diff -crB --new-file cilium-1.6.6-backup/daemon/daemon.go cilium-1.6.6-test/daemon/daemon.go
*** cilium-1.6.6-backup/daemon/daemon.go	2020-02-03 14:04:55.000000000 -0800
--- cilium-1.6.6-test/daemon/daemon.go	2020-05-03 18:24:56.636208375 -0700
***************
*** 719,725 ****
  	ctmap.InitMapInfo(option.Config.CTMapEntriesGlobalTCP, option.Config.CTMapEntriesGlobalAny,
  		option.Config.EnableIPv4, option.Config.EnableIPv6,
  	)
! 	policymap.InitMapInfo(option.Config.PolicyMapMaxEntries)
  
  	if option.Config.DryMode == false {
  		if err := bpf.ConfigureResourceLimits(); err != nil {
--- 719,725 ----
  	ctmap.InitMapInfo(option.Config.CTMapEntriesGlobalTCP, option.Config.CTMapEntriesGlobalAny,
  		option.Config.EnableIPv4, option.Config.EnableIPv6,
  	)
! 	policymap.InitMapInfo(option.Config.PolicyMapEntries)
  
  	if option.Config.DryMode == false {
  		if err := bpf.ConfigureResourceLimits(); err != nil {
diff -crB --new-file cilium-1.6.6-backup/pkg/option/config.go cilium-1.6.6-test/pkg/option/config.go
*** cilium-1.6.6-backup/pkg/option/config.go	2020-02-03 14:04:55.000000000 -0800
--- cilium-1.6.6-test/pkg/option/config.go	2020-05-03 18:34:08.532651877 -0700
***************
*** 413,418 ****
--- 413,424 ----
  	// LimitTableMax defines the maximum CT or NAT table limit
  	LimitTableMax = 1 << 24 // 16Mi entries (~1GiB of entries per map)
  
+ 	// PolicyMapMin defines the minimum policy map limit.
+ 	PolicyMapMin = 1 << 8
+ 
+ 	// PolicyMapMax defines the minimum policy map limit.
+ 	PolicyMapMax = 1 << 16
+ 
  	// NATMapEntriesGlobalName configures max entries for BPF NAT table
  	NATMapEntriesGlobalName = "bpf-nat-global-max"
  
***************
*** 890,898 ****
  	// in the BPF NAT table
  	NATMapEntriesGlobal int
  
! 	// PolicyMapMaxEntries is the maximum number of peer identities that an
  	// endpoint may allow traffic to exchange traffic with.
! 	PolicyMapMaxEntries int
  
  	// DisableCiliumEndpointCRD disables the use of CiliumEndpoint CRD
  	DisableCiliumEndpointCRD bool
--- 896,904 ----
  	// in the BPF NAT table
  	NATMapEntriesGlobal int
  
! 	// PolicyMapEntries is the maximum number of peer identities that an
  	// endpoint may allow traffic to exchange traffic with.
! 	PolicyMapEntries int
  
  	// DisableCiliumEndpointCRD disables the use of CiliumEndpoint CRD
  	DisableCiliumEndpointCRD bool
***************
*** 1431,1445 ****
  		}
  	}
  
! 	policyMapMin := (1 << 8)
! 	policyMapMax := (1 << 16)
! 	if c.PolicyMapMaxEntries < policyMapMin {
  		return fmt.Errorf("specified PolicyMap max entries %d must exceed minimum %d",
! 			c.PolicyMapMaxEntries, policyMapMin)
  	}
! 	if c.PolicyMapMaxEntries > policyMapMax {
  		return fmt.Errorf("specified PolicyMap max entries %d must not exceed maximum %d",
! 			c.PolicyMapMaxEntries, policyMapMax)
  	}
  	// Validate that the KVStore Lease TTL value lies between a particular range.
  	if c.KVstoreLeaseTTL > defaults.KVstoreLeaseMaxTTL || c.KVstoreLeaseTTL < defaults.LockLeaseTTL {
--- 1437,1449 ----
  		}
  	}
  
! 	if c.PolicyMapEntries < PolicyMapMin {
  		return fmt.Errorf("specified PolicyMap max entries %d must exceed minimum %d",
! 			c.PolicyMapEntries, PolicyMapMin)
  	}
! 	if c.PolicyMapEntries > PolicyMapMax {
  		return fmt.Errorf("specified PolicyMap max entries %d must not exceed maximum %d",
! 			c.PolicyMapEntries, PolicyMapMax)
  	}
  	// Validate that the KVStore Lease TTL value lies between a particular range.
  	if c.KVstoreLeaseTTL > defaults.KVstoreLeaseMaxTTL || c.KVstoreLeaseTTL < defaults.LockLeaseTTL {
***************
*** 1645,1651 ****
  	c.FlannelMasterDevice = viper.GetString(FlannelMasterDevice)
  	c.FlannelUninstallOnExit = viper.GetBool(FlannelUninstallOnExit)
  	c.FlannelManageExistingContainers = viper.GetBool(FlannelManageExistingContainers)
! 	c.PolicyMapMaxEntries = viper.GetInt(PolicyMapEntriesName)
  	c.PProf = viper.GetBool(PProf)
  	c.PreAllocateMaps = viper.GetBool(PreAllocateMapsName)
  	c.PrependIptablesChains = viper.GetBool(PrependIptablesChainsName)
--- 1649,1655 ----
  	c.FlannelMasterDevice = viper.GetString(FlannelMasterDevice)
  	c.FlannelUninstallOnExit = viper.GetBool(FlannelUninstallOnExit)
  	c.FlannelManageExistingContainers = viper.GetBool(FlannelManageExistingContainers)
! 	c.PolicyMapEntries = viper.GetInt(PolicyMapEntriesName)
  	c.PProf = viper.GetBool(PProf)
  	c.PreAllocateMaps = viper.GetBool(PreAllocateMapsName)
  	c.PrependIptablesChains = viper.GetBool(PrependIptablesChainsName)
