README
¶
|logo|
|cii| |build-status| |pulls| |slack| |go-report| |go-doc| |rtd| |apache| |gpl|
Cilium is open source software for providing and transparently securing network
connectivity and loadbalancing between application workloads such as
application containers or processes. Cilium operates at Layer 3/4 to provide
traditional networking and security services as well as Layer 7 to protect and
secure use of modern application protocols such as HTTP, gRPC and Kafka. Cilium
is integrated into common orchestration frameworks such as Kubernetes and Mesos.
A new Linux kernel technology called BPF is at the foundation of Cilium. It
supports dynamic insertion of BPF bytecode into the Linux kernel at various
integration points such as: network IO, application sockets, and tracepoints to
implement security, networking and visibility logic. BPF is highly efficient
and flexible. To learn more about BPF, read more in our extensive
`BPF and XDP Reference Guide`_.
.. image:: https://cdn.rawgit.com/cilium/cilium/master/Documentation/images/cilium-arch.png
:align: center
Stable Releases
===============
The Cilium community maintains minor stable releases for the last three major
Cilium versions. Older Cilium stable versions from major releases prior to that
are considered EOL.
For upgrades to new major releases please consult the `Cilium Upgrade Guide
<https://docs.cilium.io/en/stable/install/upgrade/>`_.
Listed below are the actively maintained release branches along with their latest
minor release, corresponding image pull tags and their release notes:
+-------------------------------------------------------+------------+-------------------------------------+---------------------------------------------------------------------------+------------------------------------------------------------------------+
| `v1.7 <https://github.com/cilium/cilium/tree/v1.7>`__ | 2020-05-15 | ``docker.io/cilium/cilium:v1.7.4`` | `Release Notes <https://github.com/cilium/cilium/releases/tag/v1.7.4>`__ | `General Announcement <https://cilium.io/blog/2020/02/18/cilium-17>`__ |
+-------------------------------------------------------+------------+-------------------------------------+---------------------------------------------------------------------------+------------------------------------------------------------------------+
| `v1.6 <https://github.com/cilium/cilium/tree/v1.6>`__ | 2020-03-25 | ``docker.io/cilium/cilium:v1.6.8`` | `Release Notes <https://github.com/cilium/cilium/releases/tag/v1.6.8>`__ | `General Announcement <https://cilium.io/blog/2019/08/20/cilium-16>`__ |
+-------------------------------------------------------+------------+-------------------------------------+---------------------------------------------------------------------------+------------------------------------------------------------------------+
| `v1.5 <https://github.com/cilium/cilium/tree/v1.5>`__ | 2020-03-04 | ``docker.io/cilium/cilium:v1.5.13`` | `Release Notes <https://github.com/cilium/cilium/releases/tag/v1.5.13>`__ | `General Announcement <https://cilium.io/blog/2019/04/24/cilium-15>`__ |
+-------------------------------------------------------+------------+-------------------------------------+---------------------------------------------------------------------------+------------------------------------------------------------------------+
Functionality Overview
======================
.. begin-functionality-overview
Protect and secure APIs transparently
-------------------------------------
Ability to secure modern application protocols such as REST/HTTP, gRPC and
Kafka. Traditional firewalls operates at Layer 3 and 4. A protocol running on a
particular port is either completely trusted or blocked entirely. Cilium
provides the ability to filter on individual application protocol requests such
as:
- Allow all HTTP requests with method ``GET`` and path ``/public/.*``. Deny all
other requests.
- Allow ``service1`` to produce on Kafka topic ``topic1`` and ``service2`` to
consume on ``topic1``. Reject all other Kafka messages.
- Require the HTTP header ``X-Token: [0-9]+`` to be present in all REST calls.
See the section `Layer 7 Policy`_ in our documentation for the latest list of
supported protocols and examples on how to use it.
Secure service to service communication based on identities
-----------------------------------------------------------
Modern distributed applications rely on technologies such as application
containers to facilitate agility in deployment and scale out on demand. This
results in a large number of application containers to be started in a short
period of time. Typical container firewalls secure workloads by filtering on
source IP addresses and destination ports. This concept requires the firewalls
on all servers to be manipulated whenever a container is started anywhere in
the cluster.
In order to avoid this situation which limits scale, Cilium assigns a security
identity to groups of application containers which share identical security
policies. The identity is then associated with all network packets emitted by
the application containers, allowing to validate the identity at the receiving
node. Security identity management is performed using a key-value store.
Secure access to and from external services
-------------------------------------------
Label based security is the tool of choice for cluster internal access control.
In order to secure access to and from external services, traditional CIDR based
security policies for both ingress and egress are supported. This allows to
limit access to and from application containers to particular IP ranges.
Simple Networking
-----------------
A simple flat Layer 3 network with the ability to span multiple clusters
connects all application containers. IP allocation is kept simple by using host
scope allocators. This means that each host can allocate IPs without any
coordination between hosts.
The following multi node networking models are supported:
* **Overlay:** Encapsulation-based virtual network spanning all hosts.
Currently VXLAN and Geneve are baked in but all encapsulation formats
supported by Linux can be enabled.
When to use this mode: This mode has minimal infrastructure and integration
requirements. It works on almost any network infrastructure as the only
requirement is IP connectivity between hosts which is typically already
given.
* **Native Routing:** Use of the regular routing table of the Linux host.
The network is required to be capable to route the IP addresses of the
application containers.
When to use this mode: This mode is for advanced users and requires some
awareness of the underlying networking infrastructure. This mode works well
with:
- Native IPv6 networks
- In conjunction with cloud network routers
- If you are already running routing daemons
Load balancing
--------------
Distributed load balancing for traffic between application containers and to
external services. The loadbalancing is implemented using BPF using efficient
hashtables allowing for almost unlimited scale and supports direct server
return (DSR) if the loadbalancing operation is not performed on the source
host.
*Note: load balancing requires connection tracking to be enabled. This is the
default.*
Monitoring and Troubleshooting
------------------------------
The ability to gain visibility and to troubleshoot issues is fundamental to the
operation of any distributed system. While we learned to love tools like
``tcpdump`` and ``ping`` and while they will always find a special place in our
hearts, we strive to provide better tooling for troubleshooting. This includes
tooling to provide:
- Event monitoring with metadata: When a packet is dropped, the tool doesn't
just report the source and destination IP of the packet, the tool provides
the full label information of both the sender and receiver among a lot of
other information.
- Policy decision tracing: Why is a packet being dropped or a request rejected.
The policy tracing framework allows to trace the policy decision process for
both, running workloads and based on arbitrary label definitions.
- Metrics export via Prometheus: Key metrics are exported via Prometheus for
integration with your existing dashboards.
- Hubble_: An observability platform specifically written for Cilium. It
provides service dependency maps, operational monitoring and alerting,
and application and security visibility based on flow logs.
.. _Hubble: https://github.com/cilium/hubble/
Integrations
------------
* Network plugin integrations: CNI_, libnetwork_
* Container runtime events: containerd_
* Kubernetes: NetworkPolicy_, Labels_, Ingress_, Service_
.. _CNI: https://github.com/containernetworking/cni
.. _libnetwork: https://github.com/docker/libnetwork
.. _containerd: https://github.com/containerd/containerd
.. _service: https://kubernetes.io/docs/concepts/services-networking/service/
.. _Ingress: https://kubernetes.io/docs/concepts/services-networking/ingress/
.. _NetworkPolicy: https://kubernetes.io/docs/concepts/services-networking/network-policies/
.. _Labels: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
.. _`Layer 7 Policy`: http://docs.cilium.io/en/stable/policy/#layer-7
.. end-functionality-overview
Getting Started
===============
* `Why Cilium?`_
* `Getting Started`_
* `Architecture and Concepts`_
* `Installing Cilium`_
* `Frequently Asked Questions`_
* Contributing_
What is eBPF and XDP?
=====================
Berkeley Packet Filter (BPF) is a Linux kernel bytecode interpreter originally
introduced to filter network packets, e.g. for tcpdump and socket filters. The
BPF instruction set and surrounding architecture has recently been
significantly reworked with additional data structures such as hash tables and
arrays for keeping state as well as additional actions to support packet
mangling, forwarding, encapsulation, etc. Furthermore, a compiler back end for
LLVM allows for programs to be written in C and compiled into BPF instructions.
An in-kernel verifier ensures that BPF programs are safe to run and a JIT
compiler converts the BPF bytecode to CPU architecture specific instructions
for native execution efficiency. BPF programs can be run at various hooking
points in the kernel such as for incoming packets, outgoing packets, system
calls, kprobes, uprobes, tracepoints, etc.
BPF continues to evolve and gain additional capabilities with each new Linux
release. Cilium leverages BPF to perform core data path filtering, mangling,
monitoring and redirection, and requires BPF capabilities that are in any Linux
kernel version 4.8.0 or newer (the latest current stable Linux kernel is
4.14.x).
Many Linux distributions including CoreOS, Debian, Docker's LinuxKit, Fedora,
openSUSE and Ubuntu already ship kernel versions >= 4.8.x. You can check your Linux
kernel version by running ``uname -a``. If you are not yet running a recent
enough kernel, check the Documentation of your Linux distribution on how to run
Linux kernel 4.9.x or later.
To read up on the necessary kernel versions to run the BPF runtime, see the
section Prerequisites_.
.. image:: https://cdn.rawgit.com/cilium/cilium/master/Documentation/images/bpf-overview.png
:align: center
XDP is a further step in evolution and enables to run a specific flavor of BPF
programs from the network driver with direct access to the packet's DMA buffer.
This is, by definition, the earliest possible point in the software stack,
where programs can be attached to in order to allow for a programmable, high
performance packet processor in the Linux kernel networking data path.
Further information about BPF and XDP targeted for developers can be found in
the `BPF and XDP Reference Guide`_.
To know more about Cilium, it's extensions and use cases around Cilium and BPF
take a look at `Further Readings <FURTHER_READINGS.rst>`_ section.
Community
=========
Slack
-----
Join the Cilium `Slack channel <https://cilium.herokuapp.com/>`_ to chat with
Cilium developers and other Cilium users. This is a good place to learn about
Cilium, ask questions, and share your experiences.
Special Interest Groups (SIG)
-----------------------------
See `Special Interest groups
<https://docs.cilium.io/en/stable/community/#special-interest-groups>`_ for a list of all SIGs and their meeting times.
Weekly Developer meeting
------------------------
* The developer community is hanging out on zoom on a weekly basis to chat.
Everybody is welcome.
* Weekly, Monday, 8:00 am PT, 11:00 am ET, 5:00 pm CEST
* `Join zoom <https://zoom.us/j/596609673>`_
License
=======
The cilium user space components are licensed under the
`Apache License, Version 2.0 <LICENSE>`_. The BPF code templates are licensed
under the `General Public License, Version 2.0 <bpf/COPYING>`_.
