cilium helm

Cilium is a networking, security, and observability solution for Kubernetes, built on eBPF. It provides high-performance networking with support for Layer 3-7 policies, load balancing, and transparent encryption. With Cilium, you can enforce fine-grained security policies, observe network flows in real time, and integrate seamlessly with service meshes. It also offers eBPF-powered network policies and cluster mesh capabilities, enabling secure communication across multiple Kubernetes clusters.

More popular helm chart found

cilium from astrateam-net/oci-charts/cilium is more popular with 154 repositories.

Install

Install with:

helm repo add cilium https://helm.cilium.io/
helm install cilium cilium/cilium -f values.yaml

Examples

See examples from other people.

Top Repositories (5 out of 78)

NameRepoStarsVersionTimestamp
ciliumJJGadgets/Biohazard911.19.102 days ago
ciliumsamip5/k8s-cluster1571.20.42 days ago
ciliumaxeII/home-ops611.20.412 days ago
ciliummchestr/home-cluster1771.20.413 days ago
ciliumgabe565/home-ops391.20.415 days ago

Values

See the most popular values for this chart:

KeyTypes
hubble.enabled (41)
true
boolean
hubble.relay.enabled (41)
true
boolean
hubble.relay.rollOutPods (31)
true
boolean
hubble.relay.prometheus.serviceMonitor.enabled (30)
true
boolean, string
hubble.relay.prometheus.serviceMonitor.trustCRDsExist (1)
boolean
hubble.relay.prometheus.enabled (5)
true
boolean
hubble.relay.replicas (2)
number
hubble.relay.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[].preference.matchExpressions[].key (1)
string
hubble.relay.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[].preference.matchExpressions[].operator (1)
string
hubble.relay.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[].preference.matchExpressions[].values[] (1)
string
hubble.relay.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[].weight (1)
number
hubble.relay.podLabels."policy.gabe565.com/egress-namespace" (1)
string
hubble.relay.podLabels."policy.gabe565.com/egress-nodes" (1)
string
hubble.relay.podLabels."policy.gabe565.com/ingress-namespace" (1)
string
hubble.relay.priorityClassName (1)
string
hubble.relay.tolerations[].effect (1)
string
hubble.relay.tolerations[].key (1)
string
hubble.relay.tolerations[].operator (1)
string
hubble.relay.tolerations[].value (1)
string
hubble.ui.enabled (40)
true
boolean
hubble.ui.rollOutPods (31)
true
boolean
hubble.ui.ingress.enabled (26)
true
boolean
hubble.ui.ingress.hosts[] (20)
- hubble.${SECRET_DOMAIN}
string
hubble.ui.ingress.tls[].hosts[] (17)
- hubble.${SECRET_DOMAIN}
string
hubble.ui.ingress.tls[].secretName (9)
hubble-tls
string
hubble.ui.ingress.className (16)
internal
string
hubble.ui.ingress.annotations."cert-manager.io/cluster-issuer" (8)
letsencrypt-production
string
hubble.ui.ingress.annotations."external-dns.alpha.kubernetes.io/hostname" (2)
string
hubble.ui.ingress.annotations."gethomepage.dev/enabled" (2)
string
hubble.ui.ingress.annotations."gethomepage.dev/group" (2)
string
hubble.ui.ingress.annotations."gethomepage.dev/icon" (2)
string
hubble.ui.ingress.annotations."gethomepage.dev/name" (2)
string
hubble.ui.ingress.annotations."kubernetes.io/ingress.class" (2)
string
hubble.ui.ingress.annotations."kubernetes.io/tls-acme" (2)
string
hubble.ui.ingress.annotations."external-dns.alpha.kubernetes.io/target" (1)
string
hubble.ui.ingress.annotations."external-dns.kubernetes.io/target" (1)
string
hubble.ui.ingress.annotations."gethomepage.dev/description" (1)
string
hubble.ui.ingress.annotations."hajimari.io/icon" (1)
string
hubble.ui.ingress.annotations."haproxy.org/allow-list" (1)
string
hubble.ui.ingress.annotations."haproxy.org/response-set-header" (1)
string
hubble.ui.ingress.annotations."nginx.ingress.kubernetes.io/auth-realm" (1)
string
hubble.ui.ingress.annotations."nginx.ingress.kubernetes.io/auth-secret" (1)
string
hubble.ui.ingress.annotations."nginx.ingress.kubernetes.io/auth-type" (1)
string
hubble.ui.ingress.annotations."nginx.ingress.kubernetes.io/whitelist-source-range" (1)
