feat(cilium): add toggle to enable or disable the Envoy proxy (#695)

Add a `cilium_envoy` variable (default true, matching upstream Cilium 1.20
which installs Envoy by default) that controls whether the Envoy proxy is
deployed for Cilium L7 policies. Pass it to Helm as `envoy.enabled` so users
with no L7 policies can skip Envoy to save resources.

- roles/k3s_server_post/defaults/main.yml: add cilium_envoy: true default
- roles/k3s_server_post/tasks/cilium.yml: add --helm-set envoy.enabled to the
  install/upgrade command, driven by the cilium_envoy conditional
- inventory/sample/group_vars/all.yml: document cilium_envoy sample var
- .github/scripts/test-cilium-envoy-toggle.py: regression test asserting the
  install command carries the envoy.enabled helm-set and renders true/false
- .pre-commit-config.yaml: wire the new test into pre-commit

Co-authored-by: Léo Nonnenmacher <leo@nonnenmacher-logel.fr>

This commit is contained in:

Techno Tim

2026-08-05 00:00:39 -05:00

committed by

GitHub

parent c82f2e0415

commit 010551b8d2

5 changed files with 135 additions and 0 deletions

									
										roles/k3s_server_post/defaults/main.yml
									
		+1
		
												View File
												
				@@ -18,6 +18,7 @@ cilium_bgp_peer_asn: 64512

				cilium_bgp_neighbors: []

				cilium_bgp_neighbors_groups: ['k3s_all']

				cilium_bgp_lb_cidr: 192.168.31.0/24

				cilium_envoy: true

				cilium_hubble: true

				cilium_mode: native

				cilium_tag: v1.20.0