Introduction
Hi, this Akshay Rao
we will be setting up cilium in Kubernetes cluster in locally with kind.
Cilium is an open source project to provide networking, security, and observability for cloud native environments such as Kubernetes clusters and other container orchestration platforms.
At the foundation of Cilium is a new Linux kernel technology called eBPF, which enables the dynamic insertion of powerful security, visibility, and networking control logic into the Linux kernel. eBPF is used to provide high-performance networking, multi-cluster and multi-cloud capabilities, advanced load balancing, transparent encryption, extensive network security capabilities, transparent observability, and much more
Let's Start
need to have kubectl tool installed
Installation
Step1
for mac
brew install kind
for windows
choco install kind
make a directory to store all the yaml files
mkdir kind-cluster-cilium
cd kind-cluster-cilium
Step2
create a file
apiVersion: kind.x-k8s.io/v1alpha4
kind: Cluster
nodes:
- role: control-plane
- role: worker
- role: worker
networking:
disableDefaultCNI: true
Run the following
[ kind-cluster-cilium (⎈|N/A:N/A)]$ kind create cluster --config kind-config.yaml
Creating cluster "kind" ...
✓ Ensuring node image (kindest/node:v1.27.1) 🖼
✓ Preparing nodes 📦 📦 📦
✓ Writing configuration 📜
✓ Starting control-plane 🕹️
✓ Installing StorageClass 💾
✓ Joining worker nodes 🚜
Set kubectl context to "kind-kind"
You can now use your cluster with:
kubectl cluster-info --context kind-kind
Have a question, bug, or feature request? Let us know! https://kind.sigs.k8s.io/#community 🙂
[ kind-cluster-cilium (⎈|kind-kind:N/A)]$ kubectl config current-context
kind-kind
[ kind-cluster-cilium (⎈|kind-kind:N/A)]$ k get nodes
NAME STATUS ROLES AGE VERSION
kind-control-plane NotReady control-plane 105s v1.27.1
kind-worker NotReady <none> 80s v1.27.1
kind-worker2 NotReady <none> 81s v1.27.1
[ kind-cluster-cilium (⎈|kind-kind:N/A)]$ k get nodes
NAME STATUS ROLES AGE VERSION
kind-control-plane NotReady control-plane 17m v1.27.1
kind-worker NotReady <none> 17m v1.27.1
kind-worker2 NotReady <none> 17m v1.27.1
step 2 - install cilium CLI tool
[ts-akshay.rao@JP-FVFZ91DHL414 kind-cluster-cilium (⎈|kind-kind:N/A)]$ CILIUM_CLI_VERSION=$(curl -s https://raw.githubusercontent.com/cilium/cilium-cli/master/stable.txt)
[ts-akshay.rao@JP-FVFZ91DHL414 kind-cluster-cilium (⎈|kind-kind:N/A)]$ CLI_ARCH=amd64
[ts-akshay.rao@JP-FVFZ91DHL414 kind-cluster-cilium (⎈|kind-kind:N/A)]$ if [ "$(uname -m)" = "arm64" ]; then CLI_ARCH=arm64; fi
curl -L --fail --remote-name-all https://github.com/cilium/cilium-cli/releases/download/${CILIUM_CLI_VERSION}/cilium-darwin-${CLI_ARCH}.tar.gz{,.sha256sum}
shasum -a 256 -c cilium-darwin-${CLI_ARCH}.tar.gz.sha256sum
sudo tar xzvfC cilium-darwin-${CLI_ARCH}.tar.gz /usr/local/bin
rm cilium-darwin-${CLI_ARCH}.tar.gz{,.sha256sum}[ts-akshay.rao@JP-FVFZ91DHL414 kind-cluster-cilium (⎈|kind-kind:N/A)]$ curl -L --fail --remote-name-all https://githuUM_CLI_VERSION}/cilium-darwin-${CLI_ARCH}.tar.gz{,.sha256sum}
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
100 30.4M 100 30.4M 0 0 13.5M 0 0:00:02 0:00:02 --:--:-- 26.5M
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
100 93 100 93 0 0 144 0 --:--:-- --:--:-- --:--:-- 144
[ kind-cluster-cilium (⎈|kind-kind:N/A)]$ shasum -a 256 -c cilium-darwin-${CLI_ARCH}.tar.gz.sha256sum
cilium-darwin-amd64.tar.gz: OK
[ kind-cluster-cilium (⎈|kind-kind:N/A)]$ sudo tar xzvfC cilium-darwin-${CLI_ARCH}.tar.gz /usr/local/bin
Password:
Sorry, try again.
