Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

CNI Options

Options for: cilium.

All options are under lab.clusters.<name>.components.

cilium.bandwidthManager.bbr

Enable BBR TCP congestion control

Type: boolean

Default: false

Declared in: modules/lab/cluster/components/cni/cilium.nix

cilium.bandwidthManager.enable

Enable bandwidth manager for rate limiting

Type: boolean

Default: false

Declared in: modules/lab/cluster/components/cni/cilium.nix

cilium.bgp.enable

Enable BGP control plane for advertising routes to external routers

Type: boolean

Default: false

Declared in: modules/lab/cluster/components/cni/cilium.nix

cilium.bgp.localASN

Local BGP Autonomous System Number for this cluster

Type: signed integer

Default: 65001

Declared in: modules/lab/cluster/components/cni/cilium.nix

cilium.bgp.peers

BGP peers to establish sessions with

Type: list of (submodule)

Default: [ ]

Declared in: modules/lab/cluster/components/cni/cilium.nix

cilium.bgp.peers.*.address

BGP peer IP address

Type: string

Declared in: modules/lab/cluster/components/cni/cilium.nix

cilium.bgp.peers.*.asn

BGP peer Autonomous System Number

Type: signed integer

Declared in: modules/lab/cluster/components/cni/cilium.nix

cilium.chart

Cilium Helm chart derivation (default: cataCharts.cilium)

Type: package

Default: <derivation helm-chart-https-helm.cilium.io-cilium-1.17.2>

Declared in: modules/lab/cluster/components/cni/cilium.nix

cilium.clusterMesh.clusterID

Unique cluster ID within the mesh (0-255)

Type: unsigned integer, meaning >=0

Default: 0

Declared in: modules/lab/cluster/components/cni/cilium.nix

cilium.clusterMesh.clusterName

Cluster name for mesh identity (default: cluster.name)

Type: null or string

Declared in: modules/lab/cluster/components/cni/cilium.nix

cilium.clusterMesh.enable

Enable multi-cluster networking via ClusterMesh

Type: boolean

Default: false

Declared in: modules/lab/cluster/components/cni/cilium.nix

cilium.egressGateway.enable

Enable egress gateway for controlled outbound traffic

Type: boolean

Default: false

Declared in: modules/lab/cluster/components/cni/cilium.nix

cilium.enable

Whether to enable Cilium CNI.

Type: boolean

Default: false

Example: true

Declared in: modules/lab/cluster/components/cni/cilium.nix

cilium.encryption.enable

Enable transparent encryption of pod-to-pod traffic

Type: boolean

Default: false

Declared in: modules/lab/cluster/components/cni/cilium.nix

cilium.encryption.nodeEncryption

Also encrypt node-to-node traffic

Type: boolean

Default: false

Declared in: modules/lab/cluster/components/cni/cilium.nix

cilium.encryption.type

Encryption backend (WireGuard recommended)

Type: one of "wireguard", "ipsec"

Default: "wireguard"

Declared in: modules/lab/cluster/components/cni/cilium.nix

cilium.gatewayAPI.enable

Enable Kubernetes Gateway API support (replaces legacy Ingress)

Type: boolean

Default: true

Declared in: modules/lab/cluster/components/cni/cilium.nix

cilium.gatewayAPI.tls.domain

Base domain for wildcard cert (e.g. homelab.test → *.homelab.test)

Type: string

Default: ""

Declared in: modules/lab/cluster/components/cni/cilium.nix

cilium.gatewayAPI.tls.enable

Enable HTTPS listener on the default Gateway with cert-manager TLS

Type: boolean

Default: false

Declared in: modules/lab/cluster/components/cni/cilium.nix

cilium.gatewayAPI.tls.issuerRef

cert-manager issuer for the Gateway wildcard certificate

Type: submodule

Default:

{
  kind = "ClusterIssuer";
  name = "lab-ca";
}

Declared in: modules/lab/cluster/components/cni/cilium.nix

cilium.gatewayAPI.tls.issuerRef.kind

Issuer kind

Type: string

Default: "ClusterIssuer"

Declared in: modules/lab/cluster/components/cni/cilium.nix

cilium.gatewayAPI.tls.issuerRef.name

cert-manager Issuer or ClusterIssuer name

Type: string

Declared in: modules/lab/cluster/components/cni/cilium.nix

cilium.gatewayAPI.tls.passthrough.enable

Enable TLS passthrough listener on the Gateway (for backends that terminate TLS themselves)

