cilium helm

Cilium is a networking, security, and observability solution for Kubernetes, built on eBPF. It provides high-performance networking with support for Layer 3-7 policies, load balancing, and transparent encryption. With Cilium, you can enforce fine-grained security policies, observe network flows in real time, and integrate seamlessly with service meshes. It also offers eBPF-powered network policies and cluster mesh capabilities, enabling secure communication across multiple Kubernetes clusters.

Install

Install with:

helm repo add cilium https://helm.cilium.io/
helm install cilium cilium/cilium -f values.yaml

Examples

See examples from other people.

Top Repositories (5 out of 155)

NameRepoStarsVersionTimestamp
ciliumkashalls/home-cluster1131.17.1a day ago
ciliumcoolguy1771/home-ops691.17.12 days ago
ciliumcoolguy1771/home-ops691.17.12 days ago
ciliumrafaribe/home-ops621.17.14 days ago
ciliumJJGadgets/Biohazard491.17.05 days ago

Values

See the most popular values for this chart:

KeyTypes
hubble.ui.ingress.enabled (114)
true
boolean
hubble.ui.ingress.hosts[] (114)
- hubble.${SECRET_DOMAIN}
string
hubble.ui.ingress.className (108)
internal
string
hubble.ui.ingress.tls[].hosts[] (58)
- hubble.${SECRET_DOMAIN}
string
hubble.ui.ingress.tls[].secretName (18)
hubble-tls
string
hubble.ui.ingress.annotations."hajimari.io/icon" (16)
simple-icons:cilium
string
hubble.ui.ingress.annotations."gethomepage.dev/enabled" (15)
true
string
hubble.ui.ingress.annotations."gethomepage.dev/group" (15)
Observability
string
hubble.ui.ingress.annotations."gethomepage.dev/icon" (15)
cilium.png
string
hubble.ui.ingress.annotations."gethomepage.dev/name" (15)
Hubble
string
hubble.ui.ingress.annotations."cert-manager.io/cluster-issuer" (13)
letsencrypt-production
string
hubble.ui.ingress.annotations."external-dns.alpha.kubernetes.io/target" (11)
string
hubble.ui.ingress.annotations."gethomepage.dev/description" (10)
Network Monitoring Dashboard
string
hubble.ui.ingress.annotations."hajimari.io/appName" (9)
Hubble
string
hubble.ui.ingress.annotations."hajimari.io/enable" (7)
true
string
hubble.ui.ingress.annotations."nginx.ingress.kubernetes.io/auth-signin" (6)
string
hubble.ui.ingress.annotations."nginx.ingress.kubernetes.io/auth-url" (6)
string
hubble.ui.ingress.annotations."hajimari.io/group" (5)
networking
string
hubble.ui.ingress.annotations."nginx.ingress.kubernetes.io/auth-response-headers" (5)
Remote-User,Remote-Name,Remote-Groups,Remote-Email
string
hubble.ui.ingress.annotations."nginx.ingress.kubernetes.io/auth-snippet" (5)
string
hubble.ui.ingress.annotations."traefik.ingress.kubernetes.io/router.middlewares" (4)
string
hubble.ui.ingress.annotations."kubernetes.io/tls-acme" (3)
true
string
hubble.ui.ingress.annotations."nginx.ingress.kubernetes.io/auth-method" (3)
GET
string
hubble.ui.ingress.annotations."nginx.ingress.kubernetes.io/whitelist-source-range" (3)
string
hubble.ui.ingress.annotations."traefik.ingress.kubernetes.io/router.entrypoints" (3)
websecure
string
hubble.ui.ingress.annotations."gethomepage.dev/weight" (2)
string
hubble.ui.ingress.annotations."hajimari.io/instance" (2)
string
hubble.ui.ingress.annotations.external-dns/is-public (1)
string
hubble.ui.ingress.annotations.external-dns/opnsense (1)
string
hubble.ui.ingress.annotations."external-dns.alpha.kubernetes.io/hostname" (1)
string
hubble.ui.ingress.annotations."gethomepage.dev/href" (1)
string
hubble.ui.ingress.annotations."gethomepage.dev/id" (1)
string