Password:
x cilium
[ kind-cluster-cilium (⎈|kind-kind:N/A)]$ cilium version
cilium-cli: v0.14.6 compiled with go1.20.4 on darwin/amd64
cilium image (default): v1.13.3
cilium image (stable): v1.13.3
cilium image (running): unknown. Unable to obtain cilium version, no cilium pods found in namespace "kube-system"
[ kind-cluster-cilium (⎈|kind-kind:N/A)]$ cilium install
🔮 Auto-detected Kubernetes kind: kind
✨ Running "kind" validation checks
✅ Detected kind version "0.19.0"
ℹ️ Using Cilium version 1.13.3
🔮 Auto-detected cluster name: kind-kind
🔮 Auto-detected datapath mode: tunnel
🔮 Auto-detected kube-proxy has been installed
ℹ️ helm template --namespace kube-system cilium cilium/cilium --version 1.13.3 --set cluster.id=0,cluster.name=kind-kind,encryption.nodeEncryption=false,ipam.mode=kubernetes,kubeProxyReplacement=disabled,operator.replicas=1,serviceAccounts.cilium.name=cilium,serviceAccounts.operator.name=cilium-operator,tunnel=vxlan
ℹ️ Storing helm values file in kube-system/cilium-cli-helm-values Secret
🔑 Created CA in secret cilium-ca
🔑 Generating certificates for Hubble...
🚀 Creating Service accounts...
🚀 Creating Cluster roles...
🚀 Creating ConfigMap for Cilium version 1.13.3...
🚀 Creating Agent DaemonSet...
🚀 Creating Operator Deployment...
⌛ Waiting for Cilium to be installed and ready...
✅ Cilium was successfully installed! Run 'cilium status' to view installation health
[ kind-cluster-cilium (⎈|kind-kind:N/A)]$ cilium version
cilium-cli: v0.14.6 compiled with go1.20.4 on darwin/amd64
cilium image (default): v1.13.3
cilium image (stable): v1.13.3
cilium image (running): unknown. Unable to obtain cilium version, no cilium pods found in namespace "kube-system"
Install cilium
[ kind-cluster-cilium (⎈|kind-kind:N/A)]$ cilium install
🔮 Auto-detected Kubernetes kind: kind
✨ Running "kind" validation checks
✅ Detected kind version "0.19.0"
ℹ️ Using Cilium version 1.13.3
🔮 Auto-detected cluster name: kind-kind
🔮 Auto-detected datapath mode: tunnel
🔮 Auto-detected kube-proxy has been installed
ℹ️ helm template --namespace kube-system cilium cilium/cilium --version 1.13.3 --set cluster.id=0,cluster.name=kind-kind,encryption.nodeEncryption=false,ipam.mode=kubernetes,kubeProxyReplacement=disabled,operator.replicas=1,serviceAccounts.cilium.name=cilium,serviceAccounts.operator.name=cilium-operator,tunnel=vxlan
ℹ️ Storing helm values file in kube-system/cilium-cli-helm-values Secret
🔑 Created CA in secret cilium-ca
🔑 Generating certificates for Hubble...
🚀 Creating Service accounts...
🚀 Creating Cluster roles...
🚀 Creating ConfigMap for Cilium version 1.13.3...
🚀 Creating Agent DaemonSet...
🚀 Creating Operator Deployment...
⌛ Waiting for Cilium to be installed and ready...
