The cni-cilium module: configuration

Schema version: 1

• settings

  object
  • settings.activeL2NeighborDiscoveryEnabled

    boolean

    Enables the Cilium L2 neighbor discovery mechanism, which helps ensure that ARP table entries are kept up-to-date on all cluster nodes.

    Default: true

  • settings.bpfLBMode

    string

    eBPF LoadBalancer mode:

    • SNAT — traffic from the client to the pod (and back) passes through NAT, and accordingly the sender’s address is lost.
    • DSR — traffic from the client to the pod passes with the sender’s address preserved, and back - according to the routing rules (bypassing the balancer). This mode saves network traffic and reduces delays, but only works for TCP traffic.
    • Hybrid — TCP traffic is processed in DSR mode, and UDP traffic is processed in SNAT mode.

    Default: Hybrid

    Allowed values: SNAT, Hybrid, DSR

  • settings.createNodeRoutes

    boolean

    Create routes to Pods on other Nodes.

    All Nodes must be located in the same L2 domain.

  • settings.debugLogging

    boolean

    Enables debug logging for Cilium components.

    Default: false

  • settings.encryption

    object

    CNI Cilium encryption settings.

    • settings.encryption.mode

      string

      Encryption mode:

      • Disabled — encryption is disabled.

      • WireGuard — enables traffic encryption between pods using WireGuard.

        Note! Before using WireGuard encryption, please ensure that the Linux kernel running on the cluster nodes has support WireGuard (either via the CONFIG_WIREGUARD=m kernel config option on Linux 5.6 and newer, or using an external WireGuard module for older kernels).

        Note! Using WireGuard may cause significant CPU consumption by Cilium agent pods.

      Default: Disabled

      Allowed values: Disabled, WireGuard

    • settings.encryption.nodeToNodeModeEnabled

      boolean

      Enabling traffic encryption between nodes and pods in HostNetwork.

      Note! The node-to-node traffic from and to the control-plane nodes is left unencrypted to prevent possible communication issues when renewing WireGuard public keys. At the same time, the traffic between control-plane components is still encrypted at the application layer.

      Note! When this mode is active, NodePort and HostPort are not available from the PodNetwork.

      Default: false

  • settings.exclusiveCNIPlugin

    boolean

    Prevents additional CNI plugins from being enabled on cluster nodes. If the Istio module’s dataPlane.trafficRedirectionSetupMode setting is set to CNIPlugin, the option will be automatically set to false.

    Explicitly disabling this option is recommended only when using an additional CNI or a specific CNI plugin in the cluster. An example of such a use case could be the Linkerd CNI plugin.

    Default: true

  • settings.extraLoadBalancerAlgorithmsEnabled

    boolean

    Allows selectively overriding the load balancing algorithm using eBPF between backends for individual services. The annotation service.cilium.io/lb-algorithm is used for overriding with one of the following values: random, maglev, or least-conn.

    Note! This option requires the Linux kernel version on the nodes to be at least 5.15.

    Default: false

  • settings.ipv4OptionsGuard

    object

    Mitigation of CVE-2026-98432 (use-after-free in the Linux IPv4 TCP handshake triggered by a TCP SYN with IP options).

    A sidecar of the CNI agent installs a filter into the host network namespace and into every pod network namespace on the node, including pods started later. The filter matches IPv4 TCP SYN packets and IPv4 fragments carrying IP options.

    The filter follows the iptables mode (nft or legacy) that iptables-wrapper selects on the node, the same as the other Deckhouse components. In the nft mode, the filter uses native nftables expressions. In the legacy mode, it uses iptables with the u32 match. No kernel modules are loaded unless allowKernelModuleLoad is set. If the kernel modules of the selected mode are not loaded but those of the other mode are, the filter uses the other mode, and the node is reported by the D8IPv4OptionsGuardBackendMismatch alert. A node that cannot be protected is reported by the D8IPv4OptionsGuardNodeUnprotected alert.

    To exclude a node (for example, a node with CIPSO labeled networking), set the ipv4-options-guard.deckhouse.io/disabled: "true" label on it: the changes are reverted on that node.

    The mitigation does not fix the vulnerability: update the node kernel as soon as a fixed version is available.

    • settings.ipv4OptionsGuard.allowKernelModuleLoad

      boolean

      The filter needs the nf_tables kernel module in the nft mode and the ip_tables, iptable_raw, xt_tcpudp and xt_u32 kernel modules in the legacy mode.

      By default, kernel modules are not loaded: if a module of the mode selected by iptables-wrapper is not loaded, the filter uses the other mode when its modules are loaded, and the node is reported as unprotected otherwise. Set to true to load the modules of the selected mode.

      Default: false

    • settings.ipv4OptionsGuard.disableMPTCP

      boolean

      In the Enforce mode, set net.mptcp.enabled=0 in the host and in every pod network namespace. This removes the precondition of the published exploit.

      Listeners opened before the change stay MPTCP until the process is restarted. After a node reboot, MPTCP on the host is disabled again once the CNI agent starts.