.. _`Why Cilium?`: http://docs.cilium.io/en/stable/intro/#why-cilium
.. _`Getting Started`: http://docs.cilium.io/en/stable/gettingstarted/
.. _`Architecture and Concepts`: http://docs.cilium.io/en/stable/concepts/
.. _`Installing Cilium`: http://docs.cilium.io/en/stable/gettingstarted/#installation
.. _`Frequently Asked Questions`: https://github.com/cilium/cilium/issues?utf8=%E2%9C%93&q=is%3Aissue+label%3Akind%2Fquestion+
.. _Contributing: http://docs.cilium.io/en/stable/contributing/development/
.. _Prerequisites: http://docs.cilium.io/en/doc-1.0/install/system_requirements
.. _`BPF and XDP Reference Guide`: http://docs.cilium.io/en/stable/bpf/
.. |logo| image:: https://cdn.rawgit.com/cilium/cilium/master/Documentation/images/logo.svg
:alt: Cilium Logo
:width: 350px
.. |build-status| image:: https://jenkins.cilium.io/job/cilium-ginkgo/job/cilium/job/master/badge/icon
:alt: Build Status
:scale: 100%
:target: https://jenkins.cilium.io/job/cilium-ginkgo/job/cilium/job/master/
.. |go-report| image:: https://goreportcard.com/badge/github.com/cilium/cilium
:alt: Go Report Card
:target: https://goreportcard.com/report/github.com/cilium/cilium
.. |go-doc| image:: https://godoc.org/github.com/cilium/cilium?status.svg
:alt: GoDoc
:target: https://godoc.org/github.com/cilium/cilium
.. |rtd| image:: https://readthedocs.org/projects/docs/badge/?version=latest
:alt: Read the Docs
:target: http://docs.cilium.io/
.. |apache| image:: https://img.shields.io/badge/license-Apache-blue.svg
:alt: Apache licensed
:target: https://github.com/cilium/cilium/blob/master/LICENSE
.. |gpl| image:: https://img.shields.io/badge/license-GPL-blue.svg
:alt: GPL licensed
:target: https://github.com/cilium/cilium/blob/master/bpf/COPYING
.. |slack| image:: https://cilium.herokuapp.com/badge.svg
:alt: Join the Cilium slack channel
:target: https://cilium.herokuapp.com/
.. |cii| image:: https://bestpractices.coreinfrastructure.org/projects/1269/badge
:alt: CII Best Practices
:target: https://bestpractices.coreinfrastructure.org/projects/1269
.. |pulls| image:: https://img.shields.io/docker/pulls/cilium/cilium.svg
:alt: Cilium pulls
:target: https://hub.docker.com/r/cilium/cilium/tags/
Directories
¶
| Path | Synopsis |
|---|---|
|
api
|
|
|
v1/health/server
Package server Cilium-Health API Cilium Health Checker Schemes: unix Host: localhost BasePath: /v1beta Version: v1beta Consumes: - application/json Produces: - application/json swagger:meta
|
Package server Cilium-Health API Cilium Health Checker Schemes: unix Host: localhost BasePath: /v1beta Version: v1beta Consumes: - application/json Produces: - application/json swagger:meta |
|
v1/models
Package models defines all models to be used in the Cilium API.
|
Package models defines all models to be used in the Cilium API. |
|
v1/server
Package server Cilium API Cilium Schemes: unix Host: localhost BasePath: /v1 Version: v1beta Consumes: - application/json Produces: - application/json swagger:meta
|
Package server Cilium API Cilium Schemes: unix Host: localhost BasePath: /v1 Version: v1beta Consumes: - application/json Produces: - application/json swagger:meta |
|
pkg
|
|
|
alignchecker
Package alignchecker provides routines to check Go and C struct alignments
|
Package alignchecker provides routines to check Go and C struct alignments |
|
allocator
Package allocator provides a kvstore based ID allocator
|
Package allocator provides a kvstore based ID allocator |
|
api
Package api provides the Cilium useful helpers for the external API
|
Package api provides the Cilium useful helpers for the external API |
|
aws/eni
Package eni implements AWS ENI allocation logic
|
Package eni implements AWS ENI allocation logic |
|
azure/ipam
Package ipam implements Azure IPAM logic
|
Package ipam implements Azure IPAM logic |
|
azure/types
+groupName=azure
|
+groupName=azure |
|
bpf
Package bpf provides functions that allow golang programs to interact with bpf maps.
|
Package bpf provides functions that allow golang programs to interact with bpf maps. |
|
bpf/binary
Package binary is a fork of the upstream golang library.
|
Package binary is a fork of the upstream golang library. |
|
byteorder
Package byteorder provides functions to convert from and to network byte order.
|
Package byteorder provides functions to convert from and to network byte order. |
|
command/exec
Package exec provides useful wrappers around the standard "exec" library.
|
Package exec provides useful wrappers around the standard "exec" library. |
|
completion
Package completion implements a variant of sync.WaitGroup that is associated with a context.Context.
|
Package completion implements a variant of sync.WaitGroup that is associated with a context.Context. |
|
controller
Package controller provide a simple pattern for async operations that require retries and/or regular intervals.