✅ Cilium was successfully installed! Run 'cilium status' to view installation health
enable the hubble ui which will be used in further parts
[ kind-cluster-cilium (⎈|kind-kind:N/A)]$ cilium hubble enable --ui
🔑 Found CA in secret cilium-ca
ℹ️ helm template --namespace kube-system cilium cilium/cilium --version 1.13.3 --set cluster.id=0,cluster.name=kind-kind,encryption.nodeEncryption=false,hubble.enabled=true,hubble.relay.enabled=true,hubble.ui.enabled=true,ipam.mode=kubernetes,kubeProxyReplacement=disabled,operator.replicas=1,serviceAccounts.cilium.name=cilium,serviceAccounts.operator.name=cilium-operator,tls.ca.cert=LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNGVENDQWJxZ0F3SUJBZ0lVT3lGR0lhOW94cE81YVdWbCtodnQzK1VDeEo0d0NnWUlLb1pJemowRUF3SXcKYURFTE1Ba0dBMVVFQmhNQ1ZWTXhGakFVQmdOVkJBZ1REVk5oYmlCR2NtRnVZMmx6WTI4eEN6QUpCZ05WQkFjVApBa05CTVE4d0RRWURWUVFLRXdaRGFXeHBkVzB4RHpBTkJnTlZCQXNUQmtOcGJHbDFiVEVTTUJBR0ExVUVBeE1KClEybHNhWFZ0SUVOQk1CNFhEVEl6TURZeE1EQXdNVFF3TUZvWERUSTRNRFl3T0RBd01UUXdNRm93YURFTE1Ba0cKQTFVRUJoTUNWVk14RmpBVUJnTlZCQWdURFZOaGJpQkdjbUZ1WTJselkyOHhDekFKQmdOVkJBY1RBa05CTVE4dwpEUVlEVlFRS0V3WkRhV3hwZFcweER6QU5CZ05WQkFzVEJrTnBiR2wxYlRFU01CQUdBMVVFQXhNSlEybHNhWFZ0CklFTkJNRmt3RXdZSEtvWkl6ajBDQVFZSUtvWkl6ajBEQVFjRFFnQUU3NzhDU1hzYlNpUUlJT1BWbEY5SGsvZ20KeVpxSkRTTy9wWnZ6bjE2c3Vud3hzb2xXV2F3RFR0bG54TTFvcXB1c2dtNEJ0K2NQUGRjZllRcVBxZlVURXFOQwpNRUF3RGdZRFZSMFBBUUgvQkFRREFnRUdNQThHQTFVZEV3RUIvd1FGTUFNQkFmOHdIUVlEVlIwT0JCWUVGRkNOCkFxRVhQWWFhMU5lNlJzTENPNk9nMTJ5Sk1Bb0dDQ3FHU000OUJBTUNBMGtBTUVZQ0lRRHVyMmJyeTFTYm84SVIKQThIL3U0WnlpbUdGdVEwZVgrcWd5WEx5bTdvTXl3SWhBSy91M1NJRDFBRlhYbEhMUnVaM3dTU1RnNmZxZnFCSQo3K1lzVzJQMHZEcmEKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=,tls.ca.key=[--- REDACTED WHEN PRINTING TO TERMINAL (USE --redact-helm-certificate-keys=false TO PRINT) ---],tunnel=vxlan
✨ Patching ConfigMap cilium-config to enable Hubble...
🚀 Creating ConfigMap for Cilium version 1.13.3...
♻️ Restarted Cilium pods
⌛ Waiting for Cilium to become ready before deploying other Hubble component(s)...
🚀 Creating Peer Service...
✨ Generating certificates...
🔑 Generating certificates for Relay...
✨ Deploying Relay...
✨ Deploying Hubble UI and Hubble UI Backend...
⌛ Waiting for Hubble to be installed...
ℹ️ Storing helm values file in kube-system/cilium-cli-helm-values Secret
✅ Hubble was successfully enabled!
Step 3- Validation
[ kind-cluster-cilium (⎈|kind-kind:N/A)]$ cilium status
/¯¯\
/¯¯\__/¯¯\ Cilium: OK
\__/¯¯\__/ Operator: OK
/¯¯\__/¯¯\ Envoy DaemonSet: disabled (using embedded mode)
\__/¯¯\__/ Hubble Relay: OK
\__/ ClusterMesh: disabled
Deployment hubble-ui Desired: 1, Ready: 1/1, Available: 1/1
Deployment cilium-operator Desired: 1, Ready: 1/1, Available: 1/1
Deployment hubble-relay Desired: 1, Ready: 1/1, Available: 1/1
DaemonSet cilium Desired: 3, Ready: 3/3, Available: 3/3
Containers: hubble-relay Running: 1
cilium Running: 3
hubble-ui Running: 1
cilium-operator Running: 1
Cluster Pods: 5/5 managed by Cilium
Image versions cilium quay.io/cilium/cilium:v1.13.3@sha256:77176464a1e11ea7e89e984ac7db365e7af39851507e94f137dcf56c87746314: 3
hubble-ui quay.io/cilium/hubble-ui:v0.11.0@sha256:bcb369c47cada2d4257d63d3749f7f87c91dde32e010b223597306de95d1ecc8: 1
hubble-ui quay.io/cilium/hubble-ui-backend:v0.11.0@sha256:14c04d11f78da5c363f88592abae8d2ecee3cbe009f443ef11df6ac5f692d839: 1
cilium-operator quay.io/cilium/operator-generic:v1.13.3@sha256:fa7003cbfdf8358cb71786afebc711b26e5e44a2ed99bd4944930bba915b8910: 1
hubble-relay quay.io/cilium/hubble-relay:v1.13.3@sha256:19e4aae5ff72cd9fbcb7d2d16a1570533320a478acc015fc91a4d41a177cadf6: 1
connectivity test
[ kind-cluster-cilium (⎈|kind-kind:N/A)]$ cilium connectivity test --request-timeout 30s --connect-timeout 10s
ℹ️ Monitor aggregation detected, will skip some flow validation steps
✨ [kind-kind] Creating namespace cilium-test for connectivity check...
