cilium helm installer

cilium-install.yaml

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cilium-install
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: cilium-install
  namespace: kube-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: cilium-install
  namespace: kube-system
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: cilium-installer-values
  namespace: kube-system
data:
  values.yaml: |-
    ipam:
      mode: kubernetes
    kubeProxyReplacement: true
    securityContext:
      capabilities:
        ciliumAgent:
          - CHOWN
          - KILL
          - NET_ADMIN
          - NET_RAW
          - IPC_LOCK
          - SYS_ADMIN
          - SYS_RESOURCE
          - DAC_OVERRIDE
          - FOWNER
          - SETGID
          - SETUID
        cleanCiliumState:
          - NET_ADMIN
          - SYS_ADMIN
          - SYS_RESOURCE
    cgroup:
      autoMount:
        enabled: false
      hostRoot: /sys/fs/cgroup 
    k8sServiceHost: localhost
    k8sServicePort: 7445
---
apiVersion: batch/v1
kind: Job
metadata:
  name: cilium-installer
  namespace: kube-system
spec:
  completions: 1
  ttlSecondsAfterFinished: 300
  template:
    spec:
      restartPolicy: OnFailure
      tolerations:
        - operator: Exists
        - effect: NoSchedule
          operator: Exists
        - effect: NoExecute
          operator: Exists
        - effect: PreferNoSchedule
          operator: Exists
        - key: node-role.kubernetes.io/control-plane
          operator: Exists
          effect: NoSchedule
        - key: node-role.kubernetes.io/control-plane
          operator: Exists
          effect: NoExecute
        - key: node-role.kubernetes.io/control-plane
          operator: Exists
          effect: PreferNoSchedule
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: node-role.kubernetes.io/control-plane
                    operator: Exists
      containers:
      - name: helm
        image: alpine/k8s:1.30.1
        volumeMounts:
          - name: values
            mountPath: /tmp
        command: ["helm"]
        args:
          - --namespace=kube-system
          - --repo=https://helm.cilium.io/
          - install
          - cilium
          - cilium
          - --version=1.15.6
          - --values=/tmp/values.yaml
      volumes:
        - name: values
          configMap:
            name: cilium-installer-values
      serviceAccount: cilium-install
      serviceAccountName: cilium-install