time="2025-07-15T12:07:21Z" level=info msg="DataStore closed" subsystem_name=catalog
time="2025-07-15T12:07:21Z" level=error msg="Fatal run error" error="listen unix /tmp/spire-server/private/api.sock: bind: permission denied"
time="2025-07-15T12:07:21Z" level=error msg="Server crashed" error="listen unix /tmp/spire-server/private/api.sock: bind: per ││ mission denied"

SERVER versions
1.10.4: sha256:4e77ca7017e5279af36cd2bc2fa9ba06a164b5bc352404a03bc4812881498ee8
1.11.3: sha256:fb2829b45b9c2b1ee47c3264de76375f03e9c0a0ae37188404b103aaeccadb46
1.12.4: sha256:34147f27066ab2be5cc10ca1d4bfd361144196467155d46c45f3519f41596e49


AGENT version
1.10.4: sha256:ecb3e00fa38d38e0166a678e4c4c1e1b3517b63a37e2a57154e7f5d5d0ee1f98
1.11.3: sha256:38b39a91441d646aba5fa518fffda30a14918f24af117b483529a271a96e5001
1.12.4: sha256:163970884fba18860cac93655dc32b6af85a5dcf2ebb7e3e119a10888eff8fcd

resource "helm_release" "cilium" {
  repository = "https://helm.cilium.io/"
  chart      = "cilium"
  version    = var.cilium_version

  name      = "cilium"
  namespace = "kube-system"
  # allow ample time at cluster bootstrap mainly due to ASG nodes coming up
  timeout = "900"

  set {
    name  = "cni.exclusive"
    value = "true"
  }

  set {
    name  = "enableIPv4Masquerade"
    value = "false"
  }

  set {
    name  = "routingMode"
    value = "native"
  }

  set {
    name  = "ipam.mode"
    value = "eni"
  }

  set {
    name  = "eni.enabled"
    value = "true"
  }

  set {
    name  = "eni.awsEnablePrefixDelegation"
    value = "true"
  }

  set {
    name  = "egressMasqueradeInterfaces"
    value = "ens+"
  }

  set {
    name  = "endpointRoutes.enabled"
    value = "true"
  }

  set {
    name  = "hubble.relay.enabled"
    value = "true"
  }

  set {
    name  = "hubble.ui.enabled"
    value = "true"
  }

  set {
    name  = "hubble.metrics.enabled"
    value = "{dns,drop,tcp,flow,port-distribution,icmp,httpV2:exemplars=true;labelsContext=source_ip\\,source_namespace\\,source_workload\\,destination_ip\\,destination_namespace\\,destination_workload\\,traffic_direction}"
  }

  # enables cilium agent metrics
  set {
    name  = "prometheus.enabled"
    value = "true"
  }

  # enables cilium operator metrics
  set {
    name  = "operator.prometheus.enabled"
    value = "true"
  }

  # given this, do not install kube-proxy or expect to see it
  set {
    name  = "kubeProxyReplacement"
    value = "true"
  }

  set {
    name  = "k8sServiceHost"
    value = replace(module.eks.cluster_endpoint, "https://", "")
  }

  set {
    name  = "k8sServicePort"
    value = "443"
  }

  # e2e encryption, node <-> pod, pod <-> pod
  set {
    name  = "encryption.enabled"
    value = "true"
  }

  set {
    name  = "encryption.type"
    value = "wireguard"
  }

  set {
    name  = "encryption.nodeEncryption"
    value = "true"
  }

  # mTLS (through SPIRE) - using values block for complex objects
  values = [
    yamlencode({
      authentication = {
        mutual = {
          spire = {
            install = {
              agent = {
                image = {
                  digest     = var.cilium_spire_version.agent.sha256
                  repository = "ghcr.io/spiffe/spire-agent"
                  tag        = var.cilium_spire_version.agent.version
                  pullPolicy = "IfNotPresent"
                  useDigest  = true
                }
              }
              server = {
                image = {
                  digest     = var.cilium_spire_version.server.sha256
                  repository = "ghcr.io/spiffe/spire-server"
                  tag        = var.cilium_spire_version.server.version
                  pullPolicy = "IfNotPresent"
                  useDigest  = true
                }
                # changed from the default helm value v1.9.6 to 1.10.x
                # If upgrading, you need to fiddle with EBS permissions or start over
                # See PR #3722
                podSecurityContext = {
                  runAsUser  = 1000
                  runAsGroup = 1000
                  fsGroup    = 1000
                }
              }
            }
          }
        }
      }
    })
  ]

  set {
    name  = "authentication.mutual.spire.enabled"
    value = "true"
  }

  set {
    name  = "authentication.mutual.spire.install.enabled"
    value = "true"
  }

  # node firewall
  set {
    name  = "hostFirewall.enabled"
    value = "true"
  }

  set {
    name  = "envoy.idleTimeoutDurationSeconds"
    value = "180"
  }

  set {
    name  = "operator.replicas"
    value = "3"
  }

  set {
    name  = "dnsProxy.dnsRejectResponseCode"
    value = "nameError"
  }
}