Install Cilium eBPF

Cilium is a CNI plugin that provides efficient traffic routing for BRIX application services through integration with eBPF technology. Unlike traditional proxies, eBPF applies filtering, load balancing, and L7 policies directly in the Linux kernel without consuming resources to copy data between the kernel and the application.

This makes it possible to:

Eliminate performance losses caused by context switching.
Provide linear scalability as the load increases.
Handle BRIX peak loads with minimal latency.

Installing the plugin consists of the following steps:

начало внимание

If you previously used another CNI plugin, completely remove it before installing Cilium, along with the kube-proxy, to avoid conflicts.

конец внимание

Step 1: Download the Helm chart and configuration file

To install over the Internet, obtain the values-cilium.yaml file, by running the following commands:

helm repo add brix365 https://charts.brix365.com
helm repo update
helm show values brix365/cilium > values-cilium.yaml

Get the configuration file for installation in an isolated environment without Internet access

Step 2: Fill in the configuration file

Specify the Cilium installation settings in the values-cilium.yaml configuration file.

Important: make sure that the url: http://kube-system-kube-prometheus-prometheus.kube-system.svc parameter specifies the path to your Prometheus service.

Example of the values-cilium.yaml file

Configure connection parameters for a private registry when installing in an isolated environment without Internet access

To connect to a private registry:

Download the BRIX images and upload them to a local image registry. For more information, see Download BRIX images.
In the values-cilium.yaml:
- In the image.repository, specify the path to the private registry in the registry.example.com format.
- In the imagePullSecrets, specify the name of the secret that provides access to the private registry. Create the secret manually and encode it in Base64.

cilium:
## Private registry connection parameters
  image:
    repository: "registry.example.com/docker/addons/cilium/cilium"
    tag: "v1.19.3"
    useDigest: false
## The secret that provides access to the private registry must be created manually and encoded in Base64
  imagePullSecrets: []
## Nodes on which to run Cilium
  nodeSelector:
    kubernetes.io/os: linux
  tolerations:
    - operator: Exists

  certgen:
    image:
## Private registry connection parameters
      repository: "registry.example.com/docker/addons/cilium/certgen"