilium/values.schema.jsonpackages/system/cilium/charts/cilium/values.yamlpackages/system/cilium/charts/cilium/values.yaml.tmplpackages/system/cilium/images/cilium/Dockerfilepackages/system/cilium/values.yaml
| data: | ||
| bootstrap-root.crt: {{ .Values.encryption.ztunnel.secrets.bootstrapRootCert | b64enc }} |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Find all bootstrapRootCert references and verify whether the value is documented
# as base64-encoded while also being piped through b64enc in the Secret template.
rg -n -C3 'bootstrapRootCert|bootstrap-root\.crt|b64enc'Repository: cozystack/cozystack
Length of output: 50375
🏁 Script executed:
#!/bin/bash
# Locate cilium secret files and check bootstrapRootCert references
find . -path "*cilium*" -name "secret.yaml" -o -path "*cilium*" -name "README.md" | head -20Repository: cozystack/cozystack
Length of output: 257
🏁 Script executed:
#!/bin/bash
# Search specifically for bootstrapRootCert references in cilium
rg -l "bootstrapRootCert" --type yaml | grep ciliumRepository: cozystack/cozystack
Length of output: 178
🏁 Script executed:
#!/bin/bash
# Get the cilium secret.yaml file if it exists and show line count
if [ -f "packages/system/cilium/charts/cilium/templates/ztunnel/secret.yaml" ]; then
wc -l "packages/system/cilium/charts/cilium/templates/ztunnel/secret.yaml"
echo "---"
cat -n "packages/system/cilium/charts/cilium/templates/ztunnel/secret.yaml"
fiRepository: cozystack/cozystack
Length of output: 980
🏁 Script executed:
#!/bin/bash
# Check cilium README for bootstrapRootCert documentation around line 423
if [ -f "packages/system/cilium/charts/cilium/README.md" ]; then
wc -l "packages/system/cilium/charts/cilium/README.md"
fiRepository: cozystack/cozystack
Length of output: 114
🏁 Script executed:
#!/bin/bash
# Search for bootstrapRootCert in the README
rg -n -B2 -A2 "bootstrapRootCert" packages/system/cilium/charts/cilium/README.mdRepository: cozystack/cozystack
Length of output: 2579
🏁 Script executed:
#!/bin/bash
# Check values.yaml for encryption.ztunnel.secrets.bootstrapRootCert
rg -n -B3 -A3 "bootstrapRootCert" packages/system/cilium/charts/cilium/values.yamlRepository: cozystack/cozystack
Length of output: 295
Remove double-encoding of bootstrap certificate.
Line 21 encodes bootstrapRootCert with b64enc, but README line 423 documents this value as already "Base64-encoded bootstrap root certificate content." Users following the documented contract will provide pre-encoded data, resulting in double-encoding and an invalid certificate mounted to ztunnel.
Fix: Use the pre-encoded value directly
data:
- bootstrap-root.crt: {{ .Values.encryption.ztunnel.secrets.bootstrapRootCert | b64enc }}
+ bootstrap-root.crt: {{ .Values.encryption.ztunnel.secrets.bootstrapRootCert | quote }}Either document the value as raw PEM content (no base64), or remove b64enc from the template to accept pre-encoded input as currently specified.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| data: | |
| bootstrap-root.crt: {{ .Values.encryption.ztunnel.secrets.bootstrapRootCert | b64enc }} | |
| data: | |
| bootstrap-root.crt: {{ .Values.encryption.ztunnel.secrets.bootstrapRootCert | quote }} |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@packages/system/cilium/charts/cilium/templates/ztunnel/secret.yaml` around
lines 20 - 21, The template is double-encoding the bootstrap certificate: remove
the Helm b64enc call so the data key "bootstrap-root.crt" uses the
pre-Base64-encoded value provided in
.Values.encryption.ztunnel.secrets.bootstrapRootCert (i.e., stop wrapping with
b64enc), or alternatively update the README to require raw PEM if you prefer to
keep b64enc; implement the first option by editing the ztunnel secret template
to reference .Values.encryption.ztunnel.secrets.bootstrapRootCert directly
instead of calling b64enc so the mounted certificate is valid.
There was a problem hiding this comment.
