cilium helm

Cilium is a networking, security, and observability solution for Kubernetes, built on eBPF. It provides high-performance networking with support for Layer 3-7 policies, load balancing, and transparent encryption. With Cilium, you can enforce fine-grained security policies, observe network flows in real time, and integrate seamlessly with service meshes. It also offers eBPF-powered network policies and cluster mesh capabilities, enabling secure communication across multiple Kubernetes clusters.

Install

Install with:

helm repo add cilium oci://ghcr.io/astrateam-net/oci-charts/cilium
helm install cilium cilium/cilium -f values.yaml

Examples

See examples from other people.

Top Repositories (5 out of 152)

NameRepoStarsVersionTimestamp
ciliumbjw-s-labs/home-ops8661.20.415 hours ago
ciliumadampetrovic/home-ops311.20.419 hours ago
ciliumnicolerenee/infra1121.20.42 days ago
ciliumburoa/home-ops3931.20.42 days ago
ciliumszinn/k8s-homelab3171.20.43 days ago

Resources

256Mi512Mi800Mi1024Mi2500Mi
512Mi768Mi1024Mi2048Mi4096Mi
50m100m150m200m250m400m500m

Values

See the most popular values for this chart:

KeyTypes
prometheus.enabled (130)
true
boolean
prometheus.serviceMonitor.enabled (129)
true
boolean
prometheus.serviceMonitor.trustCRDsExist (124)
true
boolean
prometheus.serviceMonitor.interval (3)
30s
string
prometheus.annotations.grafana_folder (3)
Infrastructure
string
prometheus.metrics[] (1)
string
prometheus.metricsService (1)
boolean
prometheus.port (1)
number
operator.prometheus.serviceMonitor.enabled (129)
true
boolean
operator.prometheus.serviceMonitor.interval (3)
30s
string
operator.prometheus.serviceMonitor.metricRelabelings[].action (1)
string
operator.prometheus.serviceMonitor.metricRelabelings[].regex (1)
string
operator.prometheus.serviceMonitor.metricRelabelings[].sourceLabels[] (1)
string
operator.prometheus.enabled (118)
true
boolean
operator.prometheus.metricsService (1)
boolean
operator.prometheus.replicas (1)
number
operator.prometheus.rollOutPods (1)
boolean
operator.dashboards.enabled (125)
true
boolean
operator.dashboards.annotations.grafana_folder (26)
Cilium
string
operator.rollOutPods (116)
true
boolean
operator.replicas (110)
2
number, string
operator.resources.limits.memory (17)
256Mi
string
operator.resources.limits.cpu (2)
string
operator.resources.requests.cpu (17)
50m
string
operator.resources.requests.memory (17)
128Mi
string
operator.podDisruptionBudget.enabled (6)
true
boolean
operator.podDisruptionBudget.maxUnavailable (4)
1
number
operator.podDisruptionBudget.minAvailable (1)
number
operator.enabled (3)
true
boolean
operator.nodeSelector."node-role.kubernetes.io/control-plane" (1)
string
operator.tolerations[].effect (1)
string
operator.tolerations[].key (1)
string
operator.tolerations[].operator (1)
string
operator.topologySpreadConstraints[].labelSelector.matchLabels."io.cilium/app" (1)
string
operator.topologySpreadConstraints[].maxSkew (1)
number
operator.topologySpreadConstraints[].topologyKey (1)
string
operator.topologySpreadConstraints[].whenUnsatisfiable (1)
string
hubble.enabled (127)
false
boolean
hubble.relay.enabled (57)
true
boolean
hubble.relay.rollOutPods (45)
true
boolean
hubble.relay.prometheus.serviceMonitor.enabled (31)
true
boolean
hubble.relay.prometheus.serviceMonitor.trustCRDsExist (2)
