Cilium Up and Running (Nico Vibert, Filip Nikolic, James Laverack) (z-library.sk, 1lib.sk, z-lib.sk)

📄 File Format: PDF

💾 File Size: 9.9 MB

📖 Read Online ⬇️ Download

Registered users can read the full content for free

Register as a Gaohf Library member to read the complete e-book online for free and enjoy a better reading experience.

📄 Page 1

Nico Vibert, Filip Nikolic & James Laverack Foreword by Thomas Graf Cloud Native Networking, Security, and Observability Cilium Up and Running

📄 Page 2

ISBN: 979-8-341-62301-9 NET WORKING Cilium is now considered the de facto cloud native networking platform for Kubernetes, connecting, securing, and monitoring millions of applications across thousands of clusters. With such versatility and feature-richness, Cilium can be daunting to learn. This comprehensive guide breaks Cilium down, making it broadly accessible to the increasing number of users who’ll encounter the platform in their careers. Authors Nico Vibert, Filip Nikolic, and James Laverack, all from Isovalent (creators of eBPF and Cilium), take you through how Cilium works, the problems it can solve, and how to run it in production. If you’re an experienced platform engineer or network architect who wants to get on top of the next big thing in cloud networking, this book is for you. • Learn about Kubernetes networking and the role of Cilium • Dive into the various use cases Cilium addresses • Understand Cilium’s architecture and how it moves packets around • Secure workloads through the use of network policies • Connect multiple clusters for service load balancing and discovery • Observe application networking performance for troubleshooting and forensics • Leverage Cilium’s built-in service mesh and networking capabilities for complex traffic engineering Nico Vibert is a senior staff technical marketing engineer at Isovalent, the company behind Cilium. Known for his “education without the jargon” approach, Nico simplifies complex networking topics through books, videos, and hands-on labs that have reached hundreds of thousands of engineers. Filip Nikolic is a platform engineer at Isovalent, where he contributes to CNCF projects like Cilium, Tetragon, and Argo CD, leveraging his networking expertise to advance cloud native technologies across industries. James Laverack is a principal customer success architect at Isovalent and a software engineer and conference speaker with over a decade of industry experience. James is also an upstream contributor to multiple CNCF projects as well as a former Kubernetes release lead (v1.24 “Stargazer”). Cilium: Up and Running “Comprehensive without being intimidating, this book is a good starting point for beginners and also dives deep into nuances that even experienced readers will f ind insightful.” Nimisha Mehta Senior software engineer, Confluent

📄 Page 3

isovalent.com/product

📄 Page 4

Praise for Cilium: Up and Running Comprehensive, without being intimidating, this book is a good starting point for beginners and also dives deep into nuances that even experienced readers will find insightful. —Nimisha Mehta, Senior Software Engineer, Confluent Cilium: Up and Running guides the reader through common use cases and provides a comprehensive overview of internal components and architecture. Together with code examples and the authors’ comments, this is a good reference for running Cilium in production. —Tony Norlin, Proact IT Group Cilium: Up and Running is an essential guide for novices and veterans in the Kubernetes networking space, taking you on a comprehensive journey to building robust and performant Kubernetes networking in production using Cilium’s powerful eBPF capabilities. —Glen Yu, Principal Consultant at Trident Consulting The authors’ real feat is how they share their experience to explain what Cilium does and provide you with all the keys to run it in production promptly. Turns any Cilium Padawan into a fully-grown Jedi! —Quentin Monnet, Principal Dataplane Engineer at Hedgehog

📄 Page 5

(This page has no text content)

📄 Page 6

Nico Vibert, Filip Nikolic, and James Laverack Cilium: Up and Running Cloud Native Networking, Security, and Observability

