Skip to content

chore(cilium): drop externalIPs.enabled and nodePort.enabled - #4953

Open
Nimesh (GitNimay) wants to merge 2 commits into
cozystack:mainfrom
GitNimay:chore/cilium-drop-unread-values
Open

Nimesh (GitNimay) wants to merge 2 commits into
cozystack:mainfrom
GitNimay:chore/cilium-drop-unread-values

Conversation

@GitNimay

@GitNimay Nimesh (GitNimay) commented Oct 19, 2026 •

Copy link
Copy Markdown

What this PR does

Removes cilium.externalIPs.enabled and cilium.nodePort.enabled from packages/system/cilium/values.yaml. The vendored Cilium chart (1.20.2) reads neither key: there is no externalIPs value upstream, and from nodePort the templates read only range, addresses, bindProtection, autoProtectPortRange, directRoutingDevice, enableHealthCheck, enableHealthCheckLoadBalancerIP and enableDynamicSourceLookup. Both features follow kubeProxyReplacement, which stays true, so the keys only misled readers into thinking they toggle anything.

Verified locally:

  • make test in packages/system/cilium: 4 suites, 26 tests pass.
  • helm template output is byte-identical before and after for the default values and for each of values-talos.yaml, values-kubeovn.yaml, values-kilo.yaml and values-apparmor.yaml.

Fixes #4816

Screenshots

Not a UI change.

Downstream repositories

Release note

chore(cilium): remove the unused externalIPs.enabled and nodePort.enabled values, which the Cilium chart never read; no runtime change.

Summary by CodeRabbit

  • Configuration Changes
    • Cilium no longer enables external IP or NodePort service exposure. LoadBalancer configuration remains enabled. Services relying on external IPs or NodePorts may need a different exposure method.

@github-actions github-actions Bot added size/XS This PR changes 0-9 lines, ignoring generated files area/cilium Issues or PRs related to Cilium (agent, operator, Gateway API, network policy, LB-IPAM) kind/cleanup Categorizes issue or PR as related to cleanup of code, process, or technical debt labels Oct 19, 2026
@coderabbitai

coderabbitai Bot commented Oct 19, 2026 •

Copy link
Copy Markdown
Contributor

Review in Change Stack →

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

Run configuration

Commits

Reviewing files that changed from the base of the PR and between 700600e and f8217be.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Trigger review

No actionable comments were generated in the recent review.

Walkthrough

The Cilium values no longer set the externalIPs.enabled and nodePort.enabled switches. The load balancer configuration remains unchanged.

Changes: Cilium values cleanup

Layer / File(s) Summary
Remove unused switches
packages/system/cilium/values.yaml
Removes the externalIPs.enabled and nodePort.enabled settings. The load balancer configuration remains.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other · Severity of issue fixed: Low

Merge Risk: Minimal · previous review 980de

This cleanup removes two unused Cilium values that could be mistaken for feature toggles. No runtime behavior change is expected, so merging carries minimal risk.

Pre-merge checks: Passed 4

Check name Status Explanation
Title check Passed The title clearly and concisely states the main change: removing the unused Cilium external IP and NodePort settings.
Linked Issues check Passed Issue #4816 requires removal of cilium.externalIPs.enabled and cilium.nodePort.enabled from packages/system/cilium/values.yaml. The whole-PR diff removes both declarations and no other value dec…
Out of Scope Changes check Passed The diff contains only the four lines that define the two unused values in packages/system/cilium/values.yaml. The remaining loadBalancer configuration is unchanged. The change directly implements…
Description Check Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Full details: Linked Issues check

Explanation

Issue #4816 requires removal of cilium.externalIPs.enabled and cilium.nodePort.enabled from packages/system/cilium/values.yaml. The whole-PR diff removes both declarations and no other value declarations. The PR reports unchanged rendered output for the default values and four listed variants, plus passing package tests. This supports the required no-runtime-change behavior.

Full details: Out of Scope Changes check

Explanation

The diff contains only the four lines that define the two unused values in packages/system/cilium/values.yaml. The remaining loadBalancer configuration is unchanged. The change directly implements issue #4816 and shows no unrelated change.

Finishing Touches

🧪 Generate unit tests (beta)

  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

ℹ️ Recent review info

⚙️ Run configuration

  • Configuration used: Repository: cozystack/cozystack/.coderabbit.yaml
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 22b29244-49af-4784-8c32-4b4a7ff83536
📥 Commits

Reviewing files that changed from the base of the PR and between aed7fa8 and 980de9d.

📒 Files selected for processing: 1

  • packages/system/cilium/values.yaml
💤 Files with no reviewable changes: 1

  • packages/system/cilium/values.yaml

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

@lexfrei

Copy link
Copy Markdown
Contributor

Nimesh (@GitNimay) I merged main into your branch (990f37c) so CI runs against the current base. Your commits are unchanged.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nimesh (@GitNimay) LGTM, CI and E2E are green on this head. Optional: the commit message lists the nodePort keys the chart still reads but leaves out range, directRoutingDevice and enableDynamicSourceLookup; complete the list or drop it if you rewrite the commit.

The vendored Cilium chart reads neither key: there is no externalIPs
value upstream, and from the nodePort block the templates read only
range, addresses, bindProtection, autoProtectPortRange,
directRoutingDevice, enableHealthCheck, enableHealthCheckLoadBalancerIP
and enableDynamicSourceLookup. Both features follow
kubeProxyReplacement, which stays true, so the keys only misled readers
into thinking they toggle anything.

Fixes cozystack#4816

Assisted-by: LLM
Signed-off-by: Nimesh Kulkarni <[email protected]>
@GitNimay
Nimesh (GitNimay) force-pushed the chore/cilium-drop-unread-values branch from 990f37c to 700600e Compare November 13, 2026 16:10
@GitNimay

Copy link
Copy Markdown
Author

Thanks for the review! I rewrote the commit. Its message now lists every nodePort key the chart still reads: range, addresses, bindProtection, autoProtectPortRange, directRoutingDevice, enableHealthCheck, enableHealthCheckLoadBalancerIP and enableDynamicSourceLookup. I also rebased it onto the current main, so the merge commit is gone, and added range to the PR description, which was missing it too. The diff is unchanged, and make test in packages/system/cilium still passes (26/26).

Assisted-by: LLM
Signed-off-by: Aleksei Sviridkin <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/cilium Issues or PRs related to Cilium (agent, operator, Gateway API, network policy, LB-IPAM) kind/cleanup Categorizes issue or PR as related to cleanup of code, process, or technical debt size/XS This PR changes 0-9 lines, ignoring generated files

Projects

None yet

Development

Successfully merging this pull request may close these issues.

chore(cilium): drop externalIPs.enabled and nodePort.enabled, the Cilium chart does not read them

2 participants