✨ [kind-kind] Deploying echo-same-node service...
✨ [kind-kind] Deploying DNS test server configmap...
✨ [kind-kind] Deploying same-node deployment...
✨ [kind-kind] Deploying client deployment...
✨ [kind-kind] Deploying client2 deployment...
✨ [kind-kind] Deploying echo-other-node service...
✨ [kind-kind] Deploying other-node deployment...
✨ [host-netns] Deploying kind-kind daemonset...
✨ [host-netns-non-cilium] Deploying kind-kind daemonset...
✨ [kind-kind] Deploying echo-external-node deployment...
⌛ [kind-kind] Waiting for deployments [client client2 echo-same-node] to become ready...
⌛ [kind-kind] Waiting for deployments [echo-other-node] to become ready...
⌛ [kind-kind] Waiting for CiliumEndpoint for pod cilium-test/client-6965d549d5-rtx87 to appear...
⌛ [kind-kind] Waiting for CiliumEndpoint for pod cilium-test/client2-76f4d7c5bc-mcmdn to appear...
⌛ [kind-kind] Waiting for pod cilium-test/client-6965d549d5-rtx87 to reach DNS server on cilium-test/echo-same-node-965bbc7d4-cq4f4 pod...
⌛ [kind-kind] Waiting for pod cilium-test/client2-76f4d7c5bc-mcmdn to reach DNS server on cilium-test/echo-same-node-965bbc7d4-cq4f4 pod...
⌛ [kind-kind] Waiting for pod cilium-test/client-6965d549d5-rtx87 to reach DNS server on cilium-test/echo-other-node-545c9b778b-wdgmn pod...
⌛ [kind-kind] Waiting for pod cilium-test/client2-76f4d7c5bc-mcmdn to reach DNS server on cilium-test/echo-other-node-545c9b778b-wdgmn pod...
⌛ [kind-kind] Waiting for pod cilium-test/client-6965d549d5-rtx87 to reach default/kubernetes service...
⌛ [kind-kind] Waiting for pod cilium-test/client2-76f4d7c5bc-mcmdn to reach default/kubernetes service...
⌛ [kind-kind] Waiting for CiliumEndpoint for pod cilium-test/echo-other-node-545c9b778b-wdgmn to appear...
⌛ [kind-kind] Waiting for CiliumEndpoint for pod cilium-test/echo-same-node-965bbc7d4-cq4f4 to appear...
Step 4 - Examine Cluster with kubectl
[ kind-cluster-cilium (⎈|kind-kind:N/A)]$ k get nodes
NAME STATUS ROLES AGE VERSION
kind-control-plane Ready control-plane 74m v1.27.1
kind-worker Ready <none> 74m v1.27.1
kind-worker2 Ready <none> 74m v1.27.1
[ kind-cluster-cilium (⎈|kind-kind:N/A)]$ kubectl get daemonsets --all-namespaces
NAMESPACE NAME DESIRED CURRENT READY UP-TO-DATE AVAILABLE NODE SELECTOR AGE
cilium-test host-netns 2 2 2 2 2 <none> 36m
cilium-test host-netns-non-cilium 0 0 0 0 0 cilium.io/no-schedule=true 36m
kube-system cilium 3 3 3 3 3 kubernetes.io/os=linux 42m
kube-system kube-proxy 3 3 3 3 3 kubernetes.io/os=linux 74m
[ kind-cluster-cilium (⎈|kind-kind:N/A)]$ kubectl get deployments --all-namespaces
NAMESPACE NAME READY UP-TO-DATE AVAILABLE AGE
cilium-test client 1/1 1 1 36m
cilium-test client2 1/1 1 1 36m
cilium-test echo-external-node 0/1 1 0 36m
cilium-test echo-other-node 1/1 1 1 36m
cilium-test echo-same-node 1/1 1 1 36m
kube-system cilium-operator 1/1 1 1 42m
kube-system coredns 2/2 2 2 75m
kube-system hubble-relay 1/1 1 1 38m
kube-system hubble-ui 1/1 1 1 38m
local-path-storage local-path-provisioner 1/1 1 1 75m
till this we have successfully installed cilium locally.
stay tuned for next parts.
Thank you
Top comments (0)