Cilium

Info

Support for the CNI plugin "Cilium" is currently in an alpha stage.

MetaKube offers Cilium as CNI Plugin with various optimizations.

How to create a cluster using Cilium

The choice of the CNI plugin is currently not integrated into the MetaKube UI.

The recommended way to create a cluster with Cilium is to use the MetaKube Terraform provider:

resource "metakube_cluster" "cluster" {
  ...
  spec {
    cni_plugin {
      type = "cilium"
    }
  }
}

Benefits over Canal

• Improved performance
• The data path of Cilium is implemented with eBPF and XDP, which circumvents parts of the Linux Kernel.
• Lower footprint
• Cilium takes the place of kube-proxy. This and the efficiency of the eBPF mean there's less resources required for networking components.
• Simplicity
• No encapsulation means Pod traffic is visible at the node interfaces and there's one less layer of abstraction.
• Additional capabilities
• Pod Traffic is routable inside the OpenStack network of the cluster.

IPAM

• Kubernetes assigns each node a /24 slice of the pod network CIDR (see node.spec.podCIDRs)
• Cilium agents assign Pod IPs from this CIDR

Data path

• Packets use the OpenStack network directly. The network is configured to allow this traffic.

Info

The nodes' security group must allow ingress traffic from the Pod network and all protocols. This rule is part of the security group that's automatically created by MetaKube.

Routing

• Every node acts as a "router" to its Pod network slice
• The OpenStack router has static routes for all nodes' slice
• These routes are replicated locally on each node

Network Policies

Cilium fully supports Kubernetes Network Policies. They're also implemented in eBPF.

For more information on Kubernetes Network Policies, see the official Kubernetes documentation.

Service networking

Cilium replaces kube-proxy and implements service networking itself in eBPF, without iptables or IPVS.

For more information on Kubernetes Services, see the official Kubernetes documentation.