string
hubble.ui.ingress.ingressClassName (1)
string
hubble.ui.replicas (2)
number
hubble.ui.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[].preference.matchExpressions[].key (1)
string
hubble.ui.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[].preference.matchExpressions[].operator (1)
string
hubble.ui.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[].preference.matchExpressions[].values[] (1)
string
hubble.ui.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[].weight (1)
number
hubble.ui.httpRoute.enabled (1)
boolean
hubble.ui.httpRoute.hostnames[] (1)
string
hubble.ui.httpRoute.parentRefs[].name (1)
string
hubble.ui.httpRoute.parentRefs[].namespace (1)
string
hubble.ui.podLabels."policy.gabe565.com/egress-namespace" (1)
string
hubble.ui.podLabels."policy.gabe565.com/egress-nodes" (1)
string
hubble.ui.podLabels."policy.gabe565.com/ingress-envoy-public" (1)
string
hubble.ui.tolerations[].effect (1)
string
hubble.ui.tolerations[].key (1)
string
hubble.ui.tolerations[].operator (1)
string
hubble.ui.tolerations[].value (1)
string
hubble.metrics.enabled[] (37)
- dns:query
- drop
- tcp
- flow
- port-distribution
- icmp
- http
string
hubble.metrics.serviceMonitor.enabled (32)
true
boolean, string
hubble.metrics.serviceMonitor.interval (1)
string
hubble.metrics.serviceMonitor.labels.release (1)
string
hubble.metrics.serviceMonitor.metricRelabelings[].action (1)
string
hubble.metrics.serviceMonitor.metricRelabelings[].regex (1)
string
hubble.metrics.serviceMonitor.metricRelabelings[].sourceLabels[] (1)
string
hubble.metrics.serviceMonitor.relabelings[].action (1)
string
hubble.metrics.serviceMonitor.relabelings[].regex (1)
string
hubble.metrics.serviceMonitor.relabelings[].replacement (1)
string
hubble.metrics.serviceMonitor.relabelings[].sourceLabels[] (1)
string
hubble.metrics.serviceMonitor.relabelings[].targetLabel (1)
string
hubble.metrics.serviceMonitor.trustCRDsExist (1)
boolean
hubble.metrics.dashboards.enabled (31)
true
boolean, string
hubble.metrics.dashboards.annotations.grafana_folder (15)
Cilium
string
hubble.metrics.dashboards.annotations."grafana.io/folder" (1)
string
hubble.metrics.dashboards.namespace (4)
monitoring
string
hubble.metrics.dashboards.label (3)
string
hubble.metrics.dashboards.labelValue (3)
string
hubble.tls.auto.method (12)
cronJob
string
hubble.tls.auto.schedule (10)
0 0 1 */4 *
string
hubble.tls.auto.certValidityDuration (9)
180
number
hubble.tls.auto.enabled (9)
true
boolean
hubble.tls.enabled (3)
boolean
hubble.tls.insecure (2)
boolean
hubble.dashboards.enabled (4)
true
boolean
hubble.dashboards.namespace (3)
monitoring
string
hubble.dashboards.annotations.grafana_folder (2)
string
hubble.dashboards.label (2)
string
hubble.dashboards.labelValue (2)
string
hubble.serviceMonitor.enabled (3)
true
boolean
hubble.operator.prometheus.serviceMonitor.enabled (2)
boolean
hubble.prometheus.serviceMonitor.enabled (2)
boolean
hubble.dropEventEmitter.enabled (1)
boolean
hubble.dropEventEmitter.reasons[] (1)
string
hubble.eventBufferCapacity (1)
string
hubble.eventQueueSize (1)
string
hubble.export.dynamic.config.content[].excludeFilters[].destination_ip[] (1)
string
hubble.export.dynamic.config.content[].excludeFilters[].destination_port[] (1)
string
hubble.export.dynamic.config.content[].excludeFilters[].protocol[] (1)
string
hubble.export.dynamic.config.content[].filePath (1)
string
hubble.export.dynamic.config.content[].includeFilters[].verdict[] (1)
string
hubble.export.dynamic.config.content[].name (1)
string
hubble.export.dynamic.enabled (1)
boolean
hubble.export.fileMaxBackups (1)
number
hubble.export.fileMaxSizeMb (1)
number
hubble.export.static.allowList[] (1)
string
hubble.export.static.enabled (1)
boolean
hubble.export.static.filePath (1)
string
kubeProxyReplacement (39)
true
boolean, string
k8sServiceHost (36)
127.0.0.1
string
k8sServicePort (36)
7445
number, string
ipam.mode (35)
kubernetes
string
ipam.operator.clusterPoolIPv4MaskSize (5)
24
number
ipam.operator.clusterPoolIPv4PodCIDRList[] (5)