Type: boolean

Default: false

Declared in: modules/lab/cluster/components/cni/cilium.nix

cilium.hubble.enable

Enable Hubble network observability

Type: boolean

Default: true

Declared in: modules/lab/cluster/components/cni/cilium.nix

cilium.hubble.relay.enable

Enable Hubble Relay

Type: boolean

Default: true

Declared in: modules/lab/cluster/components/cni/cilium.nix

cilium.hubble.ui.enable

Enable Hubble UI dashboard

Type: boolean

Default: false

Declared in: modules/lab/cluster/components/cni/cilium.nix

cilium.ingressController.enable

Enable Cilium’s native ingress controller

Type: boolean

Default: false

Declared in: modules/lab/cluster/components/cni/cilium.nix

cilium.ingressController.loadbalancerMode

LoadBalancer mode for ingress

Type: one of "shared", "dedicated"

Default: "shared"

Declared in: modules/lab/cluster/components/cni/cilium.nix

cilium.ipam.mode

IP Address Management mode

Type: one of "kubernetes", "cluster-pool"

Default: "kubernetes"

Declared in: modules/lab/cluster/components/cni/cilium.nix

cilium.k8sServiceHost

Kubernetes API server host. When null, auto-configured based on cluster provider:

  • external (CAPI): uses Kubernetes service ClusterIP (10.96.0.1)
  • docker (k3d): uses localhost

Type: null or string

Declared in: modules/lab/cluster/components/cni/cilium.nix

cilium.k8sServicePort

Kubernetes API server port. When null, auto-configured based on cluster provider:

  • external (CAPI): 443 (Kubernetes service port)
  • docker (k3d): 6443

Type: null or string

Declared in: modules/lab/cluster/components/cni/cilium.nix

cilium.kubeProxyReplacement

Replace kube-proxy with eBPF-based load balancing

Type: boolean

Default: true

Declared in: modules/lab/cluster/components/cni/cilium.nix

cilium.l2.announcements

Enable L2 (ARP/NDP) announcements for service IPs

Type: boolean

Default: false

Declared in: modules/lab/cluster/components/cni/cilium.nix

cilium.lbIPAM.enable

Enable LoadBalancer IP Address Management

Type: boolean

Default: false

Declared in: modules/lab/cluster/components/cni/cilium.nix

cilium.lbIPAM.pools

IP address pools for LoadBalancer services

Type: list of (submodule)

Default: [ ]

Declared in: modules/lab/cluster/components/cni/cilium.nix

cilium.lbIPAM.pools.*.cidrs

CIDR ranges for IP allocation

Type: list of string

Default: [ ]

Declared in: modules/lab/cluster/components/cni/cilium.nix

cilium.lbIPAM.pools.*.name

Pool name

Type: string

Default: "default"

Declared in: modules/lab/cluster/components/cni/cilium.nix

cilium.networkPolicy.clusterNetworkPolicy

Enable CiliumClusterwideNetworkPolicy CRD

Type: boolean

Default: false

Declared in: modules/lab/cluster/components/cni/cilium.nix

cilium.networkPolicy.enable

Enable Kubernetes NetworkPolicy enforcement

Type: boolean

Default: true

Declared in: modules/lab/cluster/components/cni/cilium.nix

cilium.networkPolicy.hostFirewall

Enable host-level firewall enforcement

Type: boolean

Default: false

Declared in: modules/lab/cluster/components/cni/cilium.nix

cilium.networkPolicy.policyAuditMode

Audit mode — log policy violations instead of enforcing

Type: boolean

Default: false

Declared in: modules/lab/cluster/components/cni/cilium.nix

cilium.operator.replicas

Number of Cilium operator replicas

Type: positive integer, meaning >0

Default: 1

Declared in: modules/lab/cluster/components/cni/cilium.nix

cilium.phase

Deployment phase this component belongs to

Type: string

Default: "networking"

Declared in: modules/lab/cluster/components/cni/cilium.nix

cilium.ref

Computed references for Cilium

Type: attribute set

Default: { }

Declared in: modules/lab/cluster/components/cni/cilium.nix

cilium.version

Cilium version

Type: string

Default: "1.16.3"

Declared in: modules/lab/cluster/components/cni/cilium.nix