|
Package controller provide a simple pattern for async operations that require retries and/or regular intervals. |
|
counter
Package counter provides generic reference counter objects
|
Package counter provides generic reference counter objects |
|
crypto/sha1
Package sha1 provides resumable sha1 hashes based on the standard go library.
|
Package sha1 provides resumable sha1 hashes based on the standard go library. |
|
datapath
Package datapath defines the interfaces to abstract all platform specific datapath components.
|
Package datapath defines the interfaces to abstract all platform specific datapath components. |
|
datapath/alignchecker
Package alignchecker is a thin wrapper around pkg/alignchecker to validate datapath object alignment.
|
Package alignchecker is a thin wrapper around pkg/alignchecker to validate datapath object alignment. |
|
datapath/connector
Package connector is responsible for the datapath specific plumbing to connect an endpoint to the network
|
Package connector is responsible for the datapath specific plumbing to connect an endpoint to the network |
|
datapath/fake
Package fake is a fake datapath implementation.
|
Package fake is a fake datapath implementation. |
|
datapath/ipcache
Package ipcache provides a BPF datapath implementation of the IPCache store.
|
Package ipcache provides a BPF datapath implementation of the IPCache store. |
|
datapath/iptables
Package iptables manages iptables-related configuration for Cilium.
|
Package iptables manages iptables-related configuration for Cilium. |
|
datapath/link
Package link provides the Cilium specific abstraction and useful helpers to manage network interfaces
|
Package link provides the Cilium specific abstraction and useful helpers to manage network interfaces |
|
datapath/linux
Package linux implements the Linux specific datapath implementation
|
Package linux implements the Linux specific datapath implementation |
|
datapath/linux/ipsec
Package ipsec provides the Linux datpaath specific abstraction and useful helpers to manage IPSec via Linux xfrm.
|
Package ipsec provides the Linux datpaath specific abstraction and useful helpers to manage IPSec via Linux xfrm. |
|
datapath/linux/linux_defaults
Package linux_defaults provides the Linux datapath defaults
|
Package linux_defaults provides the Linux datapath defaults |
|
datapath/linux/probes
Package probes provides BPF features checks based on bpftool.
|
Package probes provides BPF features checks based on bpftool. |
|
datapath/linux/route
Package route provides the Cilium specific abstraction and useful helpers to manage network routes
|
Package route provides the Cilium specific abstraction and useful helpers to manage network routes |
|
datapath/loader
Package loader provides accessors to compilation and BPF load routines necessary for creating datapath objects and attaching them to links.
|
Package loader provides accessors to compilation and BPF load routines necessary for creating datapath objects and attaching them to links. |
|
datapath/maps
Package maps performs various lifecycle operations related to maps in the datapath.
|
Package maps performs various lifecycle operations related to maps in the datapath. |
|
datapath/prefilter
Package prefilter provides a means of configuring XDP pre-filters for DDoS-mitigation.
|
Package prefilter provides a means of configuring XDP pre-filters for DDoS-mitigation. |
|
elf
Package elf provides utility functions for manipulating ELF files on the filesystem.
|
Package elf provides utility functions for manipulating ELF files on the filesystem. |
|
endpointmanager
Package endpointmanager manages the list of all local endpoints
|
Package endpointmanager manages the list of all local endpoints |
|
envoy/xds
Package xds is an implementation of Envoy's xDS (Discovery Service) protocol.
|
Package xds is an implementation of Envoy's xDS (Discovery Service) protocol. |
|
eventqueue
Package eventqueue implements a queue-based system for event processing in a generic fashion in a first-in, first-out manner.
|
Package eventqueue implements a queue-based system for event processing in a generic fashion in a first-in, first-out manner. |
|
fqdn
Package fqdn handles some of the DNS-based policy functions: - A DNS lookup cache used to populate toFQDNs rules in the policy layer.
|
Package fqdn handles some of the DNS-based policy functions: - A DNS lookup cache used to populate toFQDNs rules in the policy layer. |
|
identity
Package identity contains code for managing security identities in Cilium.
