#cilium — Public Fediverse posts

Small PSA if you're running Cilium as your k8s CNI: I just did an update from 1.19.6 to the new 1.20.0. The update itself went through fine, but afterwards, the cilium-operator Pod went into a CrashLoop. There was some sort of problem with updating the CiliumNodeConfig CRD. I didn't have a manifest for that CRD anyway, so I just deleted it manually:

k delete customresourcedefinitions ciliumnodeconfigs.cilium.io

Operator Pod came up fine after that.

#HomeLab #k8s #Cilium

Small PSA if you're running Cilium as your k8s CNI: I just did an update from 1.19.6 to the new 1.20.0. The update itself went through fine, but afterwards, the cilium-operator Pod went into a CrashLoop. There was some sort of problem with updating the CiliumNodeConfig CRD. I didn't have a manifest for that CRD anyway, so I just deleted it manually:

k delete customresourcedefinitions ciliumnodeconfigs.cilium.io

Operator Pod came up fine after that.

#HomeLab #k8s #Cilium

5 ошибок в NetworkPolicy, из‑за которых ваши политики ничего не блокируют

NetworkPolicy могут выглядеть корректно, применяться без ошибок и при этом оставлять кластер открытым там, где вы уверены в изоляции. Разберём пять типичных ошибок — от CNI без поддержки политик до неверных селекторов — и покажем, как проверять правила реальным трафиком, а не по наличию объектов в API.

https://habr.com/ru/companies/otus/articles/1067158/

#Kubernetes #NetworkPolicy #сетевые_политики #CNI #Calico #Cilium #ingress #egress #сетевая_изоляция #безопасность_Kubernetes

IP не валяй, или как я переобувал кластер kubernetes на ходу

В статье рассматривается опыт миграции сети Kubernetes-кластера на новый IP-пул (Pool IP) с использованием CNI Cilium. Особое внимание уделено процессу смены IP-адресов для Pod'ов и Service'ов в работающем кластере без длительной остановки, а также подводных камнях, с которыми пришлось столкнуться при обновлении до версии 1.20.0. Материал будет полезен инженерам по эксплуатации Kubernetes использующих уже Cilium, а так же желающим познакомиться с этим инструментом.

https://habr.com/ru/articles/1068158/

#cilium #cni #kubernetes #сеть #etcd #cidr

My daughter is an eBee fan 😅 ok, the crochet one I won last year, but I did not want to hand that one out. Now she finally got one made by my wife :)
#cilium #ebpf #ebee #crochet #crocheting #bee

This is about Cilium, the Kubernetes CNI plugin.

Am I the only one?

#HomeLab #Cilium

This is about Cilium, the Kubernetes CNI plugin.

Am I the only one?

#HomeLab #Cilium

Скрытый control plane в k8s

Рассмотрим нестандартный вариант установки Kubernetes, а именно установка кластера без control-plane ноды как таковой в стандартном ее восприятии. Установим кластер Kubernetes где слой control-plane будет просто хостом без CRI, только базове systemd сервисы. "Спрячем" control-plane от лишних глаз.

https://habr.com/ru/articles/1061228/

#kubernetes #k8s #cilium #control_plane

Gateway API против Ingress: как выбрать реализацию и не пожалеть

Если вы последние пару лет следили за развитием сетевой подсистемы Kubernetes, то наверняка заметили, что вокруг Gateway API сложился странный консенсус: «все согласны, что это будущее, но почти никто толком не понимает, какую именно реализацию брать и зачем уходить от привычного Ingress». В этой статье я попробую рассказать про ключевые отличия Gateway API от Ingress (на примере самого популярного — NGINX Ingress Controller), сравнить между собой основные реализации Gateway API и поговорить о нюансах кастомизации, интеграции и производительности.

https://habr.com/ru/companies/datasapience/articles/1054466/

#devops #kubernetes #ingress #gateway_api #nginx #envoy #calico #cilium #istio

I am slightly delighted that I obviously had some influence on choosing a CNI and possibly also accompany that team.. :)
#cilium #k8s

Got the gateway + http route working.
Lots of little pitfalls for me, like I have default deny policies but also stupid ones like typos 😅

Yeah, probably AI could have been a speedup.

BUT. I would not have learned much. And that's the point for me. How can I validate anything without having a real understanding? And that's where we're obviously heading to. Systems nobody can validate.

#k8s #cilium #gateway #ai

Got the gateway + http route working.
Lots of little pitfalls for me, like I have default deny policies but also stupid ones like typos 😅

Yeah, probably AI could have been a speedup.

BUT. I would not have learned much. And that's the point for me. How can I validate anything without having a real understanding? And that's where we're obviously heading to. Systems nobody can validate.

#k8s #cilium #gateway #ai

My summer vacation starts soon. And my brain is spinning and accumulating stuff I could do. Move my hosted server to a better one finally.. I pay both for well over a year :/ Catch up with current development of #k8s, #cilium, #flux, #proxmox, move to Gateway API, #kanidm replication as it got more important. Document all that.. trying to get away from Google photos, but it's complicated with huge shared albums.. and that's just some ideas.. and only IT.

After talos/k8s Upgrade, Cilium is now at 1.20.0-pre.2 no problem with that too 😎
Now trying to go from Ingress to Gateway API.
I want certs, and so after a long time let træfik traffic manage this, had to use cert-manager.
- Crash loops starting up (default deny prohibited access to Cluster API)
- still no certs (propagation checks failed also network policy)
- still failed... 🤯 (My local firewall does not allow access to any DNS outside.. added a few exceptions)
Certs 🎉
#cilium #k8s #upgrade

Just tried cilium cni for my kubernetes cluster setup ​:gura_vibe_wiggle_fast:​

Cilium can use eBPF instead of iptables to boost network performance ​:aye:​

#cilium #ebpf #kubernetes #homelabing

Just tried cilium cni for my kubernetes cluster setup ​:gura_vibe_wiggle_fast:​

Cilium can use eBPF instead of iptables to boost network performance ​:aye:​

#cilium #ebpf #kubernetes #homelabing

Как eBPF меняет правила безопасности и наблюдаемости в Kubernetes

eBPF часто подают как кнопку «ускорить Kubernetes», но на практике всё сложнее. Он действительно помогает уйти от тяжёлых цепочек iptables, снизить задержки и получить наблюдаемость ближе к ядру Linux. Но стоит перейти от L4 к L7, включить глубокую инспекцию трафика или mTLS — и бесплатная магия заканчивается. Разбираем, где eBPF меняет правила игры, а где всё ещё приходится считать оверхед. Читать разбор

https://habr.com/ru/companies/otus/articles/1047398/

#eBPF #Kubernetes #Cilium #kubeproxy #iptables #XDP #observability #сетевые_политики #безопасность_кластера #L7фильтрация

IP подов кончились, а обычные решения не подошли: как мы расширили сеть на проде, не пересоздавая кластер (кейс + гайд)

Штатная ситуация оказалась задачей со звёздочкой: кластер кинул алерт о том, что заканчивается сеть подов, но ни одно решение «из методички» не подходило, а вытаскивать кластер из прода было нельзя. В статье расскажу, как мы не просто расширили подсеть подов, но сделали это на работающем кластере и не потеряли при этом данные. Что важно — трюк сработает на любом дистрибутиве Kubernetes и CNI.

https://habr.com/ru/companies/flant/articles/1045872/

#kubernetes #cilium #сеть #cidr #etcd

Vertebrate #Hedgehog signaling is transduced by transmembrane protein Smoothened (SMO) on the primary #cilium, but what is its mechanism? This study shows that SMO & ciliary GPCRs regulate ciliary PKA activity to activate the Hedgehog pathway @PLOSBiology https://plos.io/4v7vdnp

Vertebrate #Hedgehog signaling is transduced by transmembrane protein Smoothened (SMO) on the primary #cilium, but what is its mechanism? This study shows that SMO & ciliary GPCRs regulate ciliary PKA activity to activate the Hedgehog pathway @PLOSBiology https://plos.io/4v7vdnp

[Перевод] Kubernetes Gateway API в 2026 году: сравниваем Envoy Gateway, Istio, Cilium, Kong и NGINX Gateway Fabric