      Default: true

    • settings.ipv4OptionsGuard.mode

      string

      Operating mode.

      If the mode is not set, it is Enforce in clusters installed with the mitigation and Audit in clusters that existed before it.

      • Audit — matching packets are only counted (the d8_ipv4_options_guard_matched_packets_total metric and the D8IPv4OptionsGuardMatchedTraffic alert). Use it to check that no workload relies on IP options. While any node is in this mode, the D8IPv4OptionsGuardAuditMode alert reminds that the cluster is not protected yet.
      • Enforce — matching packets are dropped, and MPTCP is disabled if disableMPTCP is set.
      • Disabled — the filter is removed from all network namespaces, including running pods, and net.mptcp.enabled is restored to the value it had before.

      The mode is applied without restarting the CNI agent pods.

      In the Audit and Enforce modes with bpfLBMode set to DSR or Hybrid, the backend node also removes the DSR IPv4 option from service packets before they reach the pod. Switching to or from Disabled turns this on or off and restarts the Cilium agents.

      Allowed values: Audit, Enforce, Disabled

  • settings.labelsRegex

    array of strings

    Cilium creates security identifiers based on the k8s entity labels. The more labels are involved in this process, the higher the access granularity that can be achieved. However, in large clusters, excessive granularity can create a heavy load. You can use the labelsRegex option to explicitly specify which labels are to be used for security policies, and which labels are to be neglected. Refer to the documentation to learn more about reducing the identity cardinality

    Each label must be specified by a RegExp expression in YAML quoted string format. Note that special characters must be escaped.

    Example:

    labelsRegex:
    - k8s:!app\.kubernetes\.io
    - k8s:io\.cilium\.k8s\.policy
    

  • settings.loadBalancerICMPReplyEnabled

    boolean

    Enable ICMP Echo Reply generation for LoadBalancer service IPs.

    When enabled, nodes respond to ICMP Echo Requests (ping) addressed to LoadBalancer external IPs.

    Default: false

  • settings.loadBalancerSourceRangeAllTypes

    boolean

    Enable loadBalancerSourceRanges CIDR filtering for all service types, not just LoadBalancer services. The corresponding NodePort and ClusterIP will also apply the CIDR filter. For more detailed information, please visit the link.

    Default: true

  • settings.masqueradeMode

    string

    Cilium masquerade work mode for pods traffic leaving the cluster.

    • BPF - use cilium BPF. Basic operation mode.

      In this mode, masquerade will not be used if the destination IP address is within the podSubnetCIDR or InternalIP/ExternalIP of any of the cluster nodes.

    • Netfilter - use kernel Netfilter(iptables/nf_tables).

      In this mode, masquerade will not be used if the destination IP address is within the podSubnetCIDR or InternalIP/ExternalIP of any of the cluster nodes.

    In BPF mode, if ExternalIP other than InternalIP is specified for a cluster node, and that IP address is not currently assigned to any interface on the node, it will not be reachable from neighboring nodes from pods network. The Netfilter mode allows you to bypass this limitation, but some other features stop working, such as EgressGateway.

    Default: BPF

    Allowed values: Netfilter, BPF

  • settings.nodePortAddresses

    array of strings

    List of CIDRs that restrict which node IP addresses are used for Cilium BPF NodePort listeners.

    Only addresses assigned to selected network devices and matching one of the configured CIDRs will be exposed as NodePort frontends.

    Example:

    nodePortAddresses:
    - 192.168.1.100/32
    - 10.0.0.0/8
    - 192.168.1.0/24
    

  • settings.policyAuditMode

    boolean

    Do not enforce any Network Policy. Just log allowed/disallowed connections.

    Default: false

  • settings.resourcesManagement

    Settings for CPU and memory requests and limits by cilium agent pods.

    Examples:

    resourcesManagement:
      mode: VPA
      vpa:
        mode: InPlaceOrRecreate
        cpu:
          min: 50m
          max: 2
          limitRatio: 1.5
        memory:
          min: 256Mi
          max: 2Gi
          limitRatio: 1.5
    

    resourcesManagement:
      mode: Static
      static:
        requests:
          cpu: 55m
          memory: 256Mi
        limits:
          cpu: 2
          memory: 2Gi
    

    resourcesManagement:
      mode: VPA
      vpa:
        mode: Auto
        cpu:
          min: 50m
          max: 2
          limitRatio: 1.5
        memory:
          min: 256Mi
          max: 2Gi
          limitRatio: 1.5
    

    • settings.resourcesManagement.mode

      string

      Resource management mode:

      • Static is a classic one. In it, you specify requests/limits. The parameters of this mode are defined in the static parameter section;
      • VPA mode uses VPA. You can configure this mode by modifying parameters in the vpa parameter section.

      Default: VPA

      Allowed values: VPA, Static

    • settings.resourcesManagement.static

      object

      Resource management options for the Static mode.

      • settings.resourcesManagement.static.limits

        object

        Configuring CPU and memory limits.

        • settings.resourcesManagement.static.limits.cpu

          string or number

          Configuring CPU limits.

