Initial commit

scripts/cilium-bootstrap.sh

@@ -0,0 +1,72 @@
+#!/bin/bash
+# Cilium Bootstrap - Install Cilium CNI before helmfile
+# Nodes require a CNI to become Ready. This script installs Cilium via Helm
+# and applies L2 announcement policies (replacing MetalLB).
+#
+# Usage: ./scripts/cilium-bootstrap.sh
+
+set -euo pipefail
+
+echo "================================================="
+echo "Cilium CNI Bootstrap"
+echo "================================================="
+echo ""
+
+# Add Cilium Helm repo
+echo "Adding Cilium Helm repository..."
+helm repo add cilium https://helm.cilium.io 2>/dev/null || true
+helm repo update cilium
+
+# Check if Cilium is already installed
+if helm -n kube-system status cilium >/dev/null 2>&1; then
+  echo "✅ Cilium is already installed"
+  echo ""
+  echo "Upgrading Cilium to match helmfile values..."
+  helm upgrade cilium cilium/cilium \
+    --namespace kube-system \
+    --values infrastructure/cilium/values.yaml \
+    --wait --timeout 300s
+else
+  echo "Installing Cilium CNI..."
+  helm install cilium cilium/cilium \
+    --namespace kube-system \
+    --values infrastructure/cilium/values.yaml \
+    --wait --timeout 300s
+fi
+
+echo ""
+echo "Waiting for Cilium to be ready..."
+kubectl -n kube-system rollout status daemonset/cilium --timeout=300s
+
+echo ""
+echo "Applying L2 announcement policy and IP pool..."
+kubectl apply -f infrastructure/cilium/l2-announcement-policy.yaml
+
+echo ""
+echo "Applying baseline network policies..."
+kubectl apply -f infrastructure/cilium/network-policies/dns.yaml
+
+# Apply per-namespace policies only if namespaces exist
+for ns in vault authentik rook-ceph; do
+  if kubectl get ns "$ns" >/dev/null 2>&1; then
+    kubectl apply -f infrastructure/cilium/network-policies/baseline.yaml 2>/dev/null || true
+    break
+  fi
+done
+
+echo ""
+echo "Verifying Cilium status..."
+kubectl -n kube-system exec ds/cilium -- cilium status --brief 2>/dev/null || echo "  (cilium CLI check will be available after pods stabilize)"
+
+echo ""
+echo "Checking node readiness..."
+kubectl get nodes -o wide
+
+echo ""
+echo "Verifying L2 announcements..."
+kubectl get ciliuml2announcementpolicy,ciliumloadbalancerippool 2>/dev/null || echo "  (L2 CRDs being registered...)"
+
+echo ""
+echo "================================================="
+echo "✅ Cilium CNI bootstrap complete"
+echo "================================================="