Cilium Kubernetes CNI Provider, Part 1: Overview of eBPF and Cilium and the Installation Process
Vložit
- čas přidán 21. 02. 2022
- In this multi-part series, we will take a look at Cilium. In part 1, we will learn what Cilium is and how it leverages a key technology called “eBPF” to provide load balancing, observability, and security. We will also take a look at what eBPF is and conceptually walk through how a simple eBPF program can be organized and loaded into Kernel. We will wrap this episode up by going through a complete walk-through on how to install Cilium and its components on a brand new Kubernetes cluster.
Links:
Demo scripts: github.com/gary-RR/myCZcams_...
My Other Videos:
► Cilium Kubernetes CNI Provider: Part 4, IP Routing Modes (Direct and Encapsulated)
• Cilium Kubernetes CNI ...
► Cilium Kubernetes CNI Provider, Part 3: Cluster Mesh
• Cilium Kubernetes CNI ...
►Cilium Kubernetes CNI Provider, Part 2: Security Policies and Observability Leveraging Hubble
• Cilium Kubernetes CNI ...
► What is VXLAN and How It is Used as an Overlay Network in Kubernetes?
• What is VXLAN and How ...
► Managing Linux Log-ins, Users, and Machines in Active Directory (AD): Part 2- Join Linux Machines to AD:
• Managing Linux Logins,...
► Managing Linux Log-ins, Users, and Machines in Active Directory (AD): Part 1- Setup AD:
• Managing Linux Logins,...
► Sharing Resources between Windows and Linux:
• Sharing Resources betw...
► Kubernetes kube-proxy Modes: iptables and ipvs, Deep Dive:
• Kubernetes kube-proxy ...
►Kubernetes: Configuration as Data: Environment Variables, ConfigMaps, and Secrets:
• Kubernetes: Configurat...
►Configuring and Managing Storage in Kubernetes:
• Configuring and Managi...
► Istio Service Mesh - Securing Kubernetes Workloads:
• Istio Service Mesh - S...
► Istio Service Mesh - Intro
• Istio Service Mesh (si...
► Understanding Kubernetes Networking. Part 6: Calico Network Policies:
• Understanding Kubernet...
► Understanding Kubernetes Networking. Part 5: Intro to Kubernetes Network Policies:
• Understanding Kubernet...
► Understanding Kubernetes Networking. Part 4: Kubernetes Services:
• Kubernetes services - ...
► Understanding Kubernetes Networking Part 3: Calico Kubernetes CNI Provider in depth:
• Understanding Kubernet...
► Understanding Kubernetes Networking. Part 2: POD Network, CNI, and Flannel CNI: Plug-in: • Understanding Kubernet...
►Understanding Kubernetes Networking. Part 1: Container Networking: • Video
► Setup a Linux-Windows (Calico based) Hybrid Kubernetes Cluster to Host .NET Containers:
• Setup a Linux-Windows ...
► A Docker and Kubernetes tutorial for beginners:
A Docker and Kubernetes tutorial for beginners. - CZcams
► Setup a "Docker-less" Multi-node Kubernetes Cluster on Ubuntu Server:
• Setup a "Docker-less" ...
►Step by Step Instructions on Setting up Multi-Node Kubernetes Cluster on CentOS: • Step by Step Instructi...
►Setup and Configure CentOS Linux Server on A Windows 10 Hypervisor - CZcams: • Setup and Configure Ce...
►Setup NAT (Network Address Translation) on Hyper-V: • Setup NAT (Network Add...
► Enable Nested Virtualization on Windows to run WSL 2 (Linux) and Hyper-V on a VM: • Enable Nested Virtuali...
►Setup a Multi-Node MicroK8S Cluster on Windows 10: • Setup a Multi Node Mic...
► Detailed Windows Terminal, (WSL 2), Linux, Docker, and Kubernetes Install Guide on Windows 10:
• Detailed Windows Termi... - Věda a technologie
Exceptional work!
Cilium is a great product which is evolving on regular basis. I can only admire your effort to dive deeper in its capabilities.
IMHO all your K8s related content covers highest possible quality level regarding the elements of presentation, analysis, context relations and consistency.
Please, keep going! It's highly appreciated!