          Pattern: ^[0-9]+m?$

        • settings.resourcesManagement.static.limits.memory

          string or number

          Configuring memory limits.

          Pattern: ^[0-9]+(\.[0-9]+)?(E|P|T|G|M|k|Ei|Pi|Ti|Gi|Mi|Ki)?$

      • settings.resourcesManagement.static.requests

        object

        Resource requests settings for pods.

        • settings.resourcesManagement.static.requests.cpu

          string or number

          Configuring CPU requests.

          Pattern: ^[0-9]+m?$

        • settings.resourcesManagement.static.requests.memory

          string or number

          Configuring memory requests.

          Pattern: ^[0-9]+(\.[0-9]+)?(E|P|T|G|M|k|Ei|Pi|Ti|Gi|Mi|Ki)?$

    • settings.resourcesManagement.vpa

      object

      Resource management options for the VPA mode.

      • settings.resourcesManagement.vpa.cpu

        object

        CPU-related VPA settings.

        • settings.resourcesManagement.vpa.cpu.limitRatio

          number

          The CPU limits/requests ratio.

          This ratio is used for calculating the initial CPU limits for a pod.

          If this parameter is set, the VPA will recalculate the CPU limits while maintaining the specified limits/requests ratio.

        • settings.resourcesManagement.vpa.cpu.max

          string or number

          The maximum value that the VPA can set for the CPU requests.

          Default: 4

          Pattern: ^[0-9]+m?$

        • settings.resourcesManagement.vpa.cpu.min

          string or number

          The minimum value that the VPA can set for the CPU requests.

          Default: 100m

          Pattern: ^[0-9]+m?$

      • settings.resourcesManagement.vpa.memory

        object

        Memory-related VPA settings.

        • settings.resourcesManagement.vpa.memory.limitRatio

          number

          The memory limits/requests ratio.

          This ratio is used for calculating the initial memory limits for a pod.

          If this parameter is set, the VPA will recalculate the memory limits while maintaining the specified limits/requests ratio.

        • settings.resourcesManagement.vpa.memory.max

          string or number

          The maximum memory requests the VPA can set.

          Default: 4Gi

          Pattern: ^[0-9]+(\.[0-9]+)?(E|P|T|G|M|k|Ei|Pi|Ti|Gi|Mi|Ki)?$

        • settings.resourcesManagement.vpa.memory.min

          string or number

          The minimum memory requests the VPA can set.

          Default: 128Mi

          Pattern: ^[0-9]+(\.[0-9]+)?(E|P|T|G|M|k|Ei|Pi|Ti|Gi|Mi|Ki)?$

      • settings.resourcesManagement.vpa.mode

        string

        VPA operating mode.

        • Initial — VPA sets initial values for pod resource requests and limits at pod creation time. Resource values are not changed automatically afterwards.

        • InPlaceOrRecreate — VPA attempts to update pod resources in place when supported by the cluster. If in-place updates are not possible, the pod will be recreated.

        • Auto — VPA automatically recreates pods to apply updated resource values.

          Starting from Deckhouse version 1.75, this mode is considered legacy. It is recommended to use InPlaceOrRecreate instead.

        Default: Initial

        Allowed values: Initial, InPlaceOrRecreate, Auto

  • settings.sctpEnabled

    boolean

    Enable SCTP support for Cilium (for both incoming and outgoing traffic).

    Note. Cilium implements only basic SCTP support. Therefore, when using SCTP with Cilium, please be aware of the following limitations:

    • The following features are not currently supported: SCTP multi-homing, NetworkPolicies for pod-to-VIP.
    • For incoming SCTP packets port overwriting is not supported. This means that applications must be published through either HostPort or Service, where the targetPort MUST match the port specified. Otherwise, the packet will be dropped.
    • For outgoing SCTP packets, only 1:1 SNAT is supported by default. In this mode, only the src_ip is replaced, while the src_port remains unchanged. If the src_port is already in use on the node, the packet will be rejected. To enable src_port substitution, you must switch the masqueradeMode parameter to Netfilter mode.

    Default: false

  • settings.svcSourceRangeCheck

    boolean

    For services of the loadBalancer type, enables checking the source IP for compliance with loadBalancer.sourceRanges. The check is not performed if access is made from within the cluster or the sourceRanges parameter is empty/not specified. Some cloud providers support filtering of incoming traffic based on the sourceRanges parameter in their loadBalancer implementations. In such cases, the cilium documentation recommends disabling the svcSourceRangeCheck option.

    Do not enable if another balancer or any type of SNAT is running in front of the services.

    Default: false

  • settings.tunnelMode

    string

    Tunnel mode.

    Note! After changing the parameter, it is necessary to restart all nodes, otherwise, there may be problems with the availability of Pods!

    Note! VXLAN mode is not compatible with following bpfLBMode modes: Hybrid, DSR. bpfLBMode will be overriden to SNAT if the tunnelMode is VXLAN.

    Default: Disabled

    Allowed values: Disabled, VXLAN