📄 Page 7

979-8-341-62301-9 [LSI] Cilium: Up and Running by Nico Vibert, Filip Nikolic, and James Laverack Copyright © 2026 O’Reilly Media, Inc. All rights reserved. Published by O’Reilly Media, Inc., 141 Stony Circle, Suite 195, Santa Rosa, CA 95401. O’Reilly books may be purchased for educational, business, or sales promotional use. Online editions are also available for most titles (https://oreilly.com). For more information, contact our corporate/institu‐ tional sales department: 800-998-9938 or corporate@oreilly.com. Acquisitions Editor: Megan Laddusaw Development Editor: Gary O’Brien Production Editor: Christopher Faucher Copyeditor: Rachel Wheeler Proofreader: Tim Stewart Indexer: Judith McConville Cover Designer: Susan Brown Cover Illustrator: José Marzan Jr. Interior Designer: David Futato Interior Illustrator: Kate Dullea February 2026: First Edition Revision History for the First Edition 2026-02-18: First Release See https://oreilly.com/catalog/errata.csp?isbn=9798341622999 for release details. The O’Reilly logo is a registered trademark of O’Reilly Media, Inc. Cilium: Up and Running, the cover image, and related trade dress are trademarks of O’Reilly Media, Inc. The views expressed in this work are those of the authors and do not represent the publisher’s views. While the publisher and the authors have used good faith efforts to ensure that the information and instructions contained in this work are accurate, the publisher and the authors disclaim all responsibility for errors or omissions, including without limitation responsibility for damages resulting from the use of or reliance on this work. Use of the information and instructions contained in this work is at your own risk. If any code samples or other technology this work contains or describes is subject to open source licenses or the intellectual property rights of others, it is your responsibility to ensure that your use thereof complies with such licenses and/or rights. This work is part of a collaboration between O’Reilly and Cisco. See our statement of editorial independ‐ ence.

📄 Page 8

Table of Contents Foreword. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiii Preface. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xv 1. Why Cilium?. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 From Early CNIs to Modern Datapaths 2 Cilium: Origins and Evolution 3 Industry Adoption 4 Becoming a CNCF Graduated Project 4 An Open Source Success Story 4 Cilium’s Use Cases 5 Networking with Cilium as a CNI 5 Ingress and Gateway API 6 Service Mesh Without the Sidecars 8 Multicluster Networking and Load Balancing 9 Interconnectivity with the Wider Network 9 Firewalling and Network Policy 10 Encryption and Secure Connectivity 11 Observability with Hubble 11 Looking Ahead 12 2. Inside Cilium. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Cilium at a Glance 15 The Cilium Agent 18 The Cilium CNI Plugin 19 The Cilium Operator 22 eBPF Programs and eBPF Maps 22 The Cilium CLI 24 v

📄 Page 9

Hubble 25 The Envoy Proxy 26 The DNS Proxy 27 Summary 27 3. Getting Started with Cilium. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Setting Up Your Environment 29 Kubernetes in Docker (kind) 30 Installing the Cilium CLI 30 Installing the Hubble CLI 30 Installing Helm 31 Deploying a kind Cluster 31 Installing Cilium 32 Installing Cilium Using the Cilium CLI 33 Installing Cilium Using Helm (Recommended) 34 Deploying a Sample Application 36 Securing the Application with Cilium Network Policies 41 Monitoring the Application with Hubble 44 Summary 48 4. IP Address Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 IPv4 and IPv6 Support in Cilium 49 IP Address Management 50 Pod IP Address Allocation 50 Kubernetes Host Scope IPAM Mode 52 Cluster Scope IPAM Mode 53 Multi-Pool IPAM Mode 55 ENI IPAM Mode 61 IPv6 Clusters 64 Dual Stack (IPv4/IPv6) 65 Single Stack (IPv6 Only) 68 Summary 71 5. The Cilium Datapath. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73 Intranode Connectivity 75 Internode Connectivity 80 Native Routing Mode 80 Encapsulation Mode 85 Summary 92 vi | Table of Contents

📄 Page 10

6. Service Networking. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93 Kubernetes Service Refresher 93 kube-proxy Refresher 94 kube-proxy Replacement 97 Agent Availability and Datapath Resiliency 102 KPR Service Behavior Support 104 Session Affinity 104 Traffic Policies 106 External-Facing Services 108 Summary 112 7. Ingress and Gateway API. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 Handling External Traffic in Kubernetes 114 Getting Started with Cilium Ingress 114 TLS Termination with Cilium Ingress 119 Ingress Limitations 121 Introducing Gateway API 122 Gateway API Objects 123 GatewayClass 123 Gateway 124 HTTPRoute 125 Routing HTTP Traffic with Gateway API 126 TLS Termination with Gateway API 129 Layer 7 Load Balancing Across Backends 130 50/50 Load Balancing 130 Adjusting Weights: 99/1 Split 132 Traffic Management 132 Modifying HTTP Headers with Gateway API 133 HTTP Redirects with Gateway API 135 gRPC Routing 138 East–West Layer 7 Routing with GAMMA and Gateway API 140 Summary 142 8. Performance Networking and Traffic Optimization. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143 Service Traffic Distribution 145 Local Redirect Policy 149 Using LRP to Keep Traffic on the Same Node 150 Using LRP to Redirect DNS Traffic Locally 153 Direct Server Return 156 eXpress Data Path 160 Maglev Consistent Hashing 161 Table of Contents | vii

📄 Page 11

Netkit 167 Summary 169 9. Multicluster Networking. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171 Multicluster Kubernetes 172 What Cluster Mesh Solves 173 Use Cases 173 Cluster Mesh Architecture 177 Application Datapath 178 Cluster Mesh API Server 180 Meshing Clusters 181 Preparing Clusters 181 Configuring Cilium for Cluster Mesh 182 Propagating TLS Trust 184 Testing Cluster Mesh 186 Global Services 187 Configuring Global Services 187 Endpoint Affinity 190 Global Policy 193 TLS Certificates in Cluster Mesh 196 Summary 199 10. Cluster Access. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201 L2 Announcements 203 Setting Up the Environment 203 Configuring L2 Announcements 204 Applying the L2 Announcement Policy 205 Inspecting ARP Traffic 206 Simulating a Node Failure 209 BGP 211 Setting Up the Environment 212 Enabling Cilium BGP Control Plane 215 Applying the Policies and Verifying Route Advertisements 220 Summary 221 11. Cluster Egress. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223 Masquerading 223 Configuring Masquerading 224 Masquerading Modes 226 Egress Gateway 229 Egress Gateway Use Cases 230 viii | Table of Contents

📄 Page 12

Cilium Egress Gateway Example Walk-Through 231 Bandwidth Manager 237 Summary 241 12. Network Policy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243 Creating a Basic Policy 243 Restricting Traffic by Port 244 Endpoints and Policy Enforcement 246 Default Deny 246 Egress Rules 247 Identity 248 The Foundations of Security 248 Identity in Cilium 249 The Policy Datapath 252 Selecting Identities with Policy 253 From Endpoints 253 Policy with Multiple Rules 254 Multiple Statements Versus Multiple Rules 256 Cluster-wide Policy 257 Reserved Labels, Reserved Identities, and Entities 258 Combining Statements 261 Beyond the Cluster 263 CIDR Ranges 263 CIDR Policy 263 Identity with Ingress and Gateway API 264 Deny Rules 265 Summary 266 13. Layer 7 and FQDN Policy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267 Layer 7 Policy 267 Securing HTTP 268 The Envoy Datapath 270 Performance 271 DNS Policy 274 FQDN Policy 276 Writing FQDN Policy 276 FQDN Identity 278 Content Delivery Networks 281 TLS Interception 282 Secrets and Security in Cilium 283 Writing HTTPS Policy 285 Table of Contents | ix

📄 Page 13

Public Trust 285 Internal CA 286 Overriding Pod CA Certificates 287 TLS Policy 289 Limitations 290 Summary 291 14. Transparent Encryption. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 293 Use Cases 293 Compliance 294 Threat Models 294 Traffic Flow 295 Encapsulation 297 Encryption and Authentication 299 Configuring and Validating Transparent Encryption 299 Testing Encryption 301 Viewing Unencrypted Traffic 301 Viewing Encrypted Traffic 302 Viewing Unencrypted Flows 303 Summary 304 15. Observability with Hubble. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 305 Hubble Architecture 305 Hubble Relay 307 Hubble CLI 308 Viewing Flow Details with JSON Output 311 Hubble Exporter 312 Layer 7 Visibility 313 Flow Redaction 317 Hubble UI 318 Exporting Metrics from Hubble 320 Summary 322 16. Operations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 323 Installation and Lifecycle Management 323 Cilium CLI Versus Helm 324 Running Helm from Your Laptop or Bastion Host 324 Running Helm from Argo CD or Flux 325 Upgrades, Migrations, and Version Management 326 Upgrade or Replace? 327 Traffic Stability During Upgrade 327 x | Table of Contents

📄 Page 14

Migration from Other CNIs 328 Monitoring, Capacity, and Observability 329 Day 2 Operations and Troubleshooting 333 Gateway API, Ingress, and Layer 7 Policy 335 L2 Announcements 336 Leader Election Timing 336 Client Traffic Redirection 337 BGP 337 Announcing Pod IPs Versus Service IPs 338 Reliability 338 Summary 339 Index. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 341 Table of Contents | xi

📄 Page 15

(This page has no text content)

📄 Page 16

Foreword When we started working on Cilium, none of us imagined how far the journey would take us. What began as an ambitious idea—to rethink networking and security for cloud native systems using eBPF—turned into a mission shared by an incredible group of engineers, users, and open source contributors. The journey of Cilium has been nothing short of amazing: from working with the very first wave of users trying to get Kubernetes into production, to partnering with some of the largest enterprises running massive fleets of Kubernetes clusters powered by Cilium and eBPF. Cilium was built in the open, shaped by a community that believed in a better way of doing cloud native networking and security. Every design decision, feature, and improvement was influenced by real-world feedback from operators running production systems, contributors pushing boundaries, and users who trusted us with their most critical workloads. The community didn’t just adopt Cilium—it helped build it. For that, I am deeply grateful. I vividly remember the early days when simply getting a basic ping working between two Kubernetes pods felt like a breakthrough. The days when we had to support Docker, Kubernetes, and Mesos at the same time, because the ecosystem had not yet settled on a single orchestration standard. The excitement when we got traceroute working properly by implementing full ICMP support. The moment we scaled our first Kubernetes cluster to 5,000 nodes and realized we were entering an entirely new class of infrastructure. I remember the first Hubble flow that worked end to end, unlocking a completely new way to observe and troubleshoot distributed systems. Donating Cilium to the CNCF and later celebrating its graduation marked a signifi‐ cant milestone that validated the technology and the strength and maturity of the community behind it. And I remember the moment when we realized Cilium was no longer just an exciting open source project. Today, Cilium is critical infrastructure powering stock exchanges, massive AI training clusters, sports stadiums, high-scale gaming plat‐ forms, financial institutions, and some of the most demanding production environ‐ ments in the world. We do not take that responsibility lightly. xiii

📄 Page 17

What has always mattered most is the people. Cilium exists because of the contribu‐ tors, users, operators, maintainers, and advocates who invested their time, energy, and trust into the project. It exists because platform teams around the world were willing to deploy something new and push it to its limits. It exists because engineers believed that open source could build infrastructure that is faster, more secure, and more observable than anything that came before it. It has been one of the greatest privileges of my career to be part of that journey. And it has been especially meaningful to share this journey with Nico, Filip, and James. Working closely with all three of them at Isovalent has been a true pleasure. We’ve shared countless architecture discussions, roadmap debates, customer conver‐ sations, conference stages, and community milestones. We’ve debugged complex net‐ working issues late into the night, pushed each other to raise the bar, and celebrated every hard-earned success. James has a rare gift for making complex systems understandable without oversimpli‐ fying them. Filip brings deep operational experience and an instinctive understand‐ ing of what platform teams actually need to succeed. Nico combines architectural clarity with hands-on engineering excellence and a relentless drive to make things better. Together, they represent the very best of what the Cilium community stands for: technical excellence, pragmatism, and a genuine desire to help others. This is why Cilium Up and Running feels so special to me. This book reflects years of real-world experience building, operating, and scaling cloud native infrastructure. It captures the philosophy behind Cilium: that networking and security should be simple to operate, powerful by design, and deeply observable. It explains not only how Cilium works, but why it was built the way it is—from eBPF and identity-based security to service load balancing, observability, and multicluster architectures. What truly sets this book apart is the care that went into writing it. You can feel the authors’ respect for the reader. Their love for the technology. And you can feel their commitment to helping others succeed. This is a book written by practitioners, for practitioners—by people who have been in the trenches, running production systems and solving real problems. Cilium was built by a community. This book is written by people who helped build that community. I am incredibly proud of what we’ve built together. I am deeply grateful to the global Cilium community for how far it has brought us. And I am honored to call James, Filip, and Nico not just collaborators, but friends. This book is a celebration of everything we have achieved together—and an exciting glimpse into what comes next. — Thomas Graf Cocreator of Cilium, Cofounder & CTO Isovalent xiv | Foreword

📄 Page 18

Preface Over the past decade, Kubernetes has evolved from a cutting-edge project spawned at Google into the universal standard for how modern applications are built and operated. Brendan Burns et al.’s description of the platform in Kubernetes: Up and Running (O’Reilly) as “an open source orchestrator for deploying containerized appli‐ cations” doesn’t quite do it justice. Today, Kubernetes is the preferred platform not only for containers but also for virtual machines, databases, batch processing jobs, development environments, and AI and machine learning workloads. It has followed in the footsteps of infrastructure-as-a-service, virtualization, and bare-metal servers and now provides engineers with unique abilities to run applications that have supe‐ rior agility, resilience, and orchestration. Regardless of the compute stack flavor of the year—and Kubernetes will, eventually, be replaced by something else—the networking and security requirements remain the same. Connectivity to, from, and between apps is still needed. Regulatory goals still need to be met, with data confidentiality, integrity, and resiliency remaining critical requirements. Application performance still needs to be closely monitored. Whether you’re a seasoned platform engineer or a newcomer to the cloud native world, you may be perplexed by the vast choice of networking tools that appear to be needed to meet the aforementioned requirements. It’s a common phenomenon, and as a consequence, many clusters today are cluttered with collections of purpose-built tools: Container Network Interface (CNI) implementations, proxies, service meshes, ingress controllers, load balancers, multicluster utilities, and more. But things are changing. Users are yearning for simplification. Addressing the cogni‐ tive exhaustion that comes with maintaining dozens of tools is at the forefront of engineers’ minds. A new layer is developing in the infrastructure stack—we call it “cloud native net‐ working, security, and observability.” You might call it something else, but regardless of the name, a clear leader in this category is emerging. xv