|
Package identity contains code for managing security identities in Cilium. |
|
identity/identitymanager
Package identitymanager tracks which global identities are being used by the currently running cilium-agent
|
Package identitymanager tracks which global identities are being used by the currently running cilium-agent |
|
ip
Package ip is a library for performing manipulations on IPv4 and IPv6 addresses and CIDR prefixes.
|
Package ip is a library for performing manipulations on IPv4 and IPv6 addresses and CIDR prefixes. |
|
ipam
Package ipam handles address allocation management
|
Package ipam handles address allocation management |
|
ipam/types
+groupName=ipam
|
+groupName=ipam |
|
ipcache
Package ipcache provides a local cache of the mapping of IPs of endpoints managed by Cilium to their corresponding security identities.
|
Package ipcache provides a local cache of the mapping of IPs of endpoints managed by Cilium to their corresponding security identities. |
|
k8s
Package k8s abstracts all Kubernetes specific behaviour Package k8s abstracts all Kubernetes specific behaviour Package k8s contains all k8s related logic.
|
Package k8s abstracts all Kubernetes specific behaviour Package k8s abstracts all Kubernetes specific behaviour Package k8s contains all k8s related logic. |
|
k8s/apis/cilium.io/v2
Package v2 is the v2 version of the API.
|
Package v2 is the v2 version of the API. |
|
k8s/client/clientset/versioned
This package has the automatically generated clientset.
|
This package has the automatically generated clientset. |
|
k8s/client/clientset/versioned/fake
This package has the automatically generated fake clientset.
|
This package has the automatically generated fake clientset. |
|
k8s/client/clientset/versioned/scheme
This package contains the scheme of the automatically generated clientset.
|
This package contains the scheme of the automatically generated clientset. |
|
k8s/client/clientset/versioned/typed/cilium.io/v2
This package has the automatically generated typed clients.
|
This package has the automatically generated typed clients. |
|
k8s/client/clientset/versioned/typed/cilium.io/v2/fake
Package fake has the automatically generated clients.
|
Package fake has the automatically generated clients. |
|
k8s/slim/k8s/apis/core/v1
Package types contains slimmer versions of k8s types.
|
Package types contains slimmer versions of k8s types. |
|
k8s/slim/k8s/apis/discovery/v1beta1
Package types contains slimmer versions of k8s types.
|
Package types contains slimmer versions of k8s types. |
|
k8s/slim/k8s/apis/labels
Package labels implements a simple label system, parsing and matching selectors with sets of labels.
|
Package labels implements a simple label system, parsing and matching selectors with sets of labels. |
|
k8s/slim/k8s/apis/meta/v1
Package types contains slimmer versions of k8s types.
|
Package types contains slimmer versions of k8s types. |
|
k8s/slim/k8s/apis/networking/v1
Package types contains slimmer versions of k8s types.
|
Package types contains slimmer versions of k8s types. |
|
k8s/slim/k8s/apis/util/intstr
Package types contains slimmer versions of k8s types.
|
Package types contains slimmer versions of k8s types. |
|
k8s/slim/k8s/client/clientset/versioned
This package has the automatically generated clientset.
|
This package has the automatically generated clientset. |
|
k8s/slim/k8s/client/clientset/versioned/fake
This package has the automatically generated fake clientset.
|
This package has the automatically generated fake clientset. |
|
k8s/slim/k8s/client/clientset/versioned/scheme
This package contains the scheme of the automatically generated clientset.
|
This package contains the scheme of the automatically generated clientset. |
|
k8s/slim/k8s/client/clientset/versioned/typed/core/v1
This package has the automatically generated typed clients.
|
This package has the automatically generated typed clients. |
|
k8s/slim/k8s/client/clientset/versioned/typed/core/v1/fake
Package fake has the automatically generated clients.
|
Package fake has the automatically generated clients. |
|
k8s/slim/k8s/client/clientset/versioned/typed/discovery/v1beta1
This package has the automatically generated typed clients.