boolean
hubble.relay.prometheus.enabled (7)
true
boolean
hubble.relay.resources.limits.memory (11)
128Mi
string
hubble.relay.resources.limits.cpu (1)
string
hubble.relay.resources.requests.memory (11)
64Mi
string
hubble.relay.resources.requests.cpu (10)
50m
string
hubble.relay.priorityClassName (1)
string
hubble.relay.replicas (1)
number
hubble.relay.serviceMonitor.enabled (1)
boolean
hubble.relay.tls.server.enabled (1)
boolean
hubble.ui.enabled (51)
true
boolean
hubble.ui.rollOutPods (39)
true
boolean
hubble.ui.ingress.enabled (9)
false
boolean
hubble.ui.ingress.className (2)
string
hubble.ui.ingress.hosts[] (2)
string
hubble.ui.ingress.annotations."cert-manager.io/cluster-issuer" (1)
string
hubble.ui.ingress.annotations."external-dns.kubernetes.io/target" (1)
string
hubble.ui.ingress.annotations."ingress.home.arpa/nginx-internal" (1)
string
hubble.ui.ingress.tls[].hosts[] (1)
string
hubble.ui.ingress.tls[].secretName (1)
string
hubble.ui.backend.resources.limits.memory (8)
128Mi
string
hubble.ui.backend.resources.requests.memory (8)
64Mi
string
hubble.ui.backend.resources.requests.cpu (7)
10m
string
hubble.ui.backend.image.repository (1)
string
hubble.ui.backend.image.tag (1)
string
hubble.ui.frontend.resources.limits.memory (6)
64Mi
string
hubble.ui.frontend.resources.requests.memory (6)
64Mi
string
hubble.ui.frontend.resources.requests.cpu (5)
10m
string
hubble.ui.frontend.image.repository (1)
string
hubble.ui.frontend.image.tag (1)
string
hubble.ui.httpRoute.enabled (3)
true
boolean
hubble.ui.httpRoute.hostnames[] (3)
string
hubble.ui.httpRoute.parentRefs[].name (3)
string
hubble.ui.httpRoute.parentRefs[].namespace (3)
string
hubble.ui.httpRoute.parentRefs[].sectionName (2)
string
hubble.ui.httpRoute.parentRefs[].group (1)
string
hubble.ui.httpRoute.parentRefs[].kind (1)
string
hubble.ui.resources.limits.memory (3)
string
hubble.ui.resources.limits.cpu (1)
string
hubble.ui.resources.requests.cpu (3)
string
hubble.ui.resources.requests.memory (3)
string
hubble.ui.podLabels."egress.cilium.io/kube-apiserver" (1)
string
hubble.ui.podLabels."network.home.arpa/from-envoy-internal" (1)
string
hubble.ui.priorityClassName (1)
string
hubble.ui.replicas (1)
number
hubble.ui.route.app.enabled (1)
boolean
hubble.ui.route.app.hostnames[] (1)
string
hubble.ui.route.app.parentRefs[].name (1)
string
hubble.ui.route.app.parentRefs[].namespace (1)
string
hubble.ui.route.app.parentRefs[].sectionName (1)
string
hubble.ui.route.app.rules[].backendRefs[].name (1)
string
hubble.ui.route.app.rules[].backendRefs[].port (1)
number
hubble.ui.route.app.rules[].matches[].path.type (1)
string
hubble.ui.route.app.rules[].matches[].path.value (1)
string
hubble.ui.service.annotations."gatus.home-operations.com/enabled" (1)
string
hubble.ui.standalone.enabled (1)
boolean
hubble.metrics.enabled[] (47)
- dns:query
- drop
- tcp
- flow
- port-distribution
- icmp
- http
string
hubble.metrics.serviceMonitor.enabled (46)
true
boolean
hubble.metrics.serviceMonitor.trustCRDsExist (3)
true
boolean
hubble.metrics.serviceMonitor.interval (1)
string
hubble.metrics.serviceMonitor.metricRelabelings[].action (1)
string
hubble.metrics.serviceMonitor.metricRelabelings[].regex (1)
string
hubble.metrics.serviceMonitor.metricRelabelings[].sourceLabels[] (1)
string
hubble.metrics.dashboards.enabled (33)
true
boolean
hubble.metrics.dashboards.annotations.grafana_folder (7)
Cilium
string
hubble.metrics.dashboards.labelValue (1)
string
hubble.metrics.enableOpenMetrics (3)
true
boolean
hubble.metrics.dynamic.config.content[].contextOptions[].name (1)
string
hubble.metrics.dynamic.config.content[].contextOptions[].values[] (1)
string
hubble.metrics.dynamic.config.content[].excludeFilters[].destination_label[] (1)
string
hubble.metrics.dynamic.config.content[].excludeFilters[].source_label[] (1)
string
hubble.metrics.dynamic.config.content[].name (1)
string
hubble.metrics.dynamic.config.createConfigMap (1)
boolean
hubble.metrics.dynamic.enabled (1)
boolean
hubble.tls.auto.method (5)
string
hubble.tls.auto.certManagerIssuerRef.group (2)
string
hubble.tls.auto.certManagerIssuerRef.kind (2)
string
hubble.tls.auto.certManagerIssuerRef.name (2)
string
hubble.tls.auto.certValidityDuration (1)
number
hubble.tls.auto.enabled (1)
boolean
hubble.tls.auto.schedule (1)
string
hubble.tls.enabled (1)
boolean
hubble.export.static.allowList[] (4)
string
hubble.export.static.enabled (2)
boolean
hubble.export.static.filePath (2)
string
hubble.export.static.aggregationInterval (1)
string
hubble.export.static.denyList[] (1)
string
hubble.export.static.fieldAggregate[] (1)
string
hubble.export.static.fieldMask[] (1)
string
hubble.export.dynamic.config.content[].fieldMask[] (2)
string
hubble.export.dynamic.config.content[].fileMaxBackups (2)
number
hubble.export.dynamic.config.content[].fileMaxSizeMb (2)
number
hubble.export.dynamic.config.content[].filePath (2)
string
hubble.export.dynamic.config.content[].name (2)
string
hubble.export.dynamic.config.content[].aggregationInterval (1)
string
hubble.export.dynamic.config.content[].excludeFilters[].destination_ip[] (1)
string
hubble.export.dynamic.config.content[].excludeFilters[].destination_pod[] (1)
string
hubble.export.dynamic.config.content[].excludeFilters[].dns_query[] (1)
string
hubble.export.dynamic.config.content[].excludeFilters[].event_type[].match_sub_type (1)
boolean
hubble.export.dynamic.config.content[].excludeFilters[].event_type[].sub_type (1)
number
hubble.export.dynamic.config.content[].excludeFilters[].event_type[].type (1)
number
hubble.export.dynamic.config.content[].excludeFilters[].reply[] (1)
boolean
hubble.export.dynamic.config.content[].excludeFilters[].source_ip[] (1)
string
hubble.export.dynamic.config.content[].excludeFilters[].source_pod[] (1)
string
hubble.export.dynamic.config.content[].fieldAggregate[] (1)
string
hubble.export.dynamic.config.content[].fileCompress (1)
boolean
hubble.export.dynamic.config.content[].includeFilters[].destination_label[] (1)
string
hubble.export.dynamic.config.content[].includeFilters[].protocol[] (1)
string
hubble.export.dynamic.config.content[].includeFilters[].reply[] (1)
boolean
hubble.export.dynamic.config.content[].includeFilters[].source_label[] (1)
string
hubble.export.dynamic.config.content[].includeFilters[].verdict[] (1)
string
hubble.export.dynamic.config.createConfigMap (1)
boolean
hubble.export.dynamic.enabled (2)
boolean
hubble.eventBufferCapacity (1)
string
hubble.prometheus.enabled (1)
boolean
hubble.prometheus.serviceMonitor.enabled (1)
boolean
kubeProxyReplacement (125)
true
boolean, string
dashboards.enabled (123)
true
boolean
