Update Cilium related docs (#18563)

* Extend Cilium CNI plugin description

Mention that it works on top of other CNI plugins due to the CNI
chaining [1].

[1]: http://docs.cilium.io/en/v1.6/gettingstarted/cni-chaining/

Signed-off-by: Martynas Pumputis <m@lambda.lt>

* Update Cilium installation steps for kubeadm

- Use the latest v1.6 Cilium.
- By default, Cilium no longer needs/deploys ETCD store.

Signed-off-by: Martynas Pumputis <m@lambda.lt>

* Update Cilium NetworkPolicy guide

- Update minikube min version requirement.
- Use Cilium v1.6.
- Remove the etcd store bits, as Cilium v1.6 no longer depend on
  it by default.

Signed-off-by: Martynas Pumputis <m@lambda.lt>

* Update Cilium installation steps for kubeadm

- How to run without kube-proxy.

Signed-off-by: Martynas Pumputis <m@lambda.lt>

Co-authored-by: Martynas Pumputis <m@lambda.lt>
This commit is contained in:
André Martins
2020-01-13 13:35:36 +01:00
committed by Kubernetes Prow Robot
parent 7969a84110
commit 5cb0e3d7b4
4 changed files with 29 additions and 33 deletions
@@ -10,7 +10,7 @@ weight: 20
{{% capture overview %}}
This page shows how to use Cilium for NetworkPolicy.
For background on Cilium, read the [Introduction to Cilium](https://cilium.readthedocs.io/en/stable/intro).
For background on Cilium, read the [Introduction to Cilium](https://docs.cilium.io/en/stable/intro).
{{% /capture %}}
{{% capture prerequisites %}}
@@ -23,36 +23,45 @@ For background on Cilium, read the [Introduction to Cilium](https://cilium.readt
## Deploying Cilium on Minikube for Basic Testing
To get familiar with Cilium easily you can follow the
[Cilium Kubernetes Getting Started Guide](https://cilium.readthedocs.io/en/stable/gettingstarted/minikube/)
[Cilium Kubernetes Getting Started Guide](https://docs.cilium.io/en/stable/gettingstarted/minikube/)
to perform a basic DaemonSet installation of Cilium in minikube.
To start minikube, minimal version required is >= v0.33.1, run the with the
To start minikube, minimal version required is >= v1.3.1, run the with the
following arguments:
```shell
minikube version
```
```
minikube version: v0.33.1
minikube version: v1.3.1
```
```shell
minikube start --network-plugin=cni --memory=4096
```
For minikube you can deploy this simple ''all-in-one'' YAML file that includes
DaemonSet configurations for Cilium, and the necessary configurations to connect
to the etcd instance deployed in minikube as well as appropriate RBAC settings:
Mount the BPF filesystem:
```shell
kubectl create -f https://raw.githubusercontent.com/cilium/cilium/v1.5/examples/kubernetes/1.14/cilium-minikube.yaml
minikube ssh -- sudo mount bpffs -t bpf /sys/fs/bpf
```
For minikube you can deploy this simple ''all-in-one'' YAML file that includes
DaemonSet configurations for Cilium as well as appropriate RBAC settings:
```shell
kubectl create -f https://raw.githubusercontent.com/cilium/cilium/v1.6/install/kubernetes/quick-install.yaml
```
```
configmap/cilium-config created
daemonset.apps/cilium created
clusterrolebinding.rbac.authorization.k8s.io/cilium created
clusterrole.rbac.authorization.k8s.io/cilium created
serviceaccount/cilium created
serviceaccount/cilium-operator created
clusterrole.rbac.authorization.k8s.io/cilium created
clusterrole.rbac.authorization.k8s.io/cilium-operator created
clusterrolebinding.rbac.authorization.k8s.io/cilium created
clusterrolebinding.rbac.authorization.k8s.io/cilium-operator created
daemonset.apps/cilium create
deployment.apps/cilium-operator created
```
The remainder of the Getting Started Guide explains how to enforce both L3/L4
@@ -62,7 +71,7 @@ policies using an example application.
## Deploying Cilium for Production Use
For detailed instructions around deploying Cilium for production, see:
[Cilium Kubernetes Installation Guide](https://cilium.readthedocs.io/en/stable/kubernetes/intro/)
[Cilium Kubernetes Installation Guide](https://docs.cilium.io/en/stable/kubernetes/intro/)
This documentation includes detailed requirements, instructions and example
production DaemonSet files.
@@ -86,14 +95,8 @@ cilium-6rxbd 1/1 Running 0 1m
...
```
There are two main components to be aware of:
- One `cilium` Pod runs on each node in your cluster and enforces network policy
A `cilium` Pod runs on each node in your cluster and enforces network policy
on the traffic to/from Pods on that node using Linux BPF.
- For production deployments, Cilium should leverage a key-value store
(e.g., etcd). The [Cilium Kubernetes Installation Guide](https://cilium.readthedocs.io/en/stable/kubernetes/intro/)
will provide the necessary steps on how to install this required key-value
store as well how to configure it in Cilium.
{{% /capture %}}