--- charts-original/values.yaml
+++ charts/values.yaml
@@ -152,12 +152,10 @@
   # type: [null, string]
   # @schema
   override: ~
-  repository: "quay.io/cilium/cilium"
+  repository: "rancher/mirrored-cilium-cilium"
   tag: "v1.16.1"
   pullPolicy: "IfNotPresent"
-  # cilium-digest
-  digest: "sha256:0b4a3ab41a4760d86b7fc945b8783747ba27f29dac30dd434d94f2c9e3679f39"
-  useDigest: true
+  useDigest: false
 # -- Affinity for cilium-agent.
 affinity:
   podAntiAffinity:
@@ -581,7 +579,10 @@
   #  - flannel
   #  - generic-veth
   #  - portmap
-  chainingMode: ~
+
+  # Otherwise rke2 hostPort does not work! Used for nginx
+  chainingMode: portmap
+
   # @schema
   # type: [null, string]
   # @schema
@@ -1011,10 +1012,9 @@
     # type: [null, string]
     # @schema
     override: ~
-    repository: "quay.io/cilium/certgen"
+    repository: "rancher/mirrored-cilium-certgen"
     tag: "v0.2.0"
-    digest: "sha256:169d93fd8f2f9009db3b9d5ccd37c2b753d0989e1e7cd8fe79f9160c459eef4f"
-    useDigest: true
+    useDigest: false
     pullPolicy: "IfNotPresent"
   # -- Seconds after which the completed job pod will be deleted
   ttlSecondsAfterFinished: 1800
@@ -1035,7 +1035,7 @@
   affinity: {}
 hubble:
   # -- Enable Hubble (true by default).
-  enabled: true
+  enabled: false
   # -- Annotations to be added to all top-level hubble objects (resources under templates/hubble)
   annotations: {}
   # -- Buffer size of the channel Hubble uses to receive monitor events. If this
@@ -1312,11 +1312,9 @@
       # type: [null, string]
       # @schema
       override: ~
-      repository: "quay.io/cilium/hubble-relay"
+      repository: "rancher/mirrored-cilium-hubble-relay"
       tag: "v1.16.1"
-      # hubble-relay-digest
-      digest: "sha256:2e1b4c739a676ae187d4c2bfc45c3e865bda2567cc0320a90cb666657fcfcc35"
-      useDigest: true
+      useDigest: false
       pullPolicy: "IfNotPresent"
     # -- Specifies the resources for the hubble-relay pods
     resources: {}
@@ -1561,10 +1559,9 @@
         # type: [null, string]
         # @schema
         override: ~
-        repository: "quay.io/cilium/hubble-ui-backend"
+        repository: "rancher/mirrored-cilium-hubble-ui-backend"
         tag: "v0.13.1"
-        digest: "sha256:0e0eed917653441fded4e7cdb096b7be6a3bddded5a2dd10812a27b1fc6ed95b"
-        useDigest: true
+        useDigest: false
         pullPolicy: "IfNotPresent"
       # -- Hubble-ui backend security context.
       securityContext: {}
@@ -1595,10 +1592,9 @@
         # type: [null, string]
         # @schema
         override: ~
-        repository: "quay.io/cilium/hubble-ui"
+        repository: "rancher/mirrored-cilium-hubble-ui"
         tag: "v0.13.1"
-        digest: "sha256:e2e9313eb7caf64b0061d9da0efbdad59c6c461f6ca1752768942bfeda0796c6"
-        useDigest: true
+        useDigest: false
         pullPolicy: "IfNotPresent"
       # -- Hubble-ui frontend security context.
       securityContext: {}
@@ -1772,7 +1768,7 @@
 ipam:
   # -- Configure IP Address Management mode.
   # ref: https://docs.cilium.io/en/stable/network/concepts/ipam/
-  mode: "cluster-pool"
+  mode: "kubernetes"
   # -- Maximum rate at which the CiliumNode custom resource is updated.
   ciliumNodeUpdateRate: "15s"
   operator:
@@ -2066,7 +2062,7 @@
   port: 6060
 # -- Configure prometheus metrics on the configured port at /metrics
 prometheus:
-  enabled: false
+  enabled: true
   port: 9962
   serviceMonitor:
     # -- Enable service monitors.
@@ -2130,9 +2126,9 @@
   # type: [null, boolean]
   # @schema
   # -- Enable Envoy Proxy in standalone DaemonSet.
-  # This field is enabled by default for new installation.