Thank you very much!
@Ognyan Lazarov,
Hi Ognyan, Thank you very much for your very kind words! I truly appreciate your post. Thank you again!
Welcome!
Be well and keep up the stunning work! 👍
Excellent video. Love the network/kernel-level approach. The CNCF should sponsor you, to be honest 🎉
Thanks very much!
very fruitful, well-organized contents, well done!
Great job thank you very much!
One of the best content i have seen on cillium and kubernetes networking . Very helpful 👌
Was waiting for your video ...Amazing as usual
Thank you!
Awesome content. Really appreciate you making stuff like this.
Many thanks for your kind feedback and glad it was helpful! Thanks again!
Thanks for making it. It is so helpful regarding installation and concept deep dive!!
Glad it was helpful!
I'm looking forward to the next episode！
czcams.com/video/5EcVrm01rAU/video.html
What a wonderful video! Thank you so much! K8s network is super complicated. This video is super helpful for my k8s journey😃😃😃😃😃
you deserve more views. keep going👏👏
Many thank for your sharing.
It was great. Thank you.
Glad you enjoyed it!
wow, thank you very much
You are welcome!
great content. thanks.🙂
Glad you liked it!
Great job as usual. can you do one in NSM(Network service mesh) ?
great video !! can you please make a video about multus and SRIOV plugin
Hi, Did you perform pod to pod encryption using cilium ?
Cilium can be configured to use wiregurad to encrypt POD to POD encryption, it is not enabled by default.
Hi! Quick question about rebooting nodes after Cilium is installed - have you gathered any logs or seen anything else that might have indicated what was the exact issue?
Hi Maciej,
Unfortunately, I couldn't find anything useful in the logs. My guess is that it has something to do with the IP allocation of coredns PODs, if coredens PODs are not healthy, cilium agents PODs will remain in an error/crash state. This was my experience installing (not using kube-proxy). I'd be interested if others run into this. Thanks,
@@TheLearningChannel-Tech Even I have tried to install Cilium as steps mentioned by you. CoreDNS pods was in Container Creating status. Have you modified any steps when you build your LAB? If so, please share what was the step to fix this issue.
Hi Veera,
Tyr explicitly setting the CIDR range and also explicitly enabling ipv4, helm give better control. Also, in addition to master, you must have at least a worker node as Cilium operator expects at least two nodes:
helm install cilium cilium/cilium --version 1.11.3 --namespace kube-system \
--set ipv4.enabled=true \
--set nativeRoutingCIDR="" \
--set kubeProxyReplacement=strict \
--set k8sServiceHost= \
--set k8sServicePort=6443 \
@@TheLearningChannel-Tech Thank You!!!
Could you please advice how to fix the below issue?
cloud_user@k8s-clus1-control:~$ cilium hubble enable
🔑 Found CA in secret cilium-ca
Error: Unable to enable Hubble: unable to retrieve helm values secret kube-system/cilium-cli-helm-values: secrets "cilium-cli-helm-values" not found
cloud_user@k8s-clus1-control:~$
@@veerakumar2831 Try disabling Hubble and install it through hlem:
helm upgrade cilium cilium/cilium --version 1.11.2 \
--namespace kube-system \
--reuse-values \
--set hubble.relay.enabled=true \
--set hubble.enabled=true
Hi, thanks for another great K8S Networking video..
I had a few questions if I may.
1. At 20min20sec you have the endpoints shown in the etcd, are those IP addresses supposed to be the node addresses i.e. where the PODs are spun up ? I was expecting them to match the eth0 of the Nodes ?
2. Is it possible to have some containers mapped to a specific VLAN and use IPTables whilst other Containers and VLANs use EBPF? or is the CNI using one or the other..?
3. Is it possible you could cover using Multus and Cillium on the same node with EBPF ?
Thanks
Hi,
1- I am not sure which IPs you are referring to, to be sure this is the URL at minute 20:30 czcams.com/video/aLq3O3l2LF4/video.html. There are two IPs, one is the node (192.168.0.35) and the other one is the pod's IP(10.0.0.247). Packets arrive at the node's interface and will be forwarded to the pod if they meet the criteria (destination port is 80).
2- No, the setting is the CNI level.