Сейчас ландшафт сетей Kubernetes переживает самую значительную трансформацию со времен появления Ingress API в 2015 году. Gateway API прошел путь от бета-версии до General Availability и продолжает развиваться: к 2026 году — версия 1.4. Это фундаментальная переархитектура того, как трафик моделируется, управляется и защищается в Cloud-Native-окружениях. Это руководство — исчерпывающий анализ экосистемы вокруг этого стандарта: разбираем архитектурные подходы, характеристики производительности и наборы функций ведущих реализаций. Наше исследование показывает: стандарт Gateway API успешно унифицировал базовый интерфейс конфигурации, заменив фрагментированную аннотационную модель Ingress, — но нижележащие реализации демонстрируют глубокие расхождения в производительности и операционном поведении. Команда VK Cloud перевела статью для тех, кто уже несколько лет живет с зоопарком Ingress-аннотаций под NGINX, Traefik и ALB и сейчас выбирает, на что мигрировать. Автор разбирает Gateway API в его нынешнем состоянии (версия 1.4, GA), сравнивает пять Production-Ready-реализаций — Envoy Gateway, Istio в Ambient Mode, Cilium, Kong и NGINX Gateway Fabric — и дает фреймворк выбора под конкретный профиль нагрузки. Никакого маркетинга и «лучшего решения для всех»: цифры по Latency и CPU, архитектурные компромиссы, явные пределы масштабирования каждой модели.

https://habr.com/ru/companies/vktech/articles/1042710/

#vk_cloud #kubernetes #gateway_api #envoy #istio #cilium #kong #nginx #service_mesh #ebpf

[Перевод] Cilium и защита CI/CD: как опенсорс-проект уровня ядра Kubernetes защищает свою цепочку поставок

Cilium работает в сетевом пути уровня ядра в миллионах Kubernetes-pod'ов: от облачных провайдеров до собственных кластеров банков и телекомов. Если бы кто-то скомпрометировал сборочный пайплайн Cilium, зона поражения была бы сопоставима с инцидентом SolarWinds, но в облачно-нативной экосистеме. Поэтому подход проекта к безопасности CI/CD интересен не только мейнтейнерам других опенсорс-проектов: те же паттерны полезны любой команде, которая собирает прод-артефакты в GitHub Actions. Команда VK Cloud перевела статью с конкретными YAML-конфигами, дизайн-решениями и честным списком того, что у Cilium пока не сделано.

https://habr.com/ru/companies/vk/articles/1040540/

#vk_cloud #github_actions #supply_chain #devsecops #cilium #kubernetes #sigstore #slsa #sbom #безопасность

ExternalAuth support for the Gateway API has landed in Cilium: https://github.com/cilium/cilium/pull/45739 #kubernetes #cilium

6 Stunden später: die subtilen Errors im Kubernetes Log und random Pods, die wegen Timeouts wegsterben, haben eine Ursache: Duplicated Node PodCIDRs.

6 Server hatten jeweils 2 identische Subnetze. Schon lustig, wenn man eine IP pingt, den Server mit der IP runter fährt, und trotzdem ein ICMP Reply bekommt.

Ich hab zwar noch keinen Schimmer, warum Cilium aus dem IP-Pool Blöcke doppelt vergeben hat, aber die IP Allocations sehen nun alle wieder ordentlich aus.

#kubernetes #cilium

6 Stunden später: die subtilen Errors im Kubernetes Log und random Pods, die wegen Timeouts wegsterben, haben eine Ursache: Duplicated Node PodCIDRs.

6 Server hatten jeweils 2 identische Subnetze. Schon lustig, wenn man eine IP pingt, den Server mit der IP runter fährt, und trotzdem ein ICMP Reply bekommt.

Ich hab zwar noch keinen Schimmer, warum Cilium aus dem IP-Pool Blöcke doppelt vergeben hat, aber die IP Allocations sehen nun alle wieder ordentlich aus.

#kubernetes #cilium

@hegerdes Is it wise to use GUAs when rolling out encryption (wireguard/IPSec)? I've experimented a few times with #Cilium and ULAs and Wireguard encryption. It works, but was sometimes unpredictable and would require further investigation.