-  # @default -- `true` for new installation
-  enabled: ~
+  # This field is disabled by default.
+  # @default -- `false`
+  enabled: false
   # -- (int)
   # Set Envoy'--base-id' to use when allocating shared memory regions.
   # Only needs to be changed if multiple Envoy instances will run on the same node and may have conflicts. Supported values: 0 - 4294967295. Defaults to '0'
@@ -2161,11 +2157,10 @@
     # type: [null, string]
     # @schema
     override: ~
-    repository: "quay.io/cilium/cilium-envoy"
+    repository: "rancher/mirrored-cilium-cilium-envoy"
     tag: "v1.29.7-39a2a56bbd5b3a591f69dbca51d3e30ef97e0e51"
     pullPolicy: "IfNotPresent"
-    digest: "sha256:bd5ff8c66716080028f414ec1cb4f7dc66f40d2fb5a009fff187f4a9b90b566b"
-    useDigest: true
+    useDigest: false
   # -- Additional containers added to the cilium Envoy DaemonSet.
   extraContainers: []
   # -- Additional envoy container arguments.
@@ -2477,17 +2472,9 @@
     # type: [null, string]
     # @schema
     override: ~
-    repository: "quay.io/cilium/operator"
+    repository: "rancher/mirrored-cilium-operator"
     tag: "v1.16.1"
-    # operator-generic-digest
-    genericDigest: "sha256:3bc7e7a43bc4a4d8989cb7936c5d96675dd2d02c306adf925ce0a7c35aa27dc4"
-    # operator-azure-digest
-    azureDigest: "sha256:e55c222654a44ceb52db7ade3a7b9e8ef05681ff84c14ad1d46fea34869a7a22"
-    # operator-aws-digest
-    awsDigest: "sha256:e3876fcaf2d6ccc8d5b4aaaded7b1efa971f3f4175eaa2c8a499878d58c39df4"
-    # operator-alibabacloud-digest
-    alibabacloudDigest: "sha256:4381adf48d76ec482551183947e537d44bcac9b6c31a635a9ac63f696d978804"
-    useDigest: true
+    useDigest: false
     pullPolicy: "IfNotPresent"
     suffix: ""
   # -- Number of replicas to run for the cilium-operator deployment
@@ -2656,8 +2643,7 @@
   # @schema
   # -- Taint nodes where Cilium is scheduled but not running. This prevents pods
   # from being scheduled to nodes where Cilium is not the default CNI provider.
-  # @default -- same as removeNodeTaints
-  setNodeTaints: ~
+  setNodeTaints: false
   # -- Set Node condition NetworkUnavailable to 'false' with the reason
   # 'CiliumIsUp' for nodes that have a healthy Cilium pod.
   setNodeNetworkStatus: true
@@ -2761,11 +2747,9 @@
     # type: [null, string]
     # @schema
     override: ~
-    repository: "quay.io/cilium/cilium"
+    repository: "rancher/mirrored-cilium-cilium"
     tag: "v1.16.1"
-    # cilium-digest
-    digest: "sha256:0b4a3ab41a4760d86b7fc945b8783747ba27f29dac30dd434d94f2c9e3679f39"
-    useDigest: true
+    useDigest: false
     pullPolicy: "IfNotPresent"
   # -- The priority class to use for the preflight pod.
   priorityClassName: ""
@@ -2910,11 +2894,9 @@
       # type: [null, string]
       # @schema
       override: ~
-      repository: "quay.io/cilium/clustermesh-apiserver"
+      repository: "rancher/mirrored-cilium-clustermesh-apiserver"
       tag: "v1.16.1"
-      # clustermesh-apiserver-digest
-      digest: "sha256:e9c77417cd474cc943b2303a76c5cf584ac7024dd513ebb8d608cb62fe28896f"
-      useDigest: true
+      useDigest: false
       pullPolicy: "IfNotPresent"
     # -- TCP port for the clustermesh-apiserver health API.
     healthPort: 9880
@@ -3555,3 +3537,11 @@
       agentSocketPath: /run/spire/sockets/agent/agent.sock
       # -- SPIRE connection timeout
       connectionTimeout: 30s
+
+portmapPlugin:
+  image:
+    repository: "rancher/hardened-cni-plugins"
+    tag: "v1.5.1-build20240830"
+
+global:
+  systemDefaultRegistry: ""