Cilium (computing) explained

Cilium
Cilium
Screenshot Alt:A command line session showing the status of a Cilium installation in a Kind Cluster
Author:Thomas Graf,
Daniel Borkmann,
André Martins,
Madhusudan Challa[1]
Developer:Open source community, Isovalent, Google, Datadog, Red Hat,
Cloud Native Computing Foundation[2]
Latest Release Version:1.15
Latest Release Date:[3]
Programming Language:Go, eBPF, C, C++
Operating System:Linux, Windows[4]
Platform:x86-64, ARM[5]
Language:English
Genre:Cloud-native Networking, Security, Observability
License:Apache License 2.0,
Dual GPL-2.0-only or BSD-2-clause for eBPF[6]

Cilium is a cloud native technology for networking, observability, and security. It is based on the kernel technology eBPF, originally for better networking performance, and now leverages many additional features for different use cases. The core networking component has evolved from only providing a flat Layer 3 network for containers to including advanced networking features, like BGP and Service mesh, within a Kubernetes cluster, across multiple clusters, and connecting with the world outside Kubernetes. Hubble was created as the network observability component and Tetragon was later added for security observability and runtime enforcement. Cilium runs on Linux and is one of the first eBPF applications being ported to Microsoft Windows through the eBPF on Windows project.[7]

History

Evolution from Networking CNI (Container Network Interface)

Cilium began as a networking CNI[8] for container workloads. It was originally IPv6 only and supported multiple container orchestrators, like Kubernetes. The original vision for Cilium was to build an intent and identity-based high-performance container networking platform. As the cloud native ecosystem expanded, Cilium added new projects and features to address new problems in the space.

The table below summarises some of the most significant milestones of this evolution:

CNCF

Cilium was accepted into the Cloud Native Computing Foundation on October 13th, 2021 as an incubation-level project. It applied to become a graduated project on October 27th 2022. It became a Graduated project one year later. Cilium is one of the fastest-moving projects in the CNCF ecosystem.[30]

Adoption

Cilium has been adopted by many large-scale production users, including over 100 that have stated it publicly,[31] for example:

Cilium is the CNI for many cloud providers including Alibaba,[45] APPUiO,[46] Azure,[47] AWS,[16] DigitalOcean,[48] Exoscale,[49] Google Cloud,[15] Hetzner,[50] and Tencent Cloud.[51]

Projects Overview

Cilium

Cilium began as a container networking project. With the growth of Kubernetes and container orchestration, Cilium became a CNI, providing basic things like configuring container network interfaces and Pod to Pod connectivity. From the beginning, Cilium based its networking on eBPF rather than iptables or IPVS, betting that eBPF would become the future of cloud native networking.[52]

Cilium’s eBPF based dataplane provides a simple flat Layer 3 network with the ability to span multiple clusters in either a native routing or overlay mode with Cilium Cluster Mesh. It is Layer 7-protocol aware and can enforce network policies on Layer 3 to Layer 7 and with FQDN using an identity-based security model that is decoupled from network addressing.

Cilium implements distributed load balancing for traffic between Pods and to external services, and is able to fully replace kube-proxy,[53] using XDP, socket-based load-balancing and efficient hash tables in eBPF. It also supports advanced functionality like integrated ingress and egress gateways,[54] bandwidth management, a stand-alone load balancer, and service mesh.[55]

Cilium is the first CNI to support advanced kernel features such as BBR TCP congestion control[56] and BIG TCP[57] for Kubernetes Pods.

Hubble

Hubble is the observability, service map, and UI of Cilium which is shipped with the CNI.[58] [59] It can be used to observe individual network packet flows, view network policy decisions to allow or block traffic, and build up service maps showing how Kubernetes services are communicating.[60] Hubble can export this data to Prometheus, OpenTelemetry, Grafana, and Fluentd for further analysis of Layer 3/4 and Layer 7 metrics.[61]

Tetragon

Tetragon is the security observability and runtime enforcement project of Cilium.[62] Tetragon is a flexible Kubernetes-aware security observability and runtime enforcement tool that applies policy and filtering directly with eBPF. It allows users to monitor and observe the complete lifecycle of every process execution on their machine, translate policies for file monitoring, network observability, container security, and more into eBPF programs, and do synchronous monitoring, filtering, and enforcement completely in the kernel.

Go eBPF Library

ebpf-go is a pure-Go library to interact with the eBPF subsystem in the Linux kernel.[63] It has minimal external dependencies, emphasises reliability and compatibility, and is widely deployed in production.

Pwru

pwru ("Packet, where are you?") is an eBPF-based tool for tracing network packets in the Linux kernel with advanced filtering capabilities. It allows fine-grained introspection of kernel state to facilitate debugging network connectivity issues. Under the hood, pwru attaches eBPF debugging programs to all Linux kernel functions which are responsible for processing network packets.

This gives a user finer-grained view into a packet processing in the kernel than with tcpdump, Wireshark, or more traditional tools. Also, it can show packet metadata such as network namespace, processing timestamp, internal kernel packet representation fields, and more.

Use Cases

Networking

Cilium began as a networking project and has many features that allow it to provide a consistent connectivity experience from Kubernetes workloads to virtual machines and physical servers running in the cloud, on-premises, or at the edge. Some of these include:

Observability

Being in the kernel, eBPF has complete visibility of everything that is happening on a machine. Cilium leverages this with the following features:

Security

eBPF can stop events in the kernel for security. Cilium projects leverage this through the following features:

Release timeline

Release timeline
VersionRelease dateEnd of Life dateNotes
31 May 201710 September 2017https://cilium.io/blog/2017/5/31/cilium-v09-released-hello-kubernetes/
24 July 201730 November 2017https://cilium.io/blog/2017/9/29/cilium-v010-v011-released-double-the-fun-two-updates-in-one/
10 September 201724 April 2018https://cilium.io/blog/2017/9/29/cilium-v010-v011-released-double-the-fun-two-updates-in-one/
30 November 201726 June 2018https://cilium.io/blog/2017/11/7/cilium-with-kafka/
24 April 201823 October 2018https://cilium.io/blog/2018/04/24/cilium-10/
26 June 201812 February 2019https://cilium.io/blog/2018/06/26/cilium-11/
21 August 201829 April 2019https://cilium.io/blog/2018/08/21/cilium-12/
23 October 201820 August 2019https://cilium.io/blog/2018/10/23/cilium-13-envoy-go/
12 February 201919 February 2020https://cilium.io/blog/2019/02/12/cilium-14/
29 April 201922 June 2020https://cilium.io/blog/2019/04/24/cilium-15/
20 August 201910 November 2020https://cilium.io/blog/2019/08/20/cilium-16/
19 February 202020 May 2021https://cilium.io/blog/2020/02/18/cilium-17/
22 June 20209 December 2021https://cilium.io/blog/2020/06/22/cilium-18/
10 November 202019 July 2022https://cilium.io/blog/2020/11/10/cilium-19/
20 May 202118 April 2023https://cilium.io/blog/2021/05/20/cilium-110/
9 December 202125 July 2023 https://isovalent.com/blog/post/2021-12-release-111/
19 July 202201 February 2024https://isovalent.com/blog/post/cilium-release-112/
15 February 2023https://isovalent.com/blog/post/cilium-release-113/
25 July 2023https://isovalent.com/blog/post/cilium-release-114/
01 February 2024https://isovalent.com/blog/post/cilium-1-15/
02 May 2024https://github.com/cilium/cilium/releases/tag/v1.16.0-pre.2

Support windows

The chart below visualises the period for which each Cilium community maintained release is/was supported:ImageSize = width:1000 height:auto barincrement:35PlotArea = left:100 right:50 bottom:30 top:10

DateFormat = dd/mm/yyyyPeriod = from:01/01/2017 till:01/01/2027TimeAxis = orientation:horizontalScaleMajor = unit:year increment:1 start:2017ScaleMinor = unit:month increment:1 start:01/01/2017

Define $dx = 25 # shift text to right side of bar

Colors = id:out_of_support value:rgb(0.992,0.702,0.671) legend:Out_of_support id:in-support value:rgb(0.996,0.973,0.776) legend:In_support id:latest value:rgb(0.831,0.957,0.706) legend:Latest_stable_version id:prerelease value:rgb(0.996,0.82,0.627) legend:Preview_version

PlotData= mark:(line,black) fontsize:S bar:1.15.x from:01/02/2024 till:30/12/2026 text:1.15.x color:latest bar:1.14.x from:25/07/2023 till:30/12/2025 text:1.14.x color:in-support bar:1.13.x from:18/04/2023 till:30/12/2024 text:1.13.x color:in-support bar:1.12.x from:19/07/2022 till:30/12/2024 text:1.12.x color:in-support bar:1.11.x from:09/12/2021 till:30/12/2024 text:1.11.x color:in-support bar:1.10.x from:20/05/2021 till:18/04/2023 text:1.10.x color:out_of_support bar:1.9.x from:10/11/2020 till:19/07/2022 text:1.9.x color:out_of_support bar:1.8.x from:22/06/2020 till:09/12/2021 text:1.8.x color:out_of_support bar:1.7.x from:19/02/2020 till:20/05/2021 text:1.7.x color:out_of_support bar:1.6.x from:20/08/2019 till:10/11/2020 text:1.6.x color:out_of_support bar:1.5.x from:29/04/2019 till:22/06/2020 text:1.5.x color:out_of_support bar:1.4.x from:12/02/2019 till:19/02/2020 text:1.4.x color:out_of_support bar:1.3.x from:23/10/2018 till:20/08/2019 text:1.3.x color:out_of_support bar:1.2.x from:21/08/2018 till:29/04/2019 text:1.2.x color:out_of_support bar:1.1.x from:26/06/2018 till:12/02/2019 text:1.1.x color:out_of_support bar:1.0.x from:24/04/2018 till:23/10/2018 text:1.0.x color:out_of_support

Community

Cilium's official website lists online forums, messaging platforms, and in-person meetups for the Cilium user and developer community.

Conferences

Conferences dedicated to Cilium development in the past have included:

Annual Report

The Cilium community releases an annual report to cover how the community developed over the course of the year:

See also

External links

Notes and References

  1. Web site: The Cilium Story - Why We Created Cilium - Thomas Graf, Isovalent, CiliumCon EU 2023. 10 June 2023. YouTube. 7 July 2023.
  2. Web site: Announcing the Cilium annual report. 26 January 2023. CNCF. 7 July 2023.
  3. Web site: Cilium Stable Releases. 10 February 2023. GitHub. 10 February 2023.
  4. Web site: Getting Linux based eBPF programs to run with eBPF for Windows. 7 July 2023. cloudblogs.microsoft.com. 7 July 2023.
  5. Web site: Supported Architectures for Cilium. 7 July 2023. GitHub. 7 July 2023.
  6. Web site: Cilium License. 7 July 2023. GitHub. 7 July 2023.
  7. Web site: ebpf for windows on GitHub. GitHub. 10 July 2023.
  8. Web site: CNI . 10 July 2023 . cni.dev.
  9. Web site: 16 December 2015 . Cilium Initial Commit . 10 July 2023 . GitHub.
  10. Web site: 28 May 2016 . Network Policy added to Cilium . 10 July 2023 . GitHub.
  11. Web site: 28 May 2016 . Cilium Fast IPV6 Container Networking with BPF and XDP . 24 August 2016 . Slideshare.
  12. Web site: 29 August 2017 . ebpf-go Initial Commit . 24 August 2016 . GitHub.
  13. Web site: Cilium 1.0 Advances Container Networking With Improved Security . 24 April 2018. 13 July 2023 . eWeek.com.
  14. Web site: 19 November 2019 . Announcing Hubble - Network, Service & Security Observability for Kubernetes . 24 August 2016 . Cilium.io.
  15. Web site: 20 August 2020 . New GKE Dataplane V2 increases security and visibility for containers . 10 July 2023 . Google Cloud Platform.
  16. Web site: 13 September 2021 . AWS Picks Cilium As Networking And Security Layer . 10 July 2023 . tfir.io.
  17. Web site: 12 October 2021 . pwru Initial Commit . 10 July 2023 . GitHub.
  18. Web site: 8 February 2023 . Going from Packet Where Aren’t You to pwru . 10 July 2023 . Cilium.io.
  19. Web site: 13 October 2021 . Cilium joins CNCF as an incubating project . 10 July 2023 . CNCF.
  20. Web site: Cilium 1.12 Adds Cilium Service Mesh And Other New Features For Enterprise Kubernetes. 21 July 2022 . 10 July 2023 . tfir.io.
  21. Web site: 16 May 2022 . Tetragon – eBPF-based Security Observability & Runtime Enforcement . 10 July 2023 . Isovalent.com.
  22. Web site: 16 July 2022 . Tetragon – eBPF-based Security Observability & Runtime Enforcement . 10 July 2023 . thenewstack.io.
  23. Web site: Bansal . Deepak . 2022-12-05 . Microsoft and Isovalent partner to bring next generation eBPF dataplane for cloud-native applications in Azure . 2024-02-06 . Microsoft Azure Blog . en-US.
  24. Web site: Ke . Deepak Bansal, Qi . 2023-06-22 . Azure CNI with Cilium: Most scalable and performant container networking in the Cloud . 2024-02-06 . Microsoft Azure Blog . en-US.
  25. Web site: 19 May 2022 . Cilium Mesh – One Mesh to Connect Them All . 10 July 2023 . Isovalent.com.
  26. Web site: 5 May 2023 . Isovalent’s Cilium Mesh bridges gap between Kubernetes and legacy workloads. 10 July 2023 . siliconangle.com.
  27. Web site: 17 April 2023 . Isovalent introduces Isovalent Cilium Mesh to Securely Connect Networks Across On-Prem, Edge, and Cloud. 10 July 2023 . finance.yahoo.com.
  28. Web site: CiliumCon Europe 2023 . 10 July 2023 . Linux Foundation.
  29. https://www.cncf.io/announcements/2023/10/11/cloud-native-computing-foundation-announces-cilium-graduation/
  30. Web site: 11 January 2023 . A look at the 2022 velocity of CNCF, Linux Foundation, and top 30 open source projects . 10 July 2023 . Cloud Native Computing Foundation.
  31. Web site: Who is using Cilium? . 10 July 2023 . GitHub.