Let's continue the Proxmox + Tofu + Talos + Cilium adventure, with two little footnotes. "Devil is in the details!"

First: Talos "inlineManifests" behavior.

When you add some inlineManifests to your Talos MachineConfig and push that MachineConfig, the manifests get applied immediately. Yay!

However, when you update or remove some inlineManifests and push the MachineConfig ... Nothing happens. Talos does a full (potentially destructive!) reconcile only when executing a cluster upgrade. (This is pretty well explained in the Talos docs[1])

This means that our initial installation of CIlium will work immediately, but subsequent configuration changes won't work (the YAML won't be applied) until we run a "talosctl upgrade-k8s". (Pro-tip: make sure to specify "--to" with the current k8s version, otherwise it'll execute a "real" upgrade which implies downloading new images and restarting the whole control plane one component at a time - which takes a while.)

So, are we there yet?

Not quite!

The second issue: each time I'd do a "tofu plan", it would tell me that something had changed. Which is kind of annoying. If you don't change your Tofu configuration, variables, etc, normally, you'd expect "tofu plan" to tell you a reassuring:

No changes. Your infrastructure matches the configuration.

So, what is going on? 🤔

[1] https://docs.siderolabs.com/kubernetes-guides/advanced-guides/inlinemanifests#how-talos-handles-manifest-resources

#terraform #talos #opentofu #homelab #kubernetes #cilium

Also, I want the K8S cluster to support IPV6, which meant replacing Talos' default CNI (Flannel) with Cilium.

(OK, it might be possible to support IPv6 with Flannel on Talos, but the Talos docs say very little about how to customize Flannel, and I wanted Cilium for other reasons too - e.g. LoadBalancer support with L2 announcements, replacing kube-proxy...)

This means declaring "cni: none" in the Talos machine config, and then either:

1) manually installing Cilium after provisioning the cluster

2) finding a way to automatically install Cilium when the cluster is provisioned.

Of course I went for option 2, right :-)

Which leads us to a rabbit hole of multiple options:

1) wait for the cluster to be up (=K8S API is functional) and then use the Helm provider to create a helm_release resource on the cluster

Problem: there is no easy and clean way to wait for the cluster to be up.

Talos has a talos_cluster_health resource, but this one waits for all nodes to be "Ready", which isn't going to happen since the CNI hasn't been deployed yet. (There is a skip_kubernetes_checks option but it doesn't seem to help.)

Declaring something like a kubernetes_nodes resource in Tofu sort of works, ... until you reprovision the cluster. Then you realize that you can't even do a "tofu plan" because Tofu tries to refresh that resources' status, which requires the cluster to be up. So, this is a non-starter.

2) use Talos "inlineManifests" feature, which instructs talos to apply a bunch of YAML to the cluster when it's provisioned

Problem: this requires Cilium YAML manifests; and the way I install it is typically with the Helm chart.

Solution: use a helm_template data source to do the equivalent of the "helm template" command, and render the Cilium chart into ready-to-apply YAML manifests.

Next problem: the Cilium Helm chart is very sophisticated, and depends on Capabilities.KubeVersion - in other words, when we invoke the helm_template resource, we need to pass it the correct kube_version.

Next solution: that version is available in talos_machine_configuration resources.

And with that (and a good amount of Cilium configuration!) our cluster comes up fully functional!

#kubernetes #talos #proxmox #cilium #opentofu

Stop wasting hours hardening Linux for Kubernetes. 🛑

Running K8s on Ubuntu means battling OS patches and config drift. Plus, shared cloud VMs throttle your I/O.