- "10.244.0.0/16"
string
ipam.operator.clusterPoolIPv6MaskSize (2)
number
ipam.operator.clusterPoolIPv6PodCIDRList[] (2)
string
ipam.operator.clusterPoolIPv4PodCIDRList (1)
string
prometheus.enabled (35)
true
boolean, string
prometheus.serviceMonitor.enabled (29)
true
boolean, string
prometheus.serviceMonitor.trustCRDsExist (27)
true
boolean
prometheus.trustCRDsExist (2)
boolean
operator.replicas (32)
1
number
operator.prometheus.enabled (30)
true
boolean, string
operator.prometheus.serviceMonitor.enabled (29)
true
boolean, string
operator.prometheus.serviceMonitor.trustCRDsExist (1)
boolean
operator.dashboards.enabled (26)
true
boolean
operator.dashboards.annotations.grafana_folder (19)
Cilium
string
operator.dashboards.annotations."grafana.io/folder" (1)
string
operator.dashboards.namespace (2)
string
operator.dashboards.label (1)
string
operator.dashboards.labelValue (1)
string
operator.rollOutPods (23)
true
boolean
operator.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[].preference.matchExpressions[].key (1)
string
operator.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[].preference.matchExpressions[].operator (1)
string
operator.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[].preference.matchExpressions[].values[] (1)
string
operator.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[].weight (1)
number
operator.nodeSelector."node-role.kubernetes.io/control-plane" (1)
string
operator.priorityClassName (1)
string
operator.tolerations[].effect (1)
string
operator.tolerations[].key (1)
string
operator.tolerations[].operator (1)
string
operator.tolerations[].value (1)
string
rollOutCiliumPods (29)
true
boolean
ipv4NativeRoutingCIDR (27)
${CLUSTER_CIDR}
string
securityContext.capabilities.ciliumAgent[] (27)
- CHOWN
- KILL
- NET_ADMIN
- NET_RAW
- IPC_LOCK
- SYS_ADMIN
- SYS_RESOURCE
- DAC_OVERRIDE
- FOWNER
- SETGID
- SETUID
string
securityContext.capabilities.cleanCiliumState[] (27)
- NET_ADMIN
- SYS_ADMIN
- SYS_RESOURCE
string
securityContext.capabilities.mountCgroup[] (2)
string
securityContext.capabilities.applySysctlOverwrites[] (1)
string
securityContext.capabilities.applySysctls[] (1)
string
securityContext.privileged (7)
true
boolean
securityContext.seLinuxOptions.type (1)
string
dashboards.enabled (26)
true
boolean
dashboards.annotations.grafana_folder (18)
Cilium
string
dashboards.annotations."grafana.io/folder" (1)
string
dashboards.label (1)
string
dashboards.labelValue (1)
string
dashboards.namespace (1)
string
kubeProxyReplacementHealthzBindAddr (25)
0.0.0.0:10256
string
l2announcements.enabled (25)
true
boolean
l2announcements.leaseDuration (8)
120s
string
l2announcements.leaseRenewDeadline (8)
60s
string
l2announcements.leaseRetryPeriod (8)
1s
string
routingMode (25)
native
string
autoDirectNodeRoutes (22)
true
boolean
bpf.masquerade (22)
true
boolean
bpf.preallocateMaps (10)
true
boolean
bpf.datapathMode (7)
netkit
string
bpf.tproxy (4)
true
boolean
bpf.events.trace.enabled (2)
boolean
bpf.hostLegacyRouting (2)
boolean
bpf.monitorInterval (2)
string
bpf.vlanBypass[] (2)
number
bpf.distributedLRU.enabled (1)
boolean
bpf.lbExternalClusterIP (1)
boolean
bpf.lbModeAnnotation (1)
boolean
bpf.mapDynamicSizeRatio (1)
number
bpf.mapSizeFlows (1)
number
bpf.policyMapMax (1)
number
cluster.id (22)
1
number
cluster.name (22)
main
string
loadBalancer.algorithm (22)
maglev
string
loadBalancer.mode (22)
dsr
string
loadBalancer.acceleration (3)
string
loadBalancer.protocolDifferentiation.enabled (2)
boolean
loadBalancer.dsrDispatch (1)
string
loadBalancer.enabled (1)
boolean
loadBalancer.serviceTopology (1)
boolean
loadBalancer.standalone (1)
boolean
localRedirectPolicy (22)
true
boolean
endpointRoutes.enabled (21)
true
boolean
cgroup.hostRoot (20)
/sys/fs/cgroup
string
cgroup.automount.enabled (11)
false
boolean
cgroup.autoMount.enabled (9)
false
boolean
envoy.enabled (20)
false
boolean
envoy.rollOutPods (6)
true
boolean
envoy.prometheus.serviceMonitor.enabled (4)
true
boolean, string
envoy.prometheus.enabled (1)
boolean