📄 Page 19

Cilium. Powered by a kernel technology called eBPF, Cilium has taken the Kubernetes space by storm. It has been adopted by thousands of users and selected as the standard for Kubernetes networking by the likes of Google, AWS, and Microsoft. At the time of writing, it remains the only graduated Cloud Native Computing Foundation (CNCF) project in the Cloud Native Networking category, highlighting its broad scale, adop‐ tion, and maturity. This book aims to show you the fastest way to get up and running with Cilium—but not just that: we want you to run Cilium well. Who This Book Is For This book was written for anyone who wants to accelerate and develop their profi‐ ciency in Cilium. We expect readers to have some familiarity with Kubernetes. While Cilium can be used outside this platform, for now its primary purpose remains to provide network‐ ing, security, and observability for workloads running inside a Kubernetes cluster. We also expect readers to have a fundamental understanding of IP networking. While we don’t necessarily expect you to have mastered every routing protocol, we will assume you are familiar with IP addressing, CIDR ranges, iptables, NAT, DNS, and the OSI layer model in addition to network security concepts such as firewalls and encryption. Why We Wrote This Book We knew up front that writing a book about a technology that evolves as quickly as Cilium would be a challenge—but given its ever-growing popularity and importance within the cloud native ecosystem, we thought it was important to provide a starting point for anyone considering using it. We hope that this book will expedite your learning and help even uninitiated users feel confident installing, managing, and configuring Cilium. What This Book Covers Thanks to its broad and healthy community of contributors, Cilium is constantly evolving to meet the demands of its users and adapt to changes in the Kubernetes platform. For this reason, we will focus on the core and stable features and principles of Cilium, rather than exploring every possible use case. We will focus on the version of Cilium that was available at the time of writing (v1.18) and will not cover depre‐ cated features. xvi | Preface

📄 Page 20

Chapter 1 begins by answering the question “Why Cilium?” and provides a broad overview of its role within Kubernetes and the core use cases. We present the major components in Chapter 2 before moving on to more concrete examples in Chapter 3, which provides code samples to follow to install and monitor Cilium. We then dive into the networking aspects of Cilium. Chapter 4 describes IP address management, and Chapter 5 introduces the datapath and explains how connectivity is delivered. Chapters 6 and 7 cover Kubernetes service networking and Ingress and Gateway API, respectively. Chapter 8 concentrates on performance-focused features, and Chapter 9 explains how Cilium enables multicluster communication. Next, we turn to cluster access. Chapter 10 shows how external clients reach applica‐ tions, and Chapter 11 outlines the options available for outbound traffic. From there, we move into security. Chapter 12 introduces the core ideas behind net‐ work policy, and Chapter 13 expands on this with more advanced policy capabilities. Chapter 14 covers encryption before we shift to observability in Chapter 15 with Hubble. Finally, Chapter 16 focuses on operating Cilium. Example Code and Exercises You will find code examples and manifests throughout this book, and we encourage you to try them yourself to build a solid understanding of Cilium. Example files are available for download at https://github.com/isovalent/cilium-up-and-running. Most Cilium features work well on Kubernetes in Docker (using kind), meaning you can test almost everything at no cost by running kind on your own machine. When we cover features that cannot run in nested network namespace environments such as kind, we will point out suitable alternatives. You can also follow along with this book using the free online companion lab on Isovalent.com. Command outputs shown in the book may be trimmed so they remain readable and to keep the examples focused on what matters. If you have a technical question or a problem using the code examples, please send email to support@oreilly.com. This book is here to help you get your job done. In general, if example code is offered with this book, you may use it in your programs and documentation. You do not need to contact us for permission unless you’re reproducing a significant portion of the code. For example, writing a program that uses several chunks of code from this book does not require permission. Selling or distributing examples from O’Reilly books does require permission. Answering a question by citing this book and quoting example code does not require permission. Incorporating a significant Preface | xvii