BGP (beta) Egress Gateway (beta) Cluster Mesh Setting up Cluster Mesh Load-balancing & Service Discovery Network Policy Setting up Support for External Workloads (beta) Operations Running Prometheus kube-dns and kubernetes have the required label value. Neighbor Discovery When kube-proxy replacement is enabled Cilium does L2 neighbor discovery of nodes in the cluster. In some rare cases Cilium may leave Cilium from performing the neighbor discovery and instead rely on the Linux kernel to discover hosts on the same L2 network you can pass the --enable-l2-neigh- discovery=false flag to the cilium-agent. However

(beta) CiliumEndpointSlice (beta) Cluster Mesh Setting up Cluster Mesh Load-balancing & Service Discovery Network Policy Setting up Support for External Workloads (beta) Operations Running Prometheus feature, set loadBalancer.serviceTopology=true. Neighbor Discovery When kube-proxy replacement is enabled, Cilium does L2 neighbor discovery of nodes in the cluster. This is required for the service Cilium 1.10 or earlier, the agent itself contained an ARP resolution library where it triggered discovery and periodic refresh of new nodes joining the cluster. The resolved neighbor entries were pushed

Cilium pods and validate that it lists both local nodes and nodes from remote clusters. If this discovery does not work, validate the following: In each cluster, check that the kvstore contains information choose to specify a high-level “produce” or “consume” role to a topic or choose to specify more low-level Kafka protocol specific apiKeys. Writing rules based on Kafka roles is easier and covers most common {"apiKey": "produce", "topic": "empire-announce"} ] } }] }] }] DNS Policy and IP Discovery Policy may be applied to DNS traffic, allowing or disallowing specific DNS query names or patterns

list in one of the Cilium pods and validate that all nodes are discovered correctly. If the node discovery is not working, run cilium kvstore get --recursive cilium/state/nodes/v1/ and check if an entry DNS Proxy (preferred) Update exis�ng policies to intercept DNS requests. See DNS Policy and IP Discovery or the example above Allow pods to make DNS requests to populate the cilium-agent cache. To check choose to specify a high-level “produce” or “consume” role to a topic or choose to specify more low-level Ka�a protocol specific apiKeys. Wri�ng rules based on Ka�a roles is easier and covers most common

Cilium pods and validate that it lists both local nodes and nodes from remote clusters. If this discovery does not work, validate the following: In each cluster, check that the kvstore contains information the Hubble Relay service or via Hubble UI. Hubble UI is a web interface which enables automatic discovery of the services dependency graph at the L3/L4 and even L7 layer, allowing user-friendly visualization choose to specify a high-level “produce” or “consume” role to a topic or choose to specify more low-level Kafka protocol specific apiKeys. Writing rules based on Kafka roles is easier and covers most common

Cilium pods and validate that it lists both local nodes and nodes from remote clusters. If this discovery does not work, validate the following: In each cluster, check that the kvstore contains information choose to specify a high-level “produce” or “consume” role to a topic or choose to specify more low-level Kafka protocol specific apiKeys. Writing rules based on Kafka roles is easier and covers most common {"apiKey": "produce", "topic": "empire-announce"} ] } }] }] }] DNS Policy and IP Discovery Policy may be applied to DNS traffic, allowing or disallowing specific DNS query names or patterns

Cilium pods and validate that it lists both local nodes and nodes from remote clusters. If this discovery does not work, validate the following: In each cluster, check that the kvstore contains information Proxy (preferred) 1. Update existing policies to intercept DNS requests. See DNS Policy and IP Discovery or the example above 2. Allow pods to make DNS requests to populate the cilium-agent cache. To choose to specify a high-level “produce” or “consume” role to a topic or choose to specify more low-level Kafka protocol specific apiKeys. Writing rules based on Kafka roles is easier and covers most common

not host ● Rules auto-cleanup on task stop is important ● Has to be integrated with service discovery, etc Solution: ● Use BPF_CGROUP_INET_{EGRESS,INGRESS} ● If use-case allows, filter on socket ● Filter by local/remote IP, IP prefix, port, protocol, TCP flags ● Integrated with service discovery: can filter by service name (dynamic set of IP:port endpoints) Container firewall (twfw) Network

Fellow bcc contributors (an awesome eBPF framework) This work was supported by NSERC through a Discovery Grant. github.com/willfindlay/bpfbox Check out the project on GitHub! 7 / 7

Upstream Routers Advertise VIP with eBGP Configure with RPC Health check daemon etc… Service Discovery Per-flow ECMP k8s CCM Frontend (dash board) To Backends User For More Information • Our motivation