3- I might cover that in a future video.
Thanks.
Apologies my mistake, it was meant to be 22.20 ! czcams.com/video/aLq3O3l2LF4/video.html
@@TheLearningChannel-Tech
@@skunkworksinc. No, they are end-point IP addresses (Cluster IPs). Think of cluster IPs as load balancers. You really wouldn't want to call a node directly because there is no fault tolerance, if that node goes down, then your service is dead in the water. So, clients call the Cluster IP address of a service which then forwards the call to one of the nodes. The mapping between the Cluster IP and the nodes is either in IPTables or in the case of Cilium (if Kube proxy is disabled) is done in eBPF.
understand your last point, but my understanding on K8S prior to this was the endpoint IP address in etcd are the POD IPs that are currently active for the service... i.e. you have cluster IP which is associated with a set of active endpoints (pods) which you see with kubectl get service/ kubectl describe services (the latter showing the endpoints).....but the addresses you have shown in etcd don't match the PODs, or Cluster IPs.... hence was wondering if you were talking about something different..... ?@@TheLearningChannel-Tech
@@skunkworksinc. Sorry, I meant to say POD IPs in that context, not Cluster IPs. Cluster IPs load balance on POD IPs. Just noticed that the IPs on that screen should be POD IPs, must have copied and pasted them wrong. So that is a typo. In conclusion, the IPs in the service endpoints should have been POD IPs. Thanks for noticing.
Hi sir, is there any chane that you can share the slides which you used for cilium? Cuz i'm currently studing cilium + and your slide helps to sum up alot. Thanks
Hi, I usually don't but I made an exception as you mentioned it helps with your learning. I uploaded it to the video script files in GitHub, the link is under the video's description, and the file name is "Kube-Cilium-Part1-Intro.pptx". Please remember that this is my intellectual property, so please don't modify or distribute it. Also note that it was you'll need Microsoft Power Point software to view it. Hope this helps.
Thanks for your help, and as always, great contents for beginners!
@@nguyennam870 Welcome.
Hi. Is it possible to replace iptables on bare-metal server to cilium firewall? How you think?
By firewall I think you mean switching to eBPF. The answer is yes, this is at the kernel level, not hardware layer.
@@TheLearningChannel-Tech maybe you know some utility which prepared for it? Or I should use tc and C language to make that?
@@moshonkin If you already have a cluster that is not using Cilium and you want to switch it to Cilium, I'm afraid there is no easy way that I know of other than creating a brand new cluster using Cilium and then restoring your old cluster to it.
@@TheLearningChannel-Tech noo, I don't have any clusters. I look for replace iptables to some firewall based on ebpf xdp
@@moshonkin I might have misunderstood your question, if you just want to learn eBPF, and looking for tools and getting started, this is a good channel to go to: czcams.com/video/eZp_3EjJdnA/video.html
Hi do you have any good reference for HA cluster
Hi, I don't have any videos on the subject but you can find info on Kubernetes docs: kubernetes.io/docs/setup/production-environment/tools/kubeadm/high-availability/
Hi, I'm working on Network Policy in Cilium (like Ingress/Egress) but when my network policy change, I have to edit my network policy file again. Any solution for automate this step? For instance, I want to update network policy to block an IP.
Hi,
When you say you block an IP, do you mean blocking like as in a firewall policy and somehow it would create a rule in Cilium's network policy? Nothing that I know. Remember that the goal of CNI policies is to operate independent of the environment they are installed on.
@@TheLearningChannel-Tech In my case is IDS/IPS system like Snort and I want to automate update network policy instead of edit raw .json or .yaml network policy file when update network policy :((. Thank you for answering
Got it. I don't think such automation exists, the issue is that CNI providers such as Celium and Calico have their own syntax and rules when it comes to defining network policies. But it doesn't mean you can't create your own system if you have a development background. I haven't used Snort but I would imagine it generates some sort of alert. A service could be written to constantly monitor the alerts log file and when an update occurs, parses it and looks for keywords you define, and then calls another custom app whose job is to add the rule to the policy file. Since the policy files are written in yaml/json, it wouldn't be too difficult to praise and update them.
@@TheLearningChannel-Tech Thanks for your idea