hubble.ui.ingress.annotations."haproxy.org/allow-list" (1)
string
hubble.ui.ingress.annotations."haproxy.org/response-set-header" (1)
string
hubble.ui.ingress.annotations."ingress.home.arpa/nginx-internal" (1)
string
hubble.ui.ingress.annotations."kubernetes.io/ingress.class" (1)
string
hubble.ui.ingress.annotations."nginx.ingress.kubernetes.io/configuration-snippet" (1)
string
hubble.ui.ingress.annotations."nginx.ingress.kubernetes.io/force-ssl-redirect" (1)
string
hubble.ui.ingress.annotations."nginx.ingress.kubernetes.io/ssl-redirect" (1)
string
hubble.ui.ingress.annotations."traefik.ingress.kubernetes.io/affinity" (1)
string
hubble.ui.ingress.annotations."traefik.ingress.kubernetes.io/router.tls" (1)
string
hubble.ui.ingress.ingressClassName (1)
string
hubble.ui.enabled (108)
true
boolean
hubble.ui.rollOutPods (100)
true
boolean
hubble.ui.replicas (2)
number
hubble.ui.backend.image.repository (1)
string
hubble.ui.backend.image.tag (1)
string
hubble.ui.backend.resources.requests.cpu (1)
string
hubble.ui.backend.resources.requests.memory (1)
string
hubble.ui.frontend.image.repository (1)
string
hubble.ui.frontend.image.tag (1)
string
hubble.ui.frontend.resources.requests.cpu (1)
string
hubble.ui.frontend.resources.requests.memory (1)
string
hubble.ui.podLabels."policy.gabe565.com/egress-namespace" (1)
string
hubble.ui.podLabels."policy.gabe565.com/egress-nodes" (1)
string
hubble.ui.podLabels."policy.gabe565.com/ingress-ingress" (1)
string
hubble.relay.enabled (105)
true
boolean
hubble.relay.prometheus.serviceMonitor.enabled (102)
true
boolean, string
hubble.relay.prometheus.enabled (6)
true
boolean
hubble.relay.rollOutPods (96)
true
boolean
hubble.relay.tls.server.enabled (3)
true
boolean
hubble.relay.podLabels."policy.gabe565.com/egress-namespace" (1)
string
hubble.relay.podLabels."policy.gabe565.com/egress-nodes" (1)
string
hubble.relay.podLabels."policy.gabe565.com/ingress-namespace" (1)
string
hubble.relay.replicas (1)
number
hubble.relay.resources.requests.cpu (1)
string
hubble.enabled (102)
true
boolean
hubble.metrics.enabled[] (102)
- dns:query
- drop
- tcp
- flow
- port-distribution
- icmp
- http
string
hubble.metrics.serviceMonitor.enabled (98)
true
boolean, string
hubble.metrics.serviceMonitor.interval (2)
string
hubble.metrics.serviceMonitor.relabelings[].action (2)
string
hubble.metrics.serviceMonitor.relabelings[].regex (2)
string
hubble.metrics.serviceMonitor.relabelings[].replacement (2)
string
hubble.metrics.serviceMonitor.relabelings[].sourceLabels[] (2)
string
hubble.metrics.serviceMonitor.relabelings[].targetLabel (2)
string
hubble.metrics.dashboards.enabled (90)
true
boolean, string
hubble.metrics.dashboards.annotations.grafana_folder (70)
Cilium
string
hubble.metrics.dashboards.annotations."grafana.io/folder" (1)
string
hubble.metrics.dashboards.labelValue (3)
string
hubble.metrics.dashboards.label (2)
string
hubble.metrics.dashboards.namespace (2)
string
hubble.metrics.enableOpenMetrics (2)
boolean
hubble.serviceMonitor.enabled (16)
true
boolean
hubble.dashboards.enabled (15)
true
boolean
hubble.dashboards.namespace (10)
monitoring
string
hubble.dashboards.annotations.grafana_folder (9)
Cilium
string
hubble.dashboards.label (9)
grafana_dashboard
string
hubble.dashboards.labelValue (9)
1
string
hubble.tls.auto.method (5)
string
hubble.tls.auto.certManagerIssuerRef.group (2)
string
hubble.tls.auto.certManagerIssuerRef.kind (2)
string
hubble.tls.auto.certManagerIssuerRef.name (2)
string
