Automated cherry pick of #18285: cilium: allow setting arbitrary cilium-config entries

k8s/crds/kops.k8s.io_clusters.yaml

@@ -5633,6 +5633,13 @@ spec:
                           The cluster is operated by cilium-etcd-operator.
                           Default: false
                         type: boolean
+                      extraConfig:
+                        additionalProperties:
+                          type: string
+                        description: |-
+                          ExtraConfig is appended to the cilium-config ConfigMap. Keys here override any value
+                          rendered by kops. All values must be strings (e.g. "true", not true).
+                        type: object
                       gatewayAPI:
                         description: GatewayAPI specifies the configuration for Cilium
                           Gateway API settings.

pkg/apis/kops/networking.go

@@ -528,6 +528,10 @@ type CiliumNetworkingSpec struct {
 
 	// GatewayAPI specifies the configuration for Cilium Gateway API settings.
 	GatewayAPI *CiliumGatewayAPISpec `json:"gatewayAPI,omitempty"`
+
+	// ExtraConfig is appended to the cilium-config ConfigMap. Keys here override any value
+	// rendered by kops. All values must be strings (e.g. "true", not true).
+	ExtraConfig map[string]string `json:"extraConfig,omitempty"`
 }
 
 // CiliumIngressSpec configures Cilium Ingress settings.

pkg/apis/kops/v1alpha2/networking.go

@@ -645,6 +645,10 @@ type CiliumNetworkingSpec struct {
 
 	// GatewayAPI specifies the configuration for Cilium Gateway API settings.
 	GatewayAPI *CiliumGatewayAPISpec `json:"gatewayAPI,omitempty"`
+
+	// ExtraConfig is appended to the cilium-config ConfigMap. Keys here override any value
+	// rendered by kops. All values must be strings (e.g. "true", not true).
+	ExtraConfig map[string]string `json:"extraConfig,omitempty"`
 }
 
 // CiliumIngressSpec configures Cilium Ingress settings.

pkg/apis/kops/v1alpha3/networking.go

@@ -476,6 +476,10 @@ type CiliumNetworkingSpec struct {
 
 	// GatewayAPI specifies the configuration for Cilium Gateway API settings.
 	GatewayAPI *CiliumGatewayAPISpec `json:"gatewayAPI,omitempty"`
+
+	// ExtraConfig is appended to the cilium-config ConfigMap. Keys here override any value
+	// rendered by kops. All values must be strings (e.g. "true", not true).
+	ExtraConfig map[string]string `json:"extraConfig,omitempty"`
 }
 
 // CiliumIngressSpec configures Cilium Ingress settings.

upup/models/cloudup/resources/addons/networking.cilium.io/k8s-1.16-v1.15.yaml.template

@@ -473,8 +473,11 @@ data:
   enable-non-default-deny-policies: "true"
   enable-source-ip-verification: "true"
 
-# Extra config allows adding arbitrary properties to the cilium config.
-# By putting it at the end of the ConfigMap, it's also possible to override existing properties.
+  # Extra config allows adding arbitrary properties to the cilium config.
+  # By putting it at the end of the ConfigMap, it's also possible to override existing properties.
+  {{- range $k, $v := .ExtraConfig }}
+  {{ $k }}: {{ printf "%q" $v }}
+  {{- end }}
 
 {{ if WithDefaultBool .Hubble.Enabled false }}
 ---