  32. Web site: 2022-10-11 . Datadog . 2023-07-12 . Cloud Native Computing Foundation. en-US.
  33. Web site: 2022-10-11 . Tales from an eBPF Program’s Murder Mystery - Hemanth Malla & Guillaume Fournier, Datadog . 2023-07-12 . . en-US.
  34. Web site: Case Study: Ascend . 10 July 2023 . Cloud Native Computing Foundation.
  35. Web site: 21 August 2021 . Why eBPF is changing the telco networking space – Daniel Bernier, Bell Canada . 10 July 2023 . YouTube.
  36. Web site: 19 May 2022 . Leveraging Cilium and SRv6 for Telco Networking - Daniel Bernier, Bell Canada . 10 July 2023 . YouTube.
  37. Web site: 18 Jan 2023 . Cosmonic User Story: Running Cilium on Nomad for Wasm Workloads . 10 July 2023 . Cilium.io.
  38. Web site: 26 May 2023 . Cosmonic Open Source Project Integrates Nomad and Cilium . 10 July 2023 . CloudNativeNow.com.
  39. Web site: 30 May 2023 . The Cosmonic Open Source Project Combines Cilium And Nomad. 10 July 2023 . Opensourceforu.com.
  40. Web site: 19 May 2022 . IKEA Private Cloud, eBPF Based Networking, Load Balancing, and Observability with Cilium . 13 July 2023 . YouTube.
  41. Web site: 4 October 2022 . eBPF, a road to invisible network: S&P Global's Network Transformation Journey - Guru Ramamoorthy . 10 July 2023 . YouTube.
  42. Web site: 20 August 2021 . eBPF & Cilium at Sky – Sebastian Duff, Anthony Comtois, Jospeh Samuel [sic], Sky ]. 10 July 2023 . YouTube.
  43. Web site: 20 April 2023 . Designing and Securing a Multi-Tenant Runtime Environment at the New York Times - Ahmed Bebars . 10 July 2023 . YouTube.
  44. Web site: 5 February 2020 . User Story - How Trip.com uses Cilium . 10 July 2023 . Cilium.io.
  45. Web site: Cilium High Performance Cloud Native Network. Alibaba Cloud. 10 July 2023.
  46. Web site: Partnership with Isovalent. appuio.ch . 16 December 2021 . 10 July 2023.
  47. Web site: General availability: Azure CNI powered by Cilium. . 30 May 2023 . 10 July 2023.
  48. Web site: From Managed Kubernetes to App Platform: 1.5 Years of Cilium Usage at DigitalOcean. ebpf.io . 28 October 2020 . 10 July 2023.
  49. Web site: Cilium CNI & SKS. changelog.exoscale.com . 3 June 2022 . 10 July 2023.
  50. Web site: Performance Testing Cilium Ingress at Hetzner Cloud. cilium.io . 5 January 2023 . 10 July 2023.
  51. Web site: Tencent Cloud TKE-based on Cilium unified hybrid cloud container network . segmentfault.com . 1 July 2021 . 10 July 2023.
  52. Web site: Why is the kernel community replacing iptables with BPF? . linux.com. 23 April 2018 . 10 July 2023.
  53. Web site: Kubernetes Without kube-proxy . 10 July 2023 . docs.cilium.io.
  54. Web site: Egress Gateway . docs.cilium.io. 10 July 2023.
  55. Web site: Cilium 1.12 GA: Cilium Service Mesh and other major new features for enterprise Kubernetes . . 13 July 2022. 10 July 2023.
  56. Cardwell . Neal . Cheng . Yuchung . Gunn . C. Stephen . Yeganeh . Soheil Hassas . Jacobson . Van . 2016 . BBR: Congestion-Based Congestion Control . ACM Queue . 14, September-October . 20 – 53.
  57. Web site: tcp: BIG TCP implementation [LWN.net] ]. 2023-07-12 . lwn.net.
  58. Web site: Hubble on Github . 10 July 2023 . GitHub.
  59. Web site: Hubble Series (Part 1): Re-introducing Hubble . 5 June 2023 . 10 July 2023 . Isovalent.com.
  60. Web site: Service Map & Hubble UI . 10 July 2023 . docs.cilium.io.
  61. Web site: Monitoring & Metrics . 10 July 2023 . docs.cilium.io.
  62. Web site: Tetragon on Github . 10 July 2023 . GitHub.
  63. Web site: ebpf-go on Github . 10 July 2023 . GitHub.
