Func�onality Overview Ge�ng Started Guides Installa�on Security Tutorials Advanced Networking Opera�ons Is�o Other Orchestrators Concepts Component Overview Assurances Terminology Address Management Mul� Host Requirements Configura�on Network Policy Endpoint CRD Kubernetes Compa�bility Troubleshoo�ng Is�o Ge�ng Started Using Is�o Docker Cilium with Docker & libnetwork Mesos Cilium with Mesos/Marathon Envoy Envoy Go Cilium? The development of modern datacenter applica�ons has shi�ed to a service- oriented architecture o�en referred to as microservices, wherein a large applica�on is split into small independent services

connectivity to resources outside the cluster (e.g., VMs in the VPC or AWS managed services) is masqueraded (i.e., SNAT) by Cilium to use the VPC IP address of the Kubernetes worker node. Excluding the lines for connectivity provided by Cilium and NetworkPolicy applies to them: $ kubectl get pods --all-namespaces -o custom- columns=NAMESPACE:.metadata.namespace,NAME:.metadata.name,HOSTNETWORK:. spec.hostNetwork --no-headers=true the installation, please refer to the Troubleshooting section and / or seek help on Slack. When do I need to use a kvstore? Unlike the section Quick Installation, this guide explains how to configure

connectivity to resources outside the cluster (e.g., VMs in the VPC or AWS managed services) is masqueraded (i.e., SNAT) by Cilium to use the VPC IP address of the Kubernetes worker node. To set up Cilium overlay connectivity provided by Cilium and NetworkPolicy applies to them: $ kubectl get pods --all-namespaces -o custom- columns=NAMESPACE:.metadata.namespace,NAME:.metadata.name,HOSTNETWORK:. spec.hostNetwork --no-headers=true the installation, please refer to the Troubleshooting section and / or seek help on Slack. When do I need to use a kvstore? Unlike the section Quick Installation, this guide explains how to configure

connectivity provided by Cilium and NetworkPolicy applies to them: kubectl get pods --all-namespaces -o custom- columns=NAMESPACE:.metadata.namespace,NAME:.metadata.name,HOSTNETWORK:. spec.hostNetwork --no-headers=true the installation, please refer to the Troubleshooting section and / or seek help on Slack. When do I need to use a kvstore? Unlike the section Quick Installation, this guide explains how to configure cluster-1 ? Pull Secret [? for help] ********************************** And set networkType: Cilium: sed -i 's/networkType:\ OVNKubernetes/networkType:\ Cilium/' "${CLUSTER_NAME}/install-config.yaml" Resulting

the installation, please refer to the Troubleshooting section and / or seek help on Slack. When do I need to use a kvstore? Unlike the section Quick Installation, this guide explains how to configure previously performed for kube- dns $ kubectl delete pods -n kube-system $(kubectl get pods -n kube-system -o custom-columns=NAME:.metadata.name,HOSTNETWORK:.spec.hostNetwork -- no-headers=true | grep '' following command displays the set of available Kubernetes versions. az aks get-versions -l westus -o table Create an AKS Cluster You can use any method to create and deploy an AKS cluster with the exception

connectivity provided by Cilium and NetworkPolicy applies to them: kubectl get pods --all-namespaces -o custom- columns=NAMESPACE:.metadata.namespace,NAME:.metadata.name,HOSTNETWORK:. spec.hostNetwork --no-headers=true the installation, please refer to the Troubleshooting section and / or seek help on Slack. When do I need to use a kvstore? Unlike the section Quick Installation, this guide explains how to configure connectivity to resources outside the cluster (e.g., VMs in the VPC or AWS managed services) is masqueraded (i.e., SNAT) by Cilium to use the VPC IP address of the Kubernetes worker node. Excluding the lines for

connectivity provided by Cilium and NetworkPolicy applies to them: kubectl get pods --all-namespaces -o custom- columns=NAMESPACE:.metadata.namespace,NAME:.metadata.name,HOSTNETWORK:. spec.hostNetwork --no-headers=true the installation, please refer to the Troubleshooting section and / or seek help on Slack. When do I need to use a kvstore? Unlike the section Quick Installation, this guide explains how to configure connectivity provided by Cilium and NetworkPolicy applies to them: kubectl get pods --all-namespaces -o custom- columns=NAMESPACE:.metadata.namespace,NAME:.metadata.name,HOSTNETWORK:. spec.hostNetwork --no-headers=true

with BPF socket lookup hook Jakub Sitnicki, Cloudflare @jkbs0 @cloudflare October 28-29, 2020 Who am I? ● Software Engineer at Cloudflare Spectrum TCP/UDP reverse proxy, Linux kernel, ... ● Contributor echo_dispatch.bpf.o clang -I…/linux/usr/include -I…/linux/tools/lib -g -O2 -Wall -Wextra -target bpf -c -o echo_dispatch.bpf.o echo_dispatch.bpf.c # bpftool prog load echo_dispatch.bpf.o /sys/fs/bpf/echo_dispatch_prog

understand how things work ● Sometimes, eBPF programs can’t even load ● I couldn’t find good resources on this, so, here I am ● I break lots of eBPF programs ● The BPF Virtual machine is not easy to understand nux-next.git /source/linux cd linux mkdir build make O=$PWD/build ARCH=x86_64 x86_64_defconfig make O=$PWD/build ARCH=x86_64 menuconfig make O=$PWD/build ARCH=x86_64 -j16 Kernel image Remember to:

feature-rich CNI implementation ○ actively maintained project ○ healthy, supportive community ● Today, all O(10000) DOKS clusters run on Cilium digitalocean.com ● cilium-agent managed as DaemonSet on each worker