dashboards.annotations.grafana_folder (24)
Cilium
string
ipam.mode (123)
kubernetes
string
ipam.multiPoolPreAllocation (1)
string
ipam.operator.clusterPoolIPv4PodCIDRList[] (1)
string
ipam.operator.clusterPoolIPv6PodCIDRList[] (1)
string
k8sServiceHost (123)
127.0.0.1
string
k8sServicePort (123)
7445
number, string
securityContext.capabilities.ciliumAgent[] (123)
- CHOWN
- KILL
- NET_ADMIN
- NET_RAW
- IPC_LOCK
- SYS_ADMIN
- SYS_RESOURCE
- PERFMON
- BPF
- DAC_OVERRIDE
- FOWNER
- SETGID
- SETUID
string
securityContext.capabilities.cleanCiliumState[] (123)
- NET_ADMIN
- SYS_ADMIN
- SYS_RESOURCE
string
securityContext.privileged (1)
boolean
ipv4NativeRoutingCIDR (122)
10.42.0.0/16
string
autoDirectNodeRoutes (120)
true
boolean
cgroup.hostRoot (120)
/sys/fs/cgroup
string
cgroup.automount.enabled (78)
false
boolean
cgroup.autoMount.enabled (42)
false
boolean
rollOutCiliumPods (120)
true
boolean
routingMode (120)
native
string
bpf.masquerade (118)
true
boolean
bpf.preallocateMaps (80)
true
boolean
bpf.datapathMode (78)
netkit
string
bpf.hostLegacyRouting (29)
true
boolean
bpf.tproxy (13)
true
boolean
bpf.vlanBypass[] (5)
number
bpf.lbModeAnnotation (3)
true
boolean
bpf.policyMapMax (3)
number
bpf.distributedLRU.enabled (2)
boolean
bpf.ctAnyMax (1)
number
bpf.ctTcpMax (1)
number
bpf.mapSizeFlows (1)
number
bpf.monitorAggregation (1)
string
bpf.monitorFlags (1)
string
bpf.monitorInterval (1)
string
kubeProxyReplacementHealthzBindAddr (114)
0.0.0.0:10256
string
loadBalancer.algorithm (112)
maglev
string
loadBalancer.mode (112)
dsr
string
loadBalancer.serviceTopology (28)
true
boolean
loadBalancer.acceleration (8)
best-effort
string
loadBalancer.dsrDispatch (2)
string
loadBalancer.l7.algorithm (1)
string
loadBalancer.l7.backend (1)
string
cni.exclusive (109)
false
boolean
cni.customConf (2)
boolean
cni.uninstall (2)
boolean
cni.binPath (1)
string
cni.confPath (1)
string
cni.resources.limits.cpu (1)
string
cni.resources.limits.memory (1)
string
cni.resources.requests.cpu (1)
string
cni.resources.requests.memory (1)
string
endpointRoutes.enabled (109)
true
boolean
envoy.enabled (109)
false
boolean
envoy.prometheus.serviceMonitor.enabled (11)
true
boolean
envoy.rollOutPods (11)
true
boolean
envoy.resources.limits.memory (2)
string
envoy.resources.limits.cpu (1)
string
envoy.resources.requests.cpu (2)
string
envoy.resources.requests.memory (2)
string
envoy.extraArgs[] (1)
string
envoy.securityContext.capabilities.envoy[] (1)
string
envoy.securityContext.capabilities.keepCapNetBindService (1)
boolean
l2announcements.enabled (109)
true
boolean
l2announcements.leaseDuration (5)
string
l2announcements.leaseRenewDeadline (5)
string
l2announcements.leaseRetryPeriod (5)
string
socketLB.hostNamespaceOnly (97)
true
boolean
socketLB.enabled (89)
true
boolean
socketLB.terminatePodConnections (2)
boolean
bgpControlPlane.enabled (95)
true
boolean
bandwidthManager.enabled (80)
true
boolean
bandwidthManager.bbr (77)
true
boolean
bpfClockProbe (75)
true
boolean
localRedirectPolicies.enabled (74)
true
boolean
localRedirectPolicies.enbled (1)
boolean
devices (69)
bond+
string
enableIPv4BIGTCP (69)
true
boolean
pmtuDiscovery.enabled (66)
true
boolean
gatewayAPI.enabled (51)
false
boolean
gatewayAPI.secretsNamespace.create (3)
false
boolean
gatewayAPI.secretsNamespace.name (3)
