From Managed Kubernetes to App Platform: 1.5 Years of Cilium Usage at DigitalOcean Timo Reimann, DigitalOcean October 28, 2020 digitalocean.com History / Context ● DigitalOcean Kubernetes Service

kind Install kind >= v0.7.0 per kind documentation: Installation and Usage [https://kind.sigs.k8s.io/#installation-and-usage] curl -LO https://raw.githubusercontent.com/cilium/cilium/v1.10/Documentatio com/Azure/AKS/issues/2934]. These issues prevent usage of our previously recommended scenario via replacement of initial system node pool with CriticalAddonsOnly=true:NoSchedule and usage of additional user node pools with refer to the guide AWS VPC CNI plugin. Requirements: The EKS Managed Nodegroups [https://eksctl.io/usage/eks-managed-nodes] must be properly tainted to ensure applications pods are properly managed by Cilium:

ca60a424ce69a4d79f502650199ca2b52f29e631 3. Create a minikube cluster: minikube start --network-plugin=cni --memory=4096 Note If minikube is deployed as a container (that is if docker is the configured driver), from the supported list [https://minikube.sigs.k8s.io/docs/drivers/]. minikube start --cni=cilium --memory=4096 # Only available for minikube >= v1.12.1 Note From minikube v1.12.1+, cilium networking plugin l/] 4. Install kind >= v0.7.0 per kind documentation: Installation and Usage [https://kind.sigs.k8s.io/#installation-and-usage] Configure kind Configuring kind cluster creation is done using a YAML

minikube cluster: minikube start --network-plugin=cni --memory=4096 # Only available for minikube >= v1.12.1 minikube start --cni=cilium --memory=4096 Note From minikube v1.12.1+, cilium networking plugin l/] 4. Install kind >= v0.7.0 per kind documentation: Installation and Usage [https://kind.sigs.k8s.io/#installation-and-usage] Configure kind Configuring kind cluster creation is done using a YAML the simplest way to set up a Kubernetes cluster with Cilium: minikube start --network-plugin=cni --memory=4096 minikube ssh -- sudo mount bpffs -t bpf /sys/fs/bpf kubectl create -f https://raw.githubusercontent

kind Install kind >= v0.7.0 per kind documentation: Installation and Usage [https://kind.sigs.k8s.io/#installation-and-usage] curl -LO https://raw.githubusercontent.com/cilium/cilium/v1.11/Documentatio com/Azure/AKS/issues/2934]. These issues prevent usage of our previously recommended scenario via replacement of initial system node pool with CriticalAddonsOnly=true:NoSchedule and usage of additional user node pools with refer to the guide AWS VPC CNI plugin. Requirements: The EKS Managed Nodegroups [https://eksctl.io/usage/eks-managed-nodes] must be properly tainted to ensure applications pods are properly managed by Cilium:

ca60a424ce69a4d79f502650199ca2b52f29e631 3. Create a minikube cluster: minikube start --network-plugin=cni --memory=4096 4. Mount the BPF filesystem minikube ssh -- sudo mount bpffs -t bpf /sys/fs/bpf Note In l/] 4. Install kind >= v0.7.0 per kind documentation: Installation and Usage [https://kind.sigs.k8s.io/#installation-and-usage] Kind Configuration Kind doesn’t use flags for configuration. Instead chaining configuration on top of Calico, the L7 policies may not work because of conflicting packet mark usage. This limitation is currently tracked at #12454 [https://github.com/cilium/cilium/issues/12454].

ca60a424ce69a4d79f502650199ca2b52f29e631 3. Create a minikube cluster: minikube start --network-plugin=cni --memory=4096 4. Mount the BPF filesystem minikube ssh -- sudo mount bpffs -t bpf /sys/fs/bpf Note In the simplest way to set up a Kubernetes cluster with Cilium: minikube start --network-plugin=cni --memory=4096 minikube ssh -- sudo mount bpffs -t bpf /sys/fs/bpf kubectl create -f https://raw.githubusercontent the simplest way to set up a Kubernetes cluster with Cilium: minikube start --network-plugin=cni --memory=4096 minikube ssh -- sudo mount bpffs -t bpf /sys/fs/bpf kubectl create -f https://raw.githubusercontent

version minikube version: v0.33.1 Create a minikube cluster: minikube start --network-plugin=cni --memory=4096 Note that in case of installing Cilium for a specific Kubernetes version, the --kubernetes-version flag: root@minikube:~# cilium monitor -t l7 Listening for events on 2 CPUs with 64x4096 of shared memory Press Ctrl-C to quit In the other windows, re-run the above queries, and you will see that Cilium in a future Cilium version. Memcached [h�ps://memcached.org/] is a high performance, distributed memory object caching system. It’s simple yet powerful, and used by dynamic web applica�ons to alleviate

Soni October 28, 2020 Hardware breakpoint Memory watchpoint Used in debuggers Elegant mechanism to monitor memory access Perf hardware breakpoint implementation: mem:[:access] if (efd < 0) { printf("event fd %d err %s\n", efd, strerror(errno)); return; } 02 libbpf.c Usage bpf_text = """ #include #include struct stack_key_t { int

target FD duplicate socket FD WOW! sockmap_update.c - Put socket FD in BPF map $ ./sockmap-update Usage: ./sockmap-update $ strace -e … ./sockmap-update 1289 socket cookie from ss output (sk:1) Attach echo_dispatch to network namespace # ./sk-lookup-attach Usage: ./sk-lookup-attach # ./sk-lookup-attach /sys/fs/bpf/echo_dispatch_prog /