|
This package has the automatically generated typed clients. |
|
k8s/slim/k8s/client/clientset/versioned/typed/discovery/v1beta1/fake
Package fake has the automatically generated clients.
|
Package fake has the automatically generated clients. |
|
k8s/slim/k8s/client/clientset/versioned/typed/networking/v1
This package has the automatically generated typed clients.
|
This package has the automatically generated typed clients. |
|
k8s/slim/k8s/client/clientset/versioned/typed/networking/v1/fake
Package fake has the automatically generated clients.
|
Package fake has the automatically generated clients. |
|
k8s/types
Package types contains slimmer versions of k8s types.
|
Package types contains slimmer versions of k8s types. |
|
k8s/version
Package version keeps track of the Kubernetes version the client is connected to
|
Package version keeps track of the Kubernetes version the client is connected to |
|
kafka
Package kafka provides a library to parse Kafka requests and responses and apply policy rules
|
Package kafka provides a library to parse Kafka requests and responses and apply policy rules |
|
kvstore
Package kvstore abstracts KVstore access and provides a high level API to atomically manage cluster wide resources
|
Package kvstore abstracts KVstore access and provides a high level API to atomically manage cluster wide resources |
|
kvstore/allocator
Package allocator provides a kvstore based ID allocator
|
Package allocator provides a kvstore based ID allocator |
|
kvstore/store
Package store implements a shared store backed by a kvstore or similar with the following properties: * A single type is used to represent all keys * Any number of collaborators can join the store.
|
Package store implements a shared store backed by a kvstore or similar with the following properties: * A single type is used to represent all keys * Any number of collaborators can join the store. |
|
labels
Package api defines the API of the Cilium network policy interface
|
Package api defines the API of the Cilium network policy interface |
|
labels/cidr
Package cidr provides helper methods for generating labels for CIDRs which are partially derived from node state.
|
Package cidr provides helper methods for generating labels for CIDRs which are partially derived from node state. |
|
loadbalancer
Package loadbalancer contains all logic related with the loadbalancer +groupName=pkg
|
Package loadbalancer contains all logic related with the loadbalancer +groupName=pkg |
|
loadinfo
Package loadinfo provides the ability to log system load information either at a particular time or periodically in the background
|
Package loadinfo provides the ability to log system load information either at a particular time or periodically in the background |
|
logging/logfields
Package logfields defines common logging fields which are used across packages
|
Package logfields defines common logging fields which are used across packages |
|
maps/callsmap
Package callsmap represents the internal calls map for endpoint and host datapaths.
|
Package callsmap represents the internal calls map for endpoint and host datapaths. |
|
maps/ctmap
+groupName=maps
|
+groupName=maps |
|
maps/encrypt
Package encrypt represents the nodes current encryption state.
|
Package encrypt represents the nodes current encryption state. |
|
maps/eppolicymap
Package eppolicymap represents the map from an endpoint ID to its policy map.
|
Package eppolicymap represents the map from an endpoint ID to its policy map. |
|
maps/eventsmap
Package eventsmap represents the perf event map used by the datapath to send events to the Cilium agent.
|
Package eventsmap represents the perf event map used by the datapath to send events to the Cilium agent. |
|
maps/fragmap
Package fragmap represents the BPF map used to associate IPv4 datagram fragments to the L4 ports of the datagram they belong to, in order to retrieve the full 5-tuple necessary to do L4-based lookups.
|
Package fragmap represents the BPF map used to associate IPv4 datagram fragments to the L4 ports of the datagram they belong to, in order to retrieve the full 5-tuple necessary to do L4-based lookups. |
|
maps/ipcache
+groupName=maps
|
+groupName=maps |
|
maps/lbmap
+groupName=maps
|
+groupName=maps |
|
maps/lxcmap
Package lxcmap represents the endpoints BPF map in the BPF programs.
|
Package lxcmap represents the endpoints BPF map in the BPF programs. |
|
maps/metricsmap
Package metricsmap represents the BPF metrics map in the BPF programs.
|
Package metricsmap represents the BPF metrics map in the BPF programs. |
|
maps/nat
Package nat implements the BPF NAT map interaction code.
