text: # ipam is the IPAM mode to use.
  #
  # Possible values:
  # - cluster-pool
  # - kubernetes
  # - eni
  # - azure
  # - crd
  #ipam: "cluster-pool"
  
  # identityChangeGracePeriod is the grace period that needs to pass
  # before an endpoint that has changed its identity will start using
  # that new identity. During the grace period, the new identity has
  # already been allocated and other nodes in the cluster have a chance
  # to whitelist the new upcoming identity of the endpoint.
  #identityChangeGracePeriod: "5s"
  
  #enableCnpStatusUpdates: false
  
  # bpfMapDynamicSizeRatio is the ratio (0.0-1.0) of total system memory to use
  # for dynamic sizing of CT, NAT, neighbor and SockRevNAT BPF maps. If set to
  # 0.0, dynamic sizing of BPF maps is disabled. The default value of 0.0025
  # (0.25%) leads to approximately the default CT size kube-proxy sets on a
  # node with 16 GiB of total system memory.
  #bpfMapDynamicSizeRatio: 0.0025
  
  # bpfMasquerade enables masquerading with BPF instead of iptables
  #bpfMasquerade: true
  
  # bpfClockProbe enables the probing and potential of a more efficient clock
  # source for the BPF datapath
  #bpfClockProbe: true
  
  # bpfTProxy enables the use of transparent proxying via mechanisms available
  # in Linux 5.7 or later.
  #bpfTProxy: false
  
  # sessionAffinity enable support for service sessionAffinity
  #sessionAffinity: true
  
  #healthChecking: true
  
  #synchronizeK8sNodes: true
  
  # enables non-drop mode for installed policies. In audit mode
  # packets affected by policies will not be dropped. Policy related
  # decisions can be checked via the policy verdict messages.
  #policyAuditMode: false
  
  # enables passing identity on local routes by using the mark fields. However,
  # in cases where this conflicts with a chained CNI plugin it may be disabled.
  #enableIdentityMark: true
  
  # Operator will exit if CRDs are not available within this duration upon
  # startup.
  #crdWaitTimeout: 5m
  
  # A list of labels to include or exclude from Cilium identity evaluation.
  #labels: "k8s:io.kubernetes.pod.namespace k8s:k8s-app k8s:app k8s:name"
  
  #disableEnvoyVersionCheck: false
  
  # Set the connection-tracking garbage collection interval. If not set, the value will be
  # calculated automatically on startup of cilium-agent. A low value will consume more CPU cycles.
  #conntrackGCInterval: "0s"
  