hubble.tls.auto.certValidityDuration (2)
number
hubble.tls.auto.enabled (2)
boolean
hubble.tls.auto.schedule (2)
string
hubble.tls.auto.enable (1)
boolean
hubble.tls.enabled (1)
boolean
hubble.tls.insecure (1)
boolean
hubble.eventQueueSize (2)
string
hubble.prometheus.serviceMonitor.enabled (2)
boolean
hubble.prometheus.enabled (1)
boolean
hubble.operator.prometheus.serviceMonitor.enabled (1)
boolean
prometheus.serviceMonitor.enabled (107)
true
boolean
prometheus.serviceMonitor.trustCRDsExist (93)
true
boolean
prometheus.enabled (104)
true
boolean
prometheus.relay.enabled (1)
boolean
prometheus.relay.prometheus.serviceMonitor.enabled (1)
boolean
operator.prometheus.serviceMonitor.enabled (106)
true
boolean
operator.prometheus.serviceMonitor.metricRelabelings[].action (3)
drop
drop
drop
string
operator.prometheus.serviceMonitor.metricRelabelings[].regex (3)
workqueue_(work|queue)_duration_seconds_bucket
controller_runtime_reconcile_time_seconds_bucket
cilium_k8s_client_(rate_limiter_duration|api_latency_time)_seconds_bucket
string
operator.prometheus.serviceMonitor.metricRelabelings[].sourceLabels[] (3)
- __name__
- __name__
- __name__
string
operator.prometheus.enabled (100)
true
boolean
operator.prometheus.dashboards.annotations.grafana_folder (1)
string
operator.prometheus.dashboards.enabled (1)
boolean
operator.dashboards.enabled (95)
true
boolean
operator.dashboards.annotations.grafana_folder (78)
Cilium
string
operator.dashboards.annotations."grafana.io/folder" (1)
string
operator.dashboards.label (1)
string
operator.dashboards.labelValue (1)
string
operator.dashboards.namespace (1)
string
operator.rollOutPods (48)
true
boolean
operator.replicas (44)
1
number
operator.enabled (3)
true
boolean
operator.resources.requests.cpu (1)
string
operator.resources.requests.memory (1)
string
dashboards.enabled (93)
true
boolean
dashboards.annotations.grafana_folder (76)
Cilium
string
dashboards.annotations."grafana.io/folder" (1)
string
dashboards.label (1)
string
dashboards.labelValue (1)
string
ipam.mode (56)
kubernetes
string
ipam.operator.clusterPoolIPv4MaskSize (2)
number
ipam.operator.clusterPoolIPv4PodCIDRList[] (2)
string
ipam.operator.clusterPoolIPv6MaskSize (1)
number
ipam.operator.clusterPoolIPv6PodCIDRList[] (1)
string
kubeProxyReplacement (51)
true
boolean, string
k8sServiceHost (49)
127.0.0.1
string
k8sServicePort (49)
6443
number, string
rollOutCiliumPods (47)
true
boolean
ipv4NativeRoutingCIDR (45)
${CLUSTER_CIDR}
string
localRedirectPolicy (45)
true
boolean
autoDirectNodeRoutes (44)
true
boolean
cluster.name (44)
home-cluster
string
cluster.id (43)
1
number, string
endpointRoutes.enabled (43)
true
boolean
loadBalancer.algorithm (43)
maglev
string
loadBalancer.mode (43)
dsr
string
loadBalancer.l7.backend (3)
envoy
string
loadBalancer.acceleration (2)
string
loadBalancer.protocolDifferentiation.enabled (1)
boolean
loadBalancer.serviceTopology (1)
boolean
loadBalancer.standalone (1)
boolean
kubeProxyReplacementHealthzBindAddr (42)
0.0.0.0:10256
string
bpf.masquerade (39)
true
boolean
bpf.tproxy (9)
true
boolean
bpf.events.trace.enabled (2)
boolean
bpf.monitorInterval (2)
string
bpf.preallocateMaps (2)
boolean
bpf.vlanBypass[] (2)
number
bpf.policyMapMax (1)
number
l2announcements.enabled (39)
true
boolean
l2announcements.leaseDuration (19)
120s
string
l2announcements.leaseRenewDeadline (19)
60s
string
l2announcements.leaseRetryPeriod (19)
1s
string
routingMode (37)
native
string
securityContext.capabilities.ciliumAgent[] (32)
- CHOWN