envoy.resources.limits.memory (1)
string
envoy.resources.requests.cpu (1)
string
envoy.resources.requests.memory (1)
string
envoy.secretsNamespace.create (1)
boolean
bgpControlPlane.enabled (17)
true
boolean
bgpControlPlane.secretsNamespace.create (1)
boolean
bgpControlPlane.secretsNamespace.name (1)
string
bgpControlPlane.v2Enabled (1)
boolean
gatewayAPI.enabled (16)
false
boolean
gatewayAPI.enableAlpn (6)
true
boolean
gatewayAPI.xffNumTrustedHops (3)
1
number
gatewayAPI.enableAppProtocol (2)
boolean
gatewayAPI.secretsNamespace.create (2)
boolean
gatewayAPI.secretsNamespace.name (2)
string
gatewayAPI.secretsNamespace.sync (2)
boolean
socketLB.hostNamespaceOnly (16)
true
boolean
socketLB.enabled (5)
true
boolean
cni.exclusive (11)
false
boolean
cni.binPath (2)
string
cni.confPath (2)
string
ipv6.enabled (8)
true
boolean
bandwidthManager.bbr (7)
true
boolean
bandwidthManager.enabled (7)
true
boolean
devices (6)
string
ingressController.enabled (6)
true
boolean
ingressController.default (4)
true
boolean
ingressController.defaultSecretName (4)
cert-manager/acme-crt-secret-sparks-codes
string
ingressController.loadbalancerMode (4)
dedicated
string
ingressController.defaultSecretNamespace (1)
string
ingressController.enforceHttps (1)
boolean
ingressController.service.annotations."io.cilium/lb-ipam-ips" (1)
string
containerRuntime.socketPath (5)
/var/run/k3s/containerd/containerd.sock
string
containerRuntime.integration (2)
string
ipv6NativeRoutingCIDR (5)
string
k8sClientRateLimit.burst (5)
number
k8sClientRateLimit.qps (5)
number
enableIPv4BIGTCP (4)
false
boolean
bgp.enabled (3)
false
boolean
bgp.announce.loadbalancerIP (2)
boolean
bpfClockProbe (3)
true
boolean
externalIPs.enabled (3)
boolean
l7Proxy (3)
boolean
clustermesh.apiserver.kvstoremesh.enabled (2)
boolean
clustermesh.apiserver.service.loadBalancerIP (2)
string
clustermesh.apiserver.service.type (2)
string
clustermesh.apiserver.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[].preference.matchExpressions[].key (1)
string
clustermesh.apiserver.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[].preference.matchExpressions[].operator (1)
string
clustermesh.apiserver.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[].preference.matchExpressions[].values[] (1)
string
clustermesh.apiserver.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[].weight (1)
number
clustermesh.config.clusters[].address (2)
string
clustermesh.config.clusters[].ips[] (2)
string
clustermesh.config.clusters[].name (2)
string
clustermesh.config.clusters[].port (2)
number
clustermesh.config.domain (2)
string
clustermesh.config.enabled (2)
boolean
clustermesh.mcsapi.enabled (2)
boolean
clustermesh.useAPIServer (2)
boolean
devices[] (2)
string
egressGateway.enabled (2)
boolean
enableIPv6Masquerade (2)
boolean
ipv4.enabled (2)
boolean
tunnel (2)
string
updateStrategy.rollingUpdate.maxUnavailable (2)
number
updateStrategy.rollingUpdate.maxSurge (1)
number
updateStrategy.type (1)
string
certgen.enforceCAValidityThroughoutLeavesDuration (1)
boolean
disableEndpointCRD (1)
boolean
dnsProxy.dnsRejectResponseCode (1)
string
encryption.enabled (1)
boolean
encryption.type (1)
string
endpointSlicePolicy (1)
boolean
"externalIPs.enabled" (1)
boolean
extraConfig.enable-ipv6-ndp (1)
string
extraConfig.ipv6-mcast-device (1)
string
extraConfig.ipv6-service-range (1)
string
global.encryption.enabled (1)
boolean
global.encryption.nodeEncryption (1)
boolean
hostFirewall.enabled (1)
boolean
"loadBalancer.algorithm" (1)
string
localRedirectPolicies.enabled (1)
boolean
manageCRDs (1)
boolean
metrics.disableAuth (1)
boolean
monitor.enabled (1)
string
pmtuDiscovery.enabled (1)
boolean
policyAuditMode (1)
boolean
policyEnforcementMode (1)
string
priorityClassName (1)
string
proxy.prometheus.enabled (1)
boolean
replicaCount (1)
number
resources.limits.cpu (1)
string
resources.limits.memory (1)
string
resources.requests.cpu (1)
string
resources.requests.memory (1)
string
tunnelPort (1)
number
upgradeCompatibility (1)
string
wellKnownIdentities.enabled (1)
boolean