kube-system
string
gatewayAPI.enableAlpn (2)
boolean
gatewayAPI.gatewayClass.create (1)
string
gatewayAPI.xffNumTrustedHops (1)
number
cluster.name (37)
main
string
cluster.id (36)
1
number
localRedirectPolicy (36)
true
boolean
ipv6.enabled (20)
true
boolean
resources.requests.cpu (19)
100m
string
resources.requests.memory (16)
256Mi
string
resources.limits.memory (16)
1Gi
string
resources.limits.cpu (1)
string
ipv6NativeRoutingCIDR (16)
string
enableIPv6BIGTCP (12)
true
boolean
ipv4.enabled (8)
true
boolean
updateStrategy.rollingUpdate.maxUnavailable (6)
1
number
egressGateway.enabled (5)
true
boolean
encryption.enabled (5)
true
boolean
encryption.type (3)
wireguard
string
encryption.nodeEncryption (1)
boolean
l7Proxy (5)
true
boolean
policyAuditMode (5)
false
boolean
directRoutingSkipUnreachable (4)
true
boolean
k8sClientRateLimit.burst (4)
number
k8sClientRateLimit.qps (4)
number
annotateK8sNode (3)
true
boolean
clustermesh.useAPIServer (3)
boolean
clustermesh.apiserver.service.annotations."lbipam.cilium.io/ips" (1)
string
clustermesh.apiserver.service.annotations."service.cilium.io/forwarding-mode" (1)
string
clustermesh.apiserver.service.type (1)
string
clustermesh.cacheTTL (1)
string
clustermesh.config.clusters.artemis-cluster.ips[] (1)
string
clustermesh.config.clusters.artemis-cluster.port (1)
number
clustermesh.config.clusters.frostlink-vps.ips[] (1)
string
clustermesh.config.clusters.frostlink-vps.port (1)
number
clustermesh.config.domain (1)
string
clustermesh.config.enabled (1)
boolean
envoyConfig.enabled (3)
false
boolean
envoyConfig.secretsNamespace.create (2)
boolean
envoyConfig.secretsNamespace.name (2)
string
hostFirewall.enabled (3)
boolean
maglev.hashSeed (3)
string
maglev.tableSize (2)
number
tls.secretsNamespace.create (3)
false
boolean
tls.secretsNamespace.name (3)
kube-system
string
tunnelProtocol (3)
vxlan
string
bgp.enabled (2)
boolean
bgp.announce.loadbalancerIP (1)
boolean
bgp.announce.podCIDR (1)
boolean
Cluster.id (2)
number
Cluster.name (2)
string
debug.enabled (2)
boolean
devices[] (2)
string
dnsProxy.endpointMaxIpPerHostname (2)
number
dnsProxy.maxDeferredConnectionDeletes (2)
number
dnsProxy.minTtl (2)
number
dnsProxy.dnsRejectResponseCode (1)
string
enableIPv6Masquerade (2)
boolean
enableLBIPAM (2)
boolean
enableRuntimeDeviceDetection (2)
boolean
externalIPs.enabled (2)
boolean
ingressController.enabled (2)
boolean
ingressController.secretsNamespace.create (2)
boolean
ingressController.secretsNamespace.name (2)
string
ipMasqAgent.config.nonMasqueradeCIDRs[] (2)
string
ipMasqAgent.config.masqLinkLocal (1)
boolean
ipMasqAgent.enabled (2)
boolean
k8s.requireIPv4PodCIDR (2)
boolean
k8s.requireIPv6PodCIDR (2)
boolean
k8s.apiServerURLs (1)
string
LoadBalancer.algorithm (2)
string
LoadBalancer.mode (2)
string
MTU (2)
number
nodeIPAM.enabled (2)
boolean
certgen.podLabels."egress.cilium.io/kube-apiserver" (1)
string
defaultLBServiceIPAM (1)
string
directRoutingDevice (1)
string
enableIPv4Masquerade (1)
boolean
initResources.limits.memory (1)
string
initResources.requests.cpu (1)
string
initResources.requests.memory (1)
string
logOptions.format (1)
string
nodeSelectorLabels (1)
boolean
podLabels."platform.home.arpa/tier" (1)
string
policyEnforcementMode (1)
string
priorityClassName (1)
string
tolerations[].operator (1)
string