> ## Documentation Index > Fetch the complete documentation index at: https://docs.celum.io/llms.txt > Use this file to discover all available pages before exploring further. # Validate cilium install > Gateway API CRD drift — the bundle is applied at install time and **Authorisation:** `cilium:GetDefaults` on `krn:celum:supervisor:{name}:cilium:*`. ## OpenAPI ````yaml /openapi.json post /api/supervisors/{name}/cilium/install/validate openapi: 3.0.3 info: description: >- The HTTP surface of the Celum backend, generated from its own router and authorisation map — so this list cannot drift from the server that serves it. **Every operation states the IAM action and resource it is authorised against.** That pairing is the part worth reading: a policy naming the right action against the wrong resource matches nothing, and fails silently. Request and response bodies come from the Go types the handlers send and decode. Where those types do not determine the shape (an interface, a map[string]any, an unknown custom encoding), the operation says so in `x-celum-schema-gap` instead of carrying a guessed schema. title: Celum API version: 1.0.0 servers: - description: Your Celum deployment url: https://{host} variables: host: default: celum.example.com description: The host your Celum backend is served from security: - sessionCookie: [] - bearerToken: [] tags: - description: AI assistant & MCP name: ai-assistant - description: Clusters & CAPI lifecycle name: capi - description: Certificates & external secrets name: certs - description: GitOps & apps name: gitops - description: IAM, audit & auth name: iam - description: Image library name: images - description: Infrastructure & supervisors name: infrastructure - description: Networking name: networking - description: Observability & platform health name: observability - description: Platform onboarding & settings name: platform-settings - description: Projects name: projects - description: Registries & mirroring name: registries - description: Security & flows name: security - description: Storage name: storage - description: Templates & addons name: templates - description: Virtualization platform (KubeVirt/CDI) name: virt - description: Virtual machines name: vms - description: Workloads & topology name: workloads paths: /api/supervisors/{name}/cilium/install/validate: post: tags: - networking summary: Validate cilium install description: >- Gateway API CRD drift — the bundle is applied at install time and **Authorisation:** `cilium:GetDefaults` on `krn:celum:supervisor:{name}:cilium:*`. operationId: post_supervisors_byName_cilium_install_validate parameters: - description: >- The supervisor's name, as registered under Administration → Supervisors. in: path name: name required: true schema: type: string requestBody: content: application/json: schema: properties: bgp: nullable: true type: boolean clusterId: format: int64 nullable: true type: integer egress: nullable: true type: boolean envoy: nullable: true type: boolean gatewayApi: nullable: true type: boolean hubble: nullable: true type: boolean ingress: nullable: true type: boolean values: allOf: - $ref: '#/components/schemas/cilium.HelmReleaseConfig.Input' nullable: true type: object type: object required: false responses: '200': content: application/json: schema: $ref: '#/components/schemas/api.ciliumValidateResponse' description: Success. '400': content: application/json: schema: $ref: '#/components/schemas/api.ErrorBody' description: Bad Request. '401': description: Not authenticated — no valid session cookie or API token. '403': description: >- Authenticated, but no policy allows this action on this resource. The body carries the action and resource that were evaluated. components: schemas: cilium.HelmReleaseConfig.Input: properties: bgpControlPlane: type: boolean bpfLbMode: type: string chartSource: type: string chartVersion: type: string clusterID: format: int64 type: integer clusterMeshEnabled: type: boolean clusterName: type: string clusterPoolIpv4Cidr: type: string clusterPoolIpv4MaskSize: format: int64 type: integer devices: type: string directRoutingDevice: type: string disableSourceIPVerification: type: boolean egressGatewayEnabled: type: boolean enableBandwidthManagerBBR: type: boolean enableBpfConntrackAccount: type: boolean enableBpfMasquerade: type: boolean enableEndpointRoutes: type: boolean enableEnvoyConfig: type: boolean enableGatewayAPI: type: boolean enableGatewayAPIAlpn: type: boolean enableGatewayAPIAppProtocol: type: boolean enableL7Proxy: type: boolean enablePMTUDiscovery: type: boolean enableSCTP: type: boolean envoyEnabled: type: boolean hubbleCertValidityDays: format: int64 type: integer hubbleEnabled: type: boolean hubbleEventBufferCapacity: format: int64 type: integer hubbleMetrics: items: type: string nullable: true type: array hubbleMetricsOpenMetrics: type: boolean hubbleNetworkPolicyCorrelation: type: boolean hubbleRelayEnabled: type: boolean hubbleTlsAutoMethod: type: string hubbleUiEnabled: type: boolean imagePullSecret: type: string ingressControllerEnabled: type: boolean ingressControllerLbMode: type: string ipamMode: type: string ipv4NativeRoutingCIDR: type: string k8sServiceHost: type: string k8sServicePort: format: int64 type: integer kubeProxyReplacement: type: boolean l2AnnouncementsEnabled: type: boolean l2PodAnnouncementsEnabled: type: boolean l2PodAnnouncementsIface: type: string mtu: format: int64 type: integer operatorPrometheusEnabled: type: boolean prometheusEnabled: type: boolean rawValuesYaml: type: string routingMode: type: string tunnelProtocol: type: string type: object x-go-type: backend/internal/cilium.HelmReleaseConfig api.ciliumValidateResponse: properties: issues: items: $ref: '#/components/schemas/api.ciliumValidateIssue' nullable: true type: array ok: type: boolean required: - issues - ok type: object x-go-type: backend/internal/api.ciliumValidateResponse api.ErrorBody: properties: error: type: string required: - error type: object api.ciliumValidateIssue: properties: message: type: string severity: type: string required: - message - severity type: object x-go-type: backend/internal/api.ciliumValidateIssue securitySchemes: sessionCookie: description: >- The session cookie issued by the OIDC sign-in flow. This is what a browser uses. in: cookie name: k8s-gate-session type: apiKey bearerToken: description: >- An API token, minted from your own identity page. A token carries the IAM groups you held **when it was minted**, and cannot bypass deletion approval — except for guest clusters inside a project that same token created. scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.