  64. Web site: Securing Your Kubernetes Cluster: Cilium and Network Policies . 14 June 2023 . 10 July 2023 . learncloudnative.com.
  65. Web site: Layer 4 Load Balancer . 10 July 2023 . cilium.io.
  66. Web site: Maglev: A Fast and Reliable Software Network Load Balancer . research.google.com. 10 July 2023.
  67. Web site: Cilium 1.9: Maglev, Deny Policies, VM Support, OpenShift, Hubble mTLS, Bandwidth Manager, eBPF Node-Local Redirect, Datapath Optimizations, and more . 2023-07-12 . cilium.io.
  68. Web site: Cilium 1.8: XDP Load Balancing, Cluster-wide Flow Visibility, Host Network Policy, Native GKE & Azure modes, Session Affinity, CRD-mode Scalability, Policy Audit mode, ... . 2023-07-12 . cilium.io.
  69. Web site: Cluster Mesh . cilium.io. 10 July 2023.
  70. Web site: Bandwidth And Latency Optimization . cilium.io. 10 July 2023.
  71. Web site: kube-proxy replacement . cilium.io. 10 July 2023.
  72. Web site: BGP . cilium.io. 10 July 2023.
  73. Web site: Egress Gateway . cilium.io. 10 July 2023.
  74. Web site: Cilium Service Mesh . cilium.io. 10 July 2023.
  75. Web site: Redefining service mesh with Cilium . medium.com. 31 July 2022. 10 July 2023.
  76. Web site: Gateway API . cilium.io. 10 July 2023.
  77. Web site: Cloud Native Telco Day Europe 2022: Leveraging Cilium and SRv6 for Telco Net... . 2023-07-12 . cloudnativetelcodayeu22.sched.com.
  78. Web site: Accelerate network performance with Cilium BBR - Isovalent . 2023-07-12 . isovalent.com . en.
  79. Web site: Cilium 1.12 - Ingress, Multi-Cluster, Service Mesh, External Workloads, ... . 2023-07-12 . isovalent.com . en.
  80. Web site: Tuning Guide — Cilium 1.15.0-dev documentation . 2023-07-12 . docs.cilium.io.
  81. Web site: Cilium Mesh - One Mesh to Connect Them All - Isovalent . 2023-07-12 . isovalent.com . en.
  82. Web site: Cilium Mesh: A new way to extend Kubernetes benefits across on-premises and cloud networking . 26 May 2023. 2023-07-12 . techrepublic.com . en.
  83. Web site: Service Map . 10 July 2023 . cilium.io.
  84. Web site: Identity-Aware L3/L4/DNS Network Flow Logs . 10 July 2023 . cilium.io.
  85. Web site: Advanced Network Protocol Visibility . 10 July 2023 . cilium.io.
  86. Web site: Metrics & Tracing Export . 10 July 2023 . cilium.io.
  87. Web site: Transparent Encryption . cilium.io. 10 July 2023.
  88. Web site: Advanced Network Policy . 10 July 2023 . cilium.io.
  89. Web site: Runtime Enforcement . 10 July 2023 . cilium.io.
  90. Web site: Tetragon - eBPF-based Security Observability & Runtime Enforcement - Isovalent . 2023-07-12 . isovalent.com . en.
  91. Web site: KubeCon + CloudNativeCon Europe . 2023-07-12 . Linux Foundation Events . en-US.
  92. Web site: CiliumCon North America 2023 . events.linuxfoundation.com. 11 July 2023.
  93. Web site: KubeCon + CloudNativeCon North America . 2023-07-12 . Linux Foundation Events . en-US.
  94. Web site: Cilium + eBPF Day Europe . 2024-06-07 . Linux Foundation Events . en-US.
  95. Web site: KubeCon + CloudNativeCon Europe . 2024-06-07 . Linux Foundation Events . en-US.
  96. Web site: 2023-01-26 . Announcing the Cilium annual report . 2024-02-06 . CNCF . en-US.
  97. Web site: 2023-12-21 . Cilium’s 2023 annual report . 2024-02-06 . CNCF . en-US.

This article is licensed under the GNU Free Documentation License. It uses material from the Wikipedia article "Cilium (computing)".

Except where otherwise indicated, Everything.Explained.Today is © Copyright 2009-2024, A B Cryer, All Rights Reserved. Cookie policy.