From a5a9d6447a4fcc7ef71ef92930a38555329ea394 Mon Sep 17 00:00:00 2001
From: Dasmat13 <gptdasmat@gmail.com>
Date: Thu, 6 Aug 2026 16:52:27 +0530
Subject: [PATCH] docs: add Cilium CNI integration example and documentation
 (#121)

---
 docs/book/src/examples/cni-readiness.md       | 34 ++++++++++++++++++-
 examples/cni-readiness/README.md              |  4 +++
 .../cilium-network-readiness-rule.yaml        | 17 ++++++++++
 3 files changed, 54 insertions(+), 1 deletion(-)
 create mode 100644 examples/cni-readiness/cilium-network-readiness-rule.yaml

diff --git a/docs/book/src/examples/cni-readiness.md b/docs/book/src/examples/cni-readiness.md
index 7ab3f45b..0e02afe3 100644
--- a/docs/book/src/examples/cni-readiness.md
+++ b/docs/book/src/examples/cni-readiness.md
@@ -143,4 +143,36 @@ To test this, add a new node to the cluster.
     Once Calico starts, the reporter will update it to `True`.
 
 3.  **Check Taint Removal**:
-    As soon as the condition becomes `True`, the Node Readiness Controller will remove the taint, and workloads will be scheduled.
\ No newline at end of file
+    As soon as the condition becomes `True`, the Node Readiness Controller will remove the taint, and workloads will be scheduled.
+
+## Cilium CNI Integration & Bootstrap Taints
+
+When using **Cilium** as your CNI plugin:
+
+1. **Align Bootstrap Taints**: Configure Cilium's agent not-ready taint flag to use the standardized `readiness.k8s.io/*` prefix:
+   ```yaml
+   # Helm values for Cilium
+   extraArgs:
+     - --agent-not-ready-taint-key=readiness.k8s.io/network-not-ready
+   ```
+
+2. **Bootstrap NodeReadinessRule**: Once Cilium initializes networking, it sets the built-in Kubernetes node condition `NetworkUnavailable=False`. You can define a rule to untaint nodes based on `NetworkUnavailable`:
+   ```yaml
+   # cilium-network-readiness-rule.yaml
+   apiVersion: readiness.node.x-k8s.io/v1alpha1
+   kind: NodeReadinessRule
+   metadata:
+     name: cilium-network-readiness-rule
+   spec:
+     conditions:
+       - type: "NetworkUnavailable"
+         requiredStatus: "False"
+     taint:
+       key: "readiness.k8s.io/network-not-ready"
+       effect: "NoSchedule"
+       value: "true"
+     enforcementMode: "bootstrap-only"
+   ```
+
+> [!NOTE]
+> Cilium updates `NetworkUnavailable=False` during node bootstrap. For continuous post-startup health monitoring, pair this with a custom DaemonSet probe and `enforcementMode: "continuous"`.
\ No newline at end of file
diff --git a/examples/cni-readiness/README.md b/examples/cni-readiness/README.md
index b50a2ce9..3dad2e19 100644
--- a/examples/cni-readiness/README.md
+++ b/examples/cni-readiness/README.md
@@ -10,3 +10,7 @@ This example demonstrates how to use the Node Readiness Controller to ensure nod
 3. The `NodeReadinessRule` (`network-readiness-rule.yaml`) instructs the controller to remove the startup taint once the `projectcalico.org/CalicoReady` condition becomes `True`.
 4. The reporter is deployed with `hostNetwork: true` to reach Calico's local health endpoint.
 5. The reporter needs a dedicated ServiceAccount (`cni-reporter`) with permissions to patch node status.
+
+### Cilium Integration:
+For Cilium CNI, configure `--agent-not-ready-taint-key=readiness.k8s.io/network-not-ready` and apply `cilium-network-readiness-rule.yaml` targeting `NetworkUnavailable=False`.
+
diff --git a/examples/cni-readiness/cilium-network-readiness-rule.yaml b/examples/cni-readiness/cilium-network-readiness-rule.yaml
new file mode 100644
index 00000000..0708335d
--- /dev/null
+++ b/examples/cni-readiness/cilium-network-readiness-rule.yaml
@@ -0,0 +1,17 @@
+apiVersion: readiness.node.x-k8s.io/v1alpha1
+kind: NodeReadinessRule
+metadata:
+  name: cilium-network-readiness-rule
+spec:
+  conditions:
+    - type: "NetworkUnavailable"
+      requiredStatus: "False"
+  taint:
+    key: "readiness.k8s.io/network-not-ready"
+    effect: "NoSchedule"
+    value: "true"
+  enforcementMode: "bootstrap-only"
+  nodeSelector:
+    matchExpressions:
+      - key: node-role.kubernetes.io/control-plane
+        operator: DoesNotExist