fix: remove NGINX hostNetwork; add cilium HostPort

roles/rke2/defaults/main.yml

@@ -66,15 +66,23 @@ default_manifests:
       user: ""
       password: ""
     cilium: #advanced here
-      bandwidthManager: true
       debug:
-        enabled: true
+        enabled: false
+      bandwidthManager: true
       preflight:
         enabled: false
       bpf:
         clockProbe: true
+      hostPort:
+        enabled: true
+      cni:
+        chainingMode: portmap
       containerRuntime:
         integration: auto
+      prometheus:
+        enabled: false
+        serviceMonitor:
+          enabled: false
       hubble:
         metrics:
           enabled:
@@ -84,6 +92,8 @@ default_manifests:
           - flow
           - icmp
           - http
+          serviceMonitor:
+            enabled: false
         relay:
           enabled: true
         ui:
@@ -106,6 +116,12 @@ default_manifests:
 
   config-nginx-ingress:
     enabled: false
+    hostNetwork: false
+    defaultBackend: false
+    enableAdmissionWebhooks: true
+    reportNodeInternalIp: false
+    externalTrafficPolicy: "Local" # or "Cluster"; see: https://kubernetes.github.io/ingress-nginx/deploy/baremetal/#bare-metal-considerations
+    externalIPs: []
     loadBalancerIP: ""
     loadBalancerSourceRanges: []
     metallbAddressPool: ""

roles/rke2/templates/manifests/config-nginx-ingress.j2

@@ -6,11 +6,13 @@ metadata:
 spec:
   valuesContent: |-
     defaultBackend:
-      enabled: true
+      enabled: {{ item.value.defaultBackend | bool | string | lower }}
     podSecurityPolicy:
       enabled: true
     controller:
-      config: 
+      hostNetwork: {{ item.value.hostNetwork | bool | string | lower }}
+      reportNodeInternalIp: {{ item.value.reportNodeInternalIp | bool | string | lower }}
+      config:
         use-forwarded-headers: "true"
         enable-underscores-in-headers: "true"
         proxy-add-original-uri-header: "true"
@@ -20,10 +22,10 @@ spec:
         default: true
       service:
         enabled: true
+        externalTrafficPolicy: {{ item.value.externalTrafficPolicy | bool | string | lower }}
         admissionWebhooks:
-          enabled: {{ item.value.enabledAdmissionWebhooks | default(false) }}
+          enabled: {{ item.value.enableAdmissionWebhooks | bool | string | lower }}
 {% if item.value.loadBalancerIP is defined and item.value.loadBalancerIP | length > 0 %}
-        externalTrafficPolicy: "Local"
         type: LoadBalancer
         loadBalancerIP: {{ item.value.loadBalancerIP }}
 {% if item.value.loadBalancerSourceRanges is defined and item.value.loadBalancerSourceRanges | length > 0 %}
@@ -33,10 +35,17 @@ spec:
 {% endfor %}
 {% endif %}
 {% if item.value.metallbAddressPool is defined and item.value.metallbAddressPool | length > 0 %}
-      hostNetwork: false 
       hostPort:
         enabled: false
       annotations:
         metallb.universe.tf/address-pool: {{ item.value.metallbAddressPool }}
 {% endif %}
+{% else %}
+        type: ClusterIP
+{% if item.value.externalIPs is defined and item.value.externalIPs | length > 0 %}
+        externalIPs:
+{% for sourceRange in item.value.externalIPs %}
+          - {{ externalIPs }}
+{% endfor %}
+{% endif %}
 {% endif %}
\ No newline at end of file