|
Package nat implements the BPF NAT map interaction code. |
|
maps/neighborsmap
Package neighborsmap represents the map that stores IP to mac address mappings for NodePort clients.
|
Package neighborsmap represents the map that stores IP to mac address mappings for NodePort clients. |
|
maps/policymap
+groupName=maps
|
+groupName=maps |
|
maps/signalmap
Package signalmap represents the perf event map used to signal potential congestion to Cilium agent.
|
Package signalmap represents the perf event map used to signal potential congestion to Cilium agent. |
|
maps/sockmap
Package Sockmap represents the map from 5-tuple to the socket.
|
Package Sockmap represents the map from 5-tuple to the socket. |
|
maps/tunnel
+groupName=maps
|
+groupName=maps |
|
metrics
Package metrics holds prometheus metrics objects and related utility functions.
|
Package metrics holds prometheus metrics objects and related utility functions. |
|
modules
Package modules contains a manager of loaded modules which supports search operation.
|
Package modules contains a manager of loaded modules which supports search operation. |
|
monitor/alignchecker
Package alignchecker is a thin wrapper around pkg/alignchecker to validate monitor object alignment.
|
Package alignchecker is a thin wrapper around pkg/alignchecker to validate monitor object alignment. |
|
monitor/format
Package format provides stdout formatting of monitor messages for reuse by command-line clients of the monitor event channel.
|
Package format provides stdout formatting of monitor messages for reuse by command-line clients of the monitor event channel. |
|
mtu
Package mtu is a library for tracking and configuring MTU for devices and routes.
|
Package mtu is a library for tracking and configuring MTU for devices and routes. |
|
netns
Package netns contains various utility functions to work with network namespaces
|
Package netns contains various utility functions to work with network namespaces |
|
node
Package node provides functionality related to the local and remote node addresses
|
Package node provides functionality related to the local and remote node addresses |
|
policy/api
Package api defines the API of the Cilium network policy interface +groupName=policy
|
Package api defines the API of the Cilium network policy interface +groupName=policy |
|
policy/trafficdirection
package trafficdirection specifies the directionality of policy in a numeric representation.
|
package trafficdirection specifies the directionality of policy in a numeric representation. |
|
pprof
Package pprof enables use of pprof in Cilium
|
Package pprof enables use of pprof in Cilium |
|
probe
Package probe provides a collection of kernel-side BPF feature probes.
|
Package probe provides a collection of kernel-side BPF feature probes. |
|
proxy/logger
Package logger provides the accesslog logging logic for all proxies
|
Package logger provides the accesslog logging logic for all proxies |
|
safetime
Package safetime contains a wrapper function for time.Since to deal with negative durations.
|
Package safetime contains a wrapper function for time.Since to deal with negative durations. |
|
set
Package set contains a function for performing a subset check for slices.
|
Package set contains a function for performing a subset check for slices. |
|
signal
Package signal provides handling notifications from perf RB signal map.
|
Package signal provides handling notifications from perf RB signal map. |
|
spanstat
Package spanstat provides a mechanism to measure duration of multiple spans and add them up to a total duration
|
Package spanstat provides a mechanism to measure duration of multiple spans and add them up to a total duration |
|
sysctl
Package sysctl allows to change kernel parameters at runtime.
|
Package sysctl allows to change kernel parameters at runtime. |
|
trigger
Package trigger provides a mechanism to trigger actions that require to be serialized while providing a non-blocking notification mechanism
|
Package trigger provides a mechanism to trigger actions that require to be serialized while providing a non-blocking notification mechanism |
|
tuple
Package tuple defines keys used for connection tuples in multiple BPF maps.
|
Package tuple defines keys used for connection tuples in multiple BPF maps. |
|
versioncheck
Package versioncheck provides utility wrappers for go-version, allowing the constraints to be used as global variables.
|
Package versioncheck provides utility wrappers for go-version, allowing the constraints to be used as global variables. |
|
plugins
|
|
|
test
|
|
|
tools
|
|
Click to show internal directories.
Click to hide internal directories.