cilium

1
name: cilium-config
2
description: Derive Cilium installation config
3
inputs:
4
  image-tag:
5
    description: 'SHA or tag'
6
    required: false
7
  chart-dir:
8
    description: 'Path to Cilium charts directory'
9
    required: true
10
  tunnel:
11
    description: '"disabled", "vxlan", "geneve"'
12
    default: 'disabled'
13
  endpoint-routes:
14
    description: 'Enable endpoint routes'
15
    default: false
16
  ipv6:
17
    description: 'Enable IPv6'
18
    default: true
19
  kpr:
20
    description: 'Enable kube-proxy replacement'
21
    default: false
22
  lb-mode:
23
    description: 'KPR load-balancer mode'
24
    default: 'snat'
25
  lb-acceleration:
26
    description: 'KPR acceleration'
27
    default: ''
28
  encryption:
29
    description: '"ipsec", "wireguard" or empty'
30
    default: ''
31
  encryption-node:
32
    description: 'Enable node-to-node encryption (WireGuard only)'
33
    default: false
34
  egress-gateway:
35
    description: 'Enable egress gateway'
36
    default: false
37
  host-fw:
38
    description: 'Enable host firewall'
39
    default: false
40
  mutual-auth:
41
    description: 'Enable mTLS-based Mutual Authentication'
42
    default: true
43
  ingress-controller:
44
    description: 'Enable ingress controller, required kubeProxyReplacement'
45
    default: false
46
  devices:
47
    description: 'List of native devices to attach datapath programs'
48
    default: ''
49
  misc:
50
    description: 'Misc helm rarely set by a user coma separated values'
51
    default: ''
52
outputs:
53
  config:
54
    description: 'Cilium installation config'
55
    value: ${{ steps.derive-config.outputs.config }}
56
runs:
57
  using: composite
58
  steps:
59
    - uses: ./.github/actions/set-env-variables
60
    - shell: bash
61
      id: derive-config
62
      run: |
63
        DEFAULTS="--wait \
64
            --chart-directory=${{ inputs.chart-dir }} \
65
            --helm-set=debug.enabled=true \
66
            --helm-set=debug.verbose=envoy \
67
            --helm-set=hubble.eventBufferCapacity=65535 \
68
            --helm-set=bpf.monitorAggregation=none \
69
            --helm-set=cluster.name=default \
70
            --helm-set=authentication.mutual.spire.enabled=${{ inputs.mutual-auth }} \
71
            --nodes-without-cilium=kind-worker3 \
72
            --helm-set-string=kubeProxyReplacement=${{ inputs.kpr }} \
73
            --set='${{ inputs.misc }}'"
74

75
          IMAGE=""
76
          if [ "${{ inputs.image-tag }}" != "" ]; then
77
            IMAGE="--helm-set=image.repository=quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/cilium-ci \
78
            --helm-set=image.useDigest=false \
79
            --helm-set=image.tag=${{ inputs.image-tag }} \
80
            --helm-set=operator.image.repository=quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/operator \
81
            --helm-set=operator.image.suffix=-ci \
82
            --helm-set=operator.image.tag=${{ inputs.image-tag }} \
83
            --helm-set=operator.image.useDigest=false \
84
            --helm-set=hubble.relay.image.repository=quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/hubble-relay-ci \
85
            --helm-set=hubble.relay.image.tag=${{ inputs.image-tag }} \
86
            --helm-set=hubble.relay.image.useDigest=false"
87
          fi
88

89
          TUNNEL="--helm-set-string=tunnelProtocol=${{ inputs.tunnel }}"
90
          if [ "${{ inputs.tunnel }}" == "disabled" ]; then
91
            TUNNEL="--helm-set-string=routingMode=native --helm-set-string=autoDirectNodeRoutes=true --helm-set-string=ipv4NativeRoutingCIDR=10.244.0.0/16"
92
            TUNNEL="${TUNNEL} --helm-set-string=ipv6NativeRoutingCIDR=fd00:10:244::/56"
93
          fi
94

95
          DEVICES=""
96
          if [ "${{ inputs.devices }}" != "" ]; then
97
            DEVICES="--helm-set=devices='${{ inputs.devices }}'"
98
          fi
99

100
          LB_MODE=""
101
          if [ "${{ inputs.lb-mode }}" != "" ]; then
102
            LB_MODE="--helm-set-string=loadBalancer.mode=${{ inputs.lb-mode }}"
103
          fi
104

105
          ENDPOINT_ROUTES=""
106
          if [ "${{ inputs.endpoint-routes }}" == "true" ]; then
107
            ENDPOINT_ROUTES="--helm-set-string=endpointRoutes.enabled=true"
108
          fi
109

110
          IPV6=""
111
          if [ "${{ inputs.ipv6 }}" != "false" ]; then
112
            IPV6="--helm-set=ipv6.enabled=true"
113
          fi
114

115
          MASQ=""
116
          if [ "${{ inputs.kpr }}" == "true" ]; then
117
            # BPF-masq requires KPR=true.
118
            MASQ="--helm-set=bpf.masquerade=true"
119
            if [ "${{ inputs.host-fw }}" == "true" ]; then
120
              # BPF IPv6 masquerade not currently supported with host firewall - GH-26074
121
              MASQ="${MASQ} --helm-set=enableIPv6Masquerade=false"
122
            fi
123
          fi
124

125
          EGRESS_GATEWAY=""
126
          if [ "${{ inputs.egress-gateway }}" == "true" ]; then
127
            EGRESS_GATEWAY="${{ env.EGRESS_GATEWAY_HELM_VALUES }}"
128
          fi
129

130
          LB_ACCELERATION=""
131
          if [ "${{ inputs.lb-acceleration }}" != "" ]; then
132
            LB_ACCELERATION="--helm-set=loadBalancer.acceleration=${{ inputs.lb-acceleration }}"
133
          fi
134

135
          ENCRYPT=""
136
          if [ "${{ inputs.encryption }}" != "" ]; then
137
            ENCRYPT="--helm-set=encryption.enabled=true --helm-set=encryption.type=${{ inputs.encryption }}"
138
            if [ "${{ inputs.encryption-node }}" != "" ]; then
139
              ENCRYPT+=" --helm-set=encryption.nodeEncryption=${{ inputs.encryption-node }}"
140
            fi
141
          fi
142

143
          HOST_FW=""
144
          if [ "${{ inputs.host-fw }}" == "true" ]; then
145
            HOST_FW="--helm-set=hostFirewall.enabled=true"
146
          fi
147

148
          if [ "${{ inputs.kpr }}" == "true" ]; then
149
            if [ "${{ inputs.ingress-controller }}" == "true" ]; then
150
              INGRESS_CONTROLLER="--helm-set=ingressController.enabled=true"
151
              INGRESS_CONTROLLER+=" --helm-set=ingressController.service.type=NodePort"
152
            fi
153
          fi
154
        
155
          CONFIG="${DEFAULTS} ${IMAGE} ${TUNNEL} ${DEVICES} ${LB_MODE} ${ENDPOINT_ROUTES} ${IPV6} ${MASQ} ${EGRESS_GATEWAY} ${ENCRYPT} ${HOST_FW} ${LB_ACCELERATION} ${INGRESS_CONTROLLER}"
156
          echo "config=${CONFIG}" >> $GITHUB_OUTPUT
157