Unveiling Cilium and its role to play in CNC.

What is Cilium?

Cilium is an open source project which provides - security, networking and observability for cloud native environments such as container orchestration platforms mainly Kubernetes. It supports transparent encryption of both Cilium-managed host traffic and traffic between Cilium-managed endpoints, this encryption is achieved using IPsec or WireGuard protocols. Two other security protocols - Network Policy and Runtime Enforcement are also supported by Cilium.

Here are the rest of its attributes

Networking

• High Performance Networking (CNI)
• Layer 4 Load Balancer
• Cluster Mesh
• Bandwidth and Latency Optimization
• Kube-proxy Replacement
• BGP
• Egress gateway
• Service Mesh
• Gateway API

Observability

• Service Map
• Metrics and Tracing Export
• Identity-aware L3/L4/DNS Network Flow Logs
• Advanced Network Protocol Visibility

At the base of Cilium is new Linux kernel technology called eBPf.

Read this article to understand my take on eBPF: Programmability and Performance in the Linux Kernel by eBPF

Networking under Cilium

High CNI performance for Cloud Native Networking. Cilium's control and data plane has been built from the ground up for large scale and highly dynamic Cloud Native Environments where 100s and even 1000s of containers are created and destroyed within seconds.
Cilium's control plane is highly optimized, running in Kubernetes clusters within 1000s of nodes and 100K pods.
Cilium's data plane uses eBPF for efficient load balancing and incremental updates, avoiding the pitfalls of large iptables rulesets.

Observability under Cilium

Cilium, with its powerful observability features, provides cluster-wide visibility into your Kubernetes network and security layer. The Hubble observability layer within Cilium offers insights into traffic flows, security policy enforcement, and network interactions across your entire cluster. By enabling Hubble, you gain a comprehensive view of your network, making monitoring, troubleshooting, and securing your Kubernetes environment easier than ever.

Security under Cilium

• Transparent Encryption - ensures secure communication between workloads using efficient in-kernel IPsec or WireGuard encryption. This transparent encryption safeguards data in transit.

• Network Policy Runtime Enforcement - enforces fine-grained network policies based on identity-aware access control. It allows you to define rules for communication between services, ensuring only authorized traffic flows.

• Advanced Network Policies - supports native HTTP and DNS protocol-based network policies. You can define rules at the L3/L4 layer, enhancing security and segmentation.

• Identity-aware Service Security - provides mutual authentication between services. It ensures that only authenticated and authorized services can communicate.

• Observability for Security - The Hubble observability layer within Cilium offers insights into network flows, security policy enforcement, and interactions across your Kubernetes cluster.