- KILL
- NET_ADMIN
- NET_RAW
- IPC_LOCK
- SYS_ADMIN
- SYS_RESOURCE
- DAC_OVERRIDE
- FOWNER
- SETGID
- SETUID
string
securityContext.capabilities.cleanCiliumState[] (32)
- NET_ADMIN
- SYS_ADMIN
- SYS_RESOURCE
string
securityContext.capabilities.applySysctlOverwrites[] (1)
string
securityContext.capabilities.mountCgroup[] (1)
string
securityContext.privileged (22)
true
boolean
cgroup.hostRoot (30)
/sys/fs/cgroup
string
cgroup.automount.enabled (18)
false
boolean
cgroup.autoMount.enabled (13)
false
boolean
cgroup.hostRooot (1)
string
bgpControlPlane.enabled (27)
true
boolean
bgpControlPlane.secretsNamespace.create (1)
boolean
bgpControlPlane.secretsNamespace.name (1)
string
bgpControlPlane.v2Enabled (1)
boolean
containerRuntime.integration (21)
containerd
string
containerRuntime.socketPath (17)
/var/run/k3s/containerd/containerd.sock
string
bgp.enabled (20)
false
boolean
bgp.announce.loadbalancerIP (8)
true
boolean
bgp.announce.podCIDR (2)
boolean
cni.exclusive (18)
false
boolean
cni.binPath (5)
/var/lib/rancher/k3s/data/cni
string
cni.confPath (5)
/var/lib/rancher/k3s/agent/etc/cni/net.d
string
bandwidthManager.enabled (13)
true
boolean
bandwidthManager.bbr (10)
true
boolean
envoy.enabled (13)
false
boolean
envoy.prometheus.enabled (1)
boolean
envoy.prometheus.serviceMonitor.enabled (1)
boolean
tunnel (12)
disabled
string
enableRuntimeDeviceDetection (7)
true
boolean
gatewayAPI.enabled (6)
true
boolean
gatewayAPI.enableAppProtocol (2)
boolean
gatewayAPI.enableAlpn (1)
boolean
gatewayAPI.gatewayClass.create (1)
string
l7Proxy (6)
true
boolean
socketLB.hostNamespaceOnly (6)
true
boolean
socketLB.enabled (3)
boolean
devices[] (5)
string
ingressController.enabled (5)
false
boolean
ingressController.loadbalancerMode (1)
string
ingressController.service.annotations."io.cilium/lb-ipam-ips" (1)
string
devices (4)
string
externalIPs.enabled (4)
true
boolean
ipv6.enabled (3)
boolean
clustermesh.apiserver.kvstoremesh.enabled (2)
boolean
clustermesh.apiserver.service.type (2)
string
clustermesh.apiserver.service.loadBalancerIP (1)
string
clustermesh.enableMCSAPISupport (2)
boolean
clustermesh.useAPIServer (2)
boolean
enableIPv4BIGTCP (2)
boolean
ipv6NativeRoutingCIDR (2)
string
k8sClientRateLimit.burst (2)
number
k8sClientRateLimit.qps (2)
number
proxy.prometheus.enabled (2)
boolean
resources.requests.cpu (2)
string
resources.requests.memory (1)
string
resources.limits.cpu (1)
string
resources.limits.memory (1)
string
wellKnownIdentities.enabled (2)
boolean
annotateK8sNode (1)
boolean
authentication.enabled (1)
boolean
ciliumEndpointSlice.enabled (1)
boolean
disableEndpointCRD (1)
boolean
dnsProxy.dnsRejectResponseCode (1)
string
enableIPv6Masquerade (1)
boolean
envoyConfig.enabled (1)
boolean
extraConfig.enable-icmp-rules (1)
string
global.encryption.enabled (1)
boolean
global.encryption.nodeEncryption (1)
boolean
hostFirewall.enabled (1)
boolean
hostPort.enabled (1)
boolean
k8s.requireIPv4PodCIDR (1)
boolean
l7proxy (1)
boolean
logOptions.format (1)
string
maglev.hashSeed (1)
string
maglev.tableSize (1)
number
monitor.enabled (1)
string
nativeRoutingCIDR (1)
string
nodePort.enabled (1)
boolean
pmtuDiscovery.enabled (1)
boolean
policyEnforcementMode (1)
string
relay.enabled (1)
boolean
relay.prometheus.serviceMonitor.enabled (1)
boolean
relay.rollOutPods (1)
boolean
service.loadBalancerIP (1)
string
tunnelPort (1)
number
tunnelProtocol (1)
string
ubeProxyReplacementHealthzBindAddr (1)
string
ui.enabled (1)
boolean
ui.rollOutPods (1)
boolean