cilium

module
v0.10.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jul 21, 2017 License: Apache-2.0

README

Cilium Logo

Build Status Go Report Card GoDoc Read the Docs Apache licensed GPL licensed Join the Cilium slack channel

Cilium is open source software for providing and transparently securing network connectivity and loadbalancing between application containers and services deployed using Linux container management platforms like Docker and Kubernetes.

A new Linux kernel technology called eBPF is at the foundation of Cilium, which enables the dynamic insertion of BPF bytecode into the Linux kernel. Cilium generates eBPF programs for each individual application container to provide networking, security, loadbalancing and visibility.

Features Overview

  • Security Policies: Enforcement of security policies at application (L7) and networking (L3-L4) layer. Application level policies include filtering of HTTP protocol properties such as method, path, host, and headers. Networking policies include container/pod/service interconnectivity rules based on labels, restriction of traffic to certain CIDR and/or port ranges for both ingress and egress.
  • Networking: A simple flat Layer 3 network with the ability to span multiple clusters connects all application containers and services. Simple IP allocation using host scope allocators (dedicated /24 per cluster node for IPv4, dedicated /112 per cluster node for IPv6). Choice of either integrating with Linux routing to run a routing daemon or to create an overlay network using encapsulation (VXLAN/Geneve).
  • Load balancing: Distributed load balancing for east-west traffic from application container to application container, e.g. implementation of Kubernetes services. North-south traffic to load balance external traffic, e.g. implementation of Kubernetes ingress. All load-balancing performed with direct server return (DSR) by default for improved performance.
  • Troubleshooting: Built-in troubleshooting tools providing an alternative to traditional tcpdump troubleshooting techniques.
  • Integrations:

Getting Started

What is eBPF and XDP?

Berkeley Packet Filter (BPF) is a Linux kernel bytecode interpreter originally introduced to filter network packets, e.g. for tcpdump and socket filters. The BPF instruction set and surrounding architecture has recently been significantly reworked with additional data structures such as hash tables and arrays for keeping state as well as additional actions to support packet mangling, forwarding, encapsulation, etc. Furthermore, a compiler back end for LLVM allows for programs to be written in C and compiled into BPF instructions. An in-kernel verifier ensures that BPF programs are safe to run and a JIT compiler converts the BPF bytecode to CPU architecture specific instructions for native execution efficiency. BPF programs can be run at various hooking points in the kernel such as for incoming packets, outgoing packets, system calls, kprobes, uprobes, tracepoints, etc.

BPF continues to evolve and gain additional capabilities with each new Linux release. Cilium leverages BPF to perform core data path filtering, mangling, monitoring and redirection, and requires BPF capabilities that are in any Linux kernel version 4.8.0 or newer (the latest current stable Linux kernel is 4.10.x).

Many Linux distributions including CoreOS, Debian, Docker's LinuxKit, Fedora, and Ubuntu already ship kernel versions >= 4.8.x. You can check your Linux kernel version by running uname -a. If you are not yet running a recent enough kernel, check the Documentation of your Linux distribution on how to run Linux kernel 4.9.x or later.

For more detail on kernel versions, see: Prerequisites

XDP is a further step in evolution and enables to run a specific flavor of BPF programs from the network driver with direct access to the packet's DMA buffer. This is, by definition, the earliest possible point in the software stack, where programs can be attached to in order to allow for a programmable, high performance packet processor in the Linux kernel networking data path.

Further information about BPF and XDP targeted for developers can be found in the BPF and XDP reference guide.

Installation

See the Installation instructions

Presentations

Podcasts

  • Software Gone Wild by Ivan Pepelnjak, Oct 2016: Blog, MP3
  • OVS Orbit by Ben Pfaff, May 2016: Blog, MP3

Community blog posts

  • Cilium for Network and Application Security with BPF and XDP, Apr 2017: Blog
  • Cilium, BPF and XDP, Google Open Source Blog, Nov 2016: Blog

Weekly Hangout

  • The developer community is hanging out on zoom on a weekly basis to chat. Everybody is welcome.
  • Weekly, Monday, 9:00 am PT, 12:00 pm (noon) ET, 6:00 pm CEST
  • Join zoom

Contact

If you have any questions feel free to contact us on Slack

License

The cilium user space components are licensed under the Apache License, Version 2.0. The BPF code templates are licensed under the General Public License, Version 2.0.

Directories

Path Synopsis
api
v1/server
Package server Cilium API Cilium Schemes: unix Host: localhost BasePath: /v1beta Version: v1beta Consumes: - application/json Produces: - application/json swagger:meta
Package server Cilium API Cilium Schemes: unix Host: localhost BasePath: /v1beta Version: v1beta Consumes: - application/json Produces: - application/json swagger:meta
cmd
pkg
apierror
Package API Error representation
Package API Error representation
bpf
byteorder
Package byteorder provides functions to convert from and to network byte order.
Package byteorder provides functions to convert from and to network byte order.
endpointmanager
Package endpointmanager manages the list of all local endpoints
Package endpointmanager manages the list of all local endpoints
events
Package events is used to trigger events across the daemon.
Package events is used to trigger events across the daemon.
k8s
Package k8s abstracts all Kubernetes specific behaviour
Package k8s abstracts all Kubernetes specific behaviour
mac
maps/lxcmap
Package lxcmap represents the endpoints BPF map in the BPF programs.
Package lxcmap represents the endpoints BPF map in the BPF programs.
nodeaddress
Package nodeaddress provides functionality relate to the node's address where a cilium agent is running on
Package nodeaddress provides functionality relate to the node's address where a cilium agent is running on
plugins

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL