André Martins
5cb0e3d7b4
* Extend Cilium CNI plugin description Mention that it works on top of other CNI plugins due to the CNI chaining [1]. [1]: http://docs.cilium.io/en/v1.6/gettingstarted/cni-chaining/ Signed-off-by: Martynas Pumputis <m@lambda.lt> * Update Cilium installation steps for kubeadm - Use the latest v1.6 Cilium. - By default, Cilium no longer needs/deploys ETCD store. Signed-off-by: Martynas Pumputis <m@lambda.lt> * Update Cilium NetworkPolicy guide - Update minikube min version requirement. - Use Cilium v1.6. - Remove the etcd store bits, as Cilium v1.6 no longer depend on it by default. Signed-off-by: Martynas Pumputis <m@lambda.lt> * Update Cilium installation steps for kubeadm - How to run without kube-proxy. Signed-off-by: Martynas Pumputis <m@lambda.lt> Co-authored-by: Martynas Pumputis <m@lambda.lt>
3.1 KiB
reviewers, title, content_template, weight
| reviewers | title | content_template | weight | ||
|---|---|---|---|---|---|
|
Use Cilium for NetworkPolicy | templates/task | 20 |
{{% capture overview %}} This page shows how to use Cilium for NetworkPolicy.
For background on Cilium, read the Introduction to Cilium. {{% /capture %}}
{{% capture prerequisites %}}
{{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}
{{% /capture %}}
{{% capture steps %}}
Deploying Cilium on Minikube for Basic Testing
To get familiar with Cilium easily you can follow the Cilium Kubernetes Getting Started Guide to perform a basic DaemonSet installation of Cilium in minikube.
To start minikube, minimal version required is >= v1.3.1, run the with the following arguments:
minikube version
minikube version: v1.3.1
minikube start --network-plugin=cni --memory=4096
Mount the BPF filesystem:
minikube ssh -- sudo mount bpffs -t bpf /sys/fs/bpf
For minikube you can deploy this simple ''all-in-one'' YAML file that includes DaemonSet configurations for Cilium as well as appropriate RBAC settings:
kubectl create -f https://raw.githubusercontent.com/cilium/cilium/v1.6/install/kubernetes/quick-install.yaml
configmap/cilium-config created
serviceaccount/cilium created
serviceaccount/cilium-operator created
clusterrole.rbac.authorization.k8s.io/cilium created
clusterrole.rbac.authorization.k8s.io/cilium-operator created
clusterrolebinding.rbac.authorization.k8s.io/cilium created
clusterrolebinding.rbac.authorization.k8s.io/cilium-operator created
daemonset.apps/cilium create
deployment.apps/cilium-operator created
The remainder of the Getting Started Guide explains how to enforce both L3/L4 (i.e., IP address + port) security policies, as well as L7 (e.g., HTTP) security policies using an example application.
Deploying Cilium for Production Use
For detailed instructions around deploying Cilium for production, see: Cilium Kubernetes Installation Guide This documentation includes detailed requirements, instructions and example production DaemonSet files.
{{% /capture %}}
{{% capture discussion %}}
Understanding Cilium components
Deploying a cluster with Cilium adds Pods to the kube-system namespace. To see
this list of Pods run:
kubectl get pods --namespace=kube-system
You'll see a list of Pods similar to this:
NAME READY STATUS RESTARTS AGE
cilium-6rxbd 1/1 Running 0 1m
...
A cilium Pod runs on each node in your cluster and enforces network policy
on the traffic to/from Pods on that node using Linux BPF.
{{% /capture %}}
{{% capture whatsnext %}} Once your cluster is running, you can follow the Declare Network Policy to try out Kubernetes NetworkPolicy with Cilium. Have fun, and if you have questions, contact us using the Cilium Slack Channel. {{% /capture %}}