Move to Immutable Bare Metal:
✅ Talos Linux (No SSH, purely API-driven)
✅ 3-Node HA & strict etcd quorum
✅ Cilium eBPF native L2 routing

Ditch the hypervisor tax. ⚡
🔗 https://www.servermo.com/howto/deploy-talos-linux-kubernetes-bare-metal/

#Kubernetes #TalosLinux #BareMetal #DevOps #eBPF #Cilium #Linux

I need to move off ingress-nginx because it's mothballed. I'm already using #Cilium for CNI, so I figured I'd switch to that. Yesterday was discovering that Cilium's gateway api implementation doesn't play nice with MetalLB. I figured that as Cilium BGP control plane can perform the same function, I might as well simplify a bit and replace MetalLB, so I did that this evening. Went pretty smoothly (except for a *weird* choice they made in their API wrt selectors, but at least it's documented) so I went back to try the service I was experimentally moving to gateway API. But it turns out that it doesn't support filters yet so I can't migrate the integrated authentication 😭 Looks like it's been on the todo list for a few years without moving, so it's a tossup now whether to wait a couple of releases to see if it shows up, or use something else. #kubernetes

#homelab and #k3s made further progress, they now run #cilium for networking.

Why? Because I like Cilium and eBPF.

Compare to my full blown #k8s cluster on 10 bare metal supermicro systems, this was a tremendous amount easier. In total I spent about two hours to get k3s and Cilium to play nice.

All of this is Ansible based. I am reusing the official k3s orchestration, and a personalized Cilium role.

Dabbled with enabling #IPv6 on my #cilium based #k3s cluster this morning. Seems that it /is/ possible to enable without a full cluster/node rebuild*.

Mostly went fine, prefix, prefix mask, masq set to off. After poking a couple of the Cilium Pods new Pods got an IPv6 addr. ...but couldn't ping anything. Traffic made it out based on what Hubble was showing, but not the reverse.

Enabled v6 masquerading, and it all started to work, yay. Suspect I need to try setting up a static route on my router for this to work.

I have a couple pods w/ quirky networking so they got unhappy. v6 IP, dns query replying w/ AAAA but no dice as they really only have v4 connectivity.

Back off for now but promising that it could work.

*.spec.PodCIDR(s) are immutable on v1.Node resources, but cilium in it's default configuration doesn't get it's PodCIDR from there in the default config.

Cilium deprecated external workload? Deploy HAProxy Ingress in DMZ w/ BGP+BIRD. Pod CIDR export, firewalld hardening, AlmaLinux-ready. Secure & tested! 👇

https://devopstales.github.io/kubernetes/k8s-dmz-bgp-external-haproxy/

#Kubernetes #BGP #HAProxy #NetworkSecurity #DevOps #Cilium

Its easy to hate on #k8s if you're a developer now working in microservices at your job. Microservices intensify the division of labor to an inconcievable degree, alienating workers from not just from the products of our labor, but especially from each other. And the Agile culture that comes with it is simply Taylorism perfected

But the truth is, #Cilium + #eBPF is simply one of the coolest things happening in software rn. A rose garden sprouting in the cracks of our neo-Haussmannian boulevards

One last oddity from my NetworkPolicy project over the last few days.....

I am getting the following in my hubble logs:

Feb 22 20:48:28.333: :: (ID:16777244) <> ff02::1:ff99:2a81 (ID:16777244) Unknown L3 target address DROPPED (ICMPv6 NeighborSolicitation)
Feb 22 20:48:29.325: fe80::b85f:80ff:fed7:6193 (ID:2435) <> ff02::16 (ID:16777244) Invalid source ip DROPPED (ICMPv6 143(0))
Feb 22 20:48:29.325: fe80::b85f:80ff:fed7:6193 (ID:2435) <> ff02::2 (ID:16777244) Invalid source ip DROPPED (ICMPv6 RouterSolicitation)
Feb 22 20:49:43.117: :: (ID:9705) <> ff02::16 (ID:16777244) Invalid source ip DROPPED (ICMPv6 143(0))
Feb 22 20:49:43.213: :: (ID:16777244) <> ff02::1:ffaf:3d08 (ID:16777244) Unknown L3 target address DROPPED (ICMPv6 NeighborSolicitation)

@rachel The Hubble-generated dashboards (from cilium/hubble) tend to work better than third-party ones. The official Grafana integration at grafana.com/grafana/dashboards/16611 is solid for flow visibility.

For DNS-specific monitoring, dashboard 16612 covers Hubble DNS metrics well.

Avoid anything built for pre-1.14 Cilium — the metric names changed significantly.

#kubernetes #cilium #grafana #monitoring