This file is part of the upstream Cilium Helm chart, vendored into packages/system/cilium/charts/cilium/ by make update (see packages/system/cilium/Makefile). Cozystack does not modify vendored upstream templates — per docs/agents/overview.md:100 ("Do not edit upstream charts in packages/*/charts/ directly"), bugs in vendored code should be reported at github.com/cilium/cilium, not patched locally. The ztunnel feature is also not enabled in Cozystack (encryption.type is never set to ztunnel in any values file), so this template is not rendered in practice. If the double-encoding concern is real, please file it upstream.
There was a problem hiding this comment.
@lexfrei, understood — thank you for the clarification. This is vendored upstream Cilium code and should not be patched locally. I'll withdraw the concern. If the double-encoding behaviour is a real issue, it would be worth raising at https://github.com/cilium/cilium.
✏️ Learnings added
Learnt from: lexfrei
Repo: cozystack/cozystack PR: 2464
File: packages/system/cilium/charts/cilium/templates/ztunnel/secret.yaml:20-21
Timestamp: 2026-04-23T11:10:31.546Z
Learning: In the cozystack/cozystack repository, the `packages/system/cilium/charts/cilium/` directory contains the vendored upstream Cilium Helm chart, refreshed via `make update` in `packages/system/cilium/Makefile`. Cozystack does not modify these vendored templates directly. Issues found in those templates should be reported upstream at https://github.com/cilium/cilium, not patched locally. Additionally, the ztunnel encryption feature (`encryption.type=ztunnel`) is not enabled in Cozystack's own values files, so the ztunnel templates are not rendered in practice. Do not flag issues in `packages/system/cilium/charts/` as actionable for this repository.
Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.
🧠 Learnings used
Learnt from: sircthulhu
Repo: cozystack/cozystack PR: 2247
File: packages/apps/postgres/templates/init-script.yaml:70-82
Timestamp: 2026-03-25T07:20:03.991Z
Learning: In the cozystack/cozystack repository, database and role name identifiers in `packages/apps/postgres/templates/init-script.yaml` are sourced from Helm values map keys. Helm values keys cannot contain spaces or special characters, so shell word-splitting on these identifiers (e.g. iterating `for db in $MANAGED_DBS`) is safe in practice. The existing user deletion code in the same file uses the identical pattern. Do not flag this as a critical bug; at most note it as a low-priority hardening opportunity for a follow-up.
Learnt from: mattia-eleuteri
Repo: cozystack/cozystack PR: 1988
File: packages/extra/external-dns/templates/external-dns.yaml:22-31
Timestamp: 2026-02-12T11:03:15.183Z
Learning: In the cozystack/cozystack repository, `valuesFrom` is not correctly supported with Cozystack's HelmRelease implementation. Inline credential values in HelmRelease specs are the expected pattern, and suggestions to move credentials to `valuesFrom` with Secret references should be avoided.
Learnt from: myasnikovdaniil
Repo: cozystack/cozystack PR: 2070
File: packages/system/cert-manager/charts/cert-manager/values.schema.json:727-729
Timestamp: 2026-02-26T14:46:54.219Z
Learning: The `packages/system/cert-manager/charts/` directory contains vendored upstream cert-manager Helm charts. These vendored charts should not be modified directly. Issues with the vendored cert-manager charts should be reported upstream at https://github.com/cert-manager/cert-manager.
Learnt from: mattia-eleuteri
Repo: cozystack/cozystack PR: 2095
File: packages/apps/kubernetes/templates/helmreleases/csi.yaml:30-42
Timestamp: 2026-02-24T18:01:11.514Z
Learning: In the cozystack/cozystack repository, Helm templates under `packages/apps/kubernetes/templates/` are only rendered by FluxCD against live clusters (not via `helm template`). The established convention is to directly access `(lookup "..." "" "" "").items` without nil guards. This pattern is used consistently across multiple templates (e.g., linstor-scheduler/_helpers.tpl, cluster.yaml, driver-config.yaml, helmreleases/csi.yaml), so adding defensive checks would be inconsistent with the codebase style.
<!-- [/add_learning]
Learnt from: lexfrei
Repo: cozystack/cozystack PR: 2073
File: packages/system/kamaji/charts/kamaji/templates/kubeconfiggenerator-deployment.yaml:11-21
Timestamp: 2026-02-19T13:25:34.652Z
Learning: The `packages/system/kamaji/charts/` directory in the cozystack/cozystack repository contains vendored upstream Kamaji Helm charts fetched via `make -C packages/system/kamaji update`. The team does not modify vendored charts directly; patches only go into `images/kamaji/patches/` for the Go binary. Issues with the vendored charts should be reported upstream at https://github.com/clastix/kamaji.
Learnt from: lexfrei
Repo: cozystack/cozystack PR: 2010
File: packages/core/installer/values.yaml:10-26
Timestamp: 2026-02-10T10:44:34.963Z
Learning: In the cozystack/cozystack repository, the Makefile uses `helm template -s` to selectively render templates for different modes (talos, generic, hosted). Because Helm evaluates all templates regardless of `-s` filtering, using `required` checks in mode-specific templates (e.g., generic-mode templates) would break the build for other modes. Therefore, avoid suggesting `required` validation for mode-specific values in Helm templates in this repository.
Learnt from: sircthulhu
Repo: cozystack/cozystack PR: 2068
File: packages/system/cozystack-basics/templates/tenant-root.yaml:7-11
Timestamp: 2026-02-18T15:45:24.589Z
Learning: In the cozystack/cozystack repository, for the tenant-root HelmRelease in `packages/system/cozystack-basics/templates/tenant-root.yaml`, users are only supposed to modify the `values` field, not `valuesFrom`. Therefore, preserving only `spec.values` during reconciliation is sufficient and intentional.
Learnt from: lexfrei
Repo: cozystack/cozystack PR: 2073
File: packages/system/kamaji/charts/kamaji-crds/Makefile:1-9
Timestamp: 2026-02-19T13:25:34.837Z
Learning: The directory `packages/system/kamaji/charts/` in cozystack/cozystack contains vendored upstream Kamaji Helm charts fetched via `make -C packages/system/kamaji update`. These vendored charts should not be modified directly. Issues with these charts should be reported upstream at https://github.com/clastix/kamaji. Patches for the Kamaji Go binary go into `images/kamaji/patches/` only.
Learnt from: lexfrei
Repo: cozystack/cozystack PR: 2073
File: packages/system/kamaji/charts/kamaji/templates/kubeconfiggenerator-deployment.yaml:25-25
Timestamp: 2026-02-19T13:25:26.984Z
Learning: The `packages/system/kamaji/charts/` directory in the cozystack/cozystack repository contains vendored upstream Kamaji Helm charts fetched via `make -C packages/system/kamaji update`. These charts should not be modified directly. Patches for Kamaji go into `images/kamaji/patches/` for the Go binary only. Issues in the vendored charts should be reported upstream at https://github.com/clastix/kamaji.
Learnt from: lllamnyp
Repo: cozystack/cozystack PR: 2330
File: packages/system/cozystack-scheduler/tests/configmap_test.yaml:3-4
Timestamp: 2026-04-06T11:48:18.106Z
Learning: In cozystack/cozystack, helm-unittest test suite `templates:` paths for subcharts use the subchart's alias (as defined in the parent Chart.yaml `dependencies[].alias`), not the actual directory name under `charts/`. For example, a subchart in `charts/cozystack-scheduler/` aliased as `cozy-cozystack-scheduler` should be referenced as `charts/cozy-cozystack-scheduler/templates/...` in test files. Do not flag these paths as incorrect.
Learnt from: lllamnyp
Repo: cozystack/cozystack PR: 1233
File: packages/system/hetzner-robotlb/charts/robotlb/templates/deployment.yaml:33-35
Timestamp: 2025-07-23T09:15:09.658Z
Learning: The `./charts/robotlb/` directory in the hetzner-robotlb package contains vendored code, and the team generally avoids modifying vendored code to maintain clean separation from upstream dependencies.
Learnt from: mattia-eleuteri
Repo: cozystack/cozystack PR: 2095
File: packages/apps/kubernetes/templates/csi/driver-config.yaml:6-17
Timestamp: 2026-02-24T18:01:06.090Z
Learning: In the cozystack/cozystack repository, Helm templates are rendered by FluxCD's helm-controller against a live cluster. Therefore, patterns like (lookup ...).items are considered safe and are used consistently. Do not add default dict guards to protect against nil lookup results, as this would be inconsistent with project conventions. Apply this guidance to YAML templates under the templates directories (e.g., packages/apps/kubernetes/templates/ and similar) and verify against the existing FluxCD-based rendering approach.
Learnt from: mattia-eleuteri
Repo: cozystack/cozystack PR: 2199
File: packages/apps/tenant/templates/networkpolicy.yaml:222-225
Timestamp: 2026-03-10T16:00:27.642Z
Learning: In this repository, Cilium hostFirewall is enabled, so pods using hostNetwork (e.g., virt-handler) retain their Cilium endpoint identity and are matchable by label-based toEndpoints/matchLabels in CiliumNetworkPolicy. When reviewing YAML network policy manifests (e.g., packages/apps/**/templates/networkpolicy.yaml and similar), do not flag toEndpoints rules that target hostNetwork: true pods as ineffective. Ensure that policy selectors use labels that correctly target these hostNetwork pods and validate that policies reflect intended access while leveraging the retained identity for precise matching.
Vendored chart refreshed via make update in packages/system/cilium. Motivation: v1.19.2 fixes a cert-manager HTTP-01 bug on hostnames with both HTTP and HTTPS listeners (cilium#44492, backport PR #44517). This is a prerequisite for upcoming Gateway API work. v1.19.3 is the latest stable release in the v1.19.x line (15 Apr 2026). Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>
Built ghcr.io/cozystack/cozystack/cilium from the refreshed upstream v1.19.3 base image and updated values.yaml with the new digest. Previously values.yaml still pointed at the v1.19.1 cozystack rebuild by digest while Chart.yaml and the Dockerfile were on v1.19.3 — with chart default useDigest=true that would have silently pulled v1.19.1 until the next release-tag rebuild. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>
c0a5f2f to
a78505e
Compare
The previous image digest in values.yaml pointed at a single-arch linux/arm64 manifest because 'make image' was run from an arm64 host with the default buildx platform. Cozystack targets amd64 (Talos build output, E2E runners, most real-world clusters) and also arm64 for hybrid fleets, so Helm install would fail on amd64 nodes with 'no matching manifest for linux/amd64 in the manifest list entries' whenever somebody installed directly from this commit between merge and the next release-tag CI rebuild. Fix: rebuilt the image locally with PLATFORM='linux/amd64,linux/arm64' make image from a buildx docker-container driver, pushed the multi-arch manifest, and refreshed values.yaml with: - digest of the new multi-arch manifest list (verified via 'docker manifest inspect': amd64 sha256:e1977323..., arm64 sha256:8f5ab529...). - tag bumped from 'latest' (emitted by the common-envs.mk settag macro on a non-tagged checkout) to '1.19.3', matching the established convention in every other packages/system/*/values.yaml so reviewers and incident response have a human-readable version anchor independent of digest chasing. The Makefile is left untouched so the CI builder (which only uses the default docker driver) keeps building single-arch for whatever architecture it runs on; multi-arch is a responsibility of the release-tag pipeline or an explicit local rebuild. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>
f9503e9 to
3f36a1b
Compare
…PPool (#2468) ## What this PR does Adds an opt-in `publishing.exposure=loadBalancer` mode for the ingress-nginx Service as a migration path away from `Service.spec.externalIPs`, which is deprecated upstream in Kubernetes v1.36 ([KEP-5707](kubernetes/enhancements#5707), [kubernetes#137293](kubernetes/kubernetes#137293)). The `AllowServiceExternalIPs` feature gate is expected to default to off around v1.40 and the implementation to be removed around v1.43. Stacked on top of #2464 (cilium v1.19.3 bump) — depends on it for the `CiliumLoadBalancerIPPool` at `cilium.io/v2`. ### Behavior - New platform value `publishing.exposure` — enum `externalIPs | loadBalancer`, default `externalIPs` (current behavior unchanged on upgrade). - Plumbed through `cozystack-values` into each tenant's ingress HelmRelease via the new `expose-mode` key. - When `exposure=loadBalancer` and the current namespace matches `publishing.ingressName`, the Service becomes `type: LoadBalancer` with `externalTrafficPolicy: Local` and a `CiliumLoadBalancerIPPool` announces the addresses from `publishing.externalIPs` via Cilium LB IPAM. - The pool uses a namespace-only `serviceSelector` (`io.kubernetes.service.namespace: <ns>`) — any LoadBalancer Service in the tenant namespace draws from it. See "Pool ownership" below. - IPv4 addresses get `/32` CIDRs, IPv6 addresses get `/128`. Mixed families supported. Pre-CIDR entries (`192.0.2.10/32`) are accepted without double-suffixing. - Unknown values, `loadBalancer` with empty externalIPs, and stray empty entries from `publishing.externalIPs` are rejected at render time with explicit error messages. ### Pool ownership The `CiliumLoadBalancerIPPool` is rendered from `packages/apps/tenant/templates/cilium-lb-pool.yaml`, not from the ingress chart. The tenant chart is the per-tenant owner of cross-cutting resources (Namespace, `cozystack-values` Secret, HelmReleases for ingress and gateway), so one pool per tenant lives there. Cilium LB IPAM rejects overlapping CIDRs across pools regardless of `serviceSelector` — the last-added pool gets `cilium.io/PoolConflict` and stops allocating. Keeping the pool in the ingress chart would collide with the Gateway-API PR (#2470), which materialises its own LoadBalancer Service from the same `publishing.externalIPs` range when `tenant.spec.gateway=true`. Moving the pool to the tenant chart with a namespace-only selector lets a single pool back both services (ingress-nginx today, a Cilium Gateway Service once #2470 lands). Only the ingress-loadBalancer signal is wired here (`_cluster.expose-mode=loadBalancer` + `.Values.ingress=true` + publishing tenant). #2470 rebases on top of this PR, drops its own `packages/extra/gateway/templates/cilium-lb-pool.yaml`, and adds an OR branch for `.Values.gateway` in the tenant template. ### Scope Only the ingress-nginx Service is migrated by this setting. Other cozystack components that still write `Service.spec.externalIPs` directly (notably the `vpn` app at `packages/apps/vpn/templates/service.yaml`) need separate follow-up before Kubernetes v1.40. ### Tests - `packages/extra/ingress/tests/exposure_test.yaml` — 10 helm-unittest cases on the ingress-nginx Service: type / externalTrafficPolicy / externalIPs assertion for both modes, unknown-mode rejection (case-sensitive enum), empty-IPs failure, empty-entry filtering, non-publishing-tenant fallback. - `packages/apps/tenant/tests/exposure_test.yaml` — 9 cases on the pool itself: IPv4, IPv6, mixed, pre-CIDR input, empty-entry filtering, `ingress=false` in publishing tenant (no pool), non-publishing tenant (no pool), empty externalIPs (no pool). - Both suites are auto-discovered by `hack/helm-unit-tests.sh` via the `test:` target in each package's Makefile. ### Caveats (copied from the inline `values.yaml` comment) - `loadBalancer` mode uses `externalTrafficPolicy: Local`. The external IP must already be routed to a node that hosts an ingress pod (floating IP / upstream router / podAntiAffinity). - Cilium does not announce the IP on its own unless L2 announcements or BGP are enabled in the Cilium values (disabled by default in cozystack). - Switching the value on a running cluster causes the ingress-nginx Service to be recreated (`upgrade.force: true` on the HelmRelease + Service kind change); expect a brief interruption of ingress traffic. ### Release note ```release-note feat(ingress): add opt-in publishing.exposure=loadBalancer mode that uses type: LoadBalancer + CiliumLoadBalancerIPPool instead of the deprecated Service.spec.externalIPs. Default (externalIPs) preserves existing behavior. ```
What this PR does
Refreshes the vendored Cilium chart in
packages/system/ciliumfrom v1.19.1 to v1.19.3 viamake update. Chart templates, values, CRDs and the Cilium image reference are regenerated from upstream.Motivation
Upstream changes pulled in
values.schema.jsonand the cilium-agent DaemonSet refreshed from upstream.templates/ztunnel/directory (DaemonSet, Secret, ServiceAccount) added by upstream — not enabled by default in Cozystack values.Release note
Summary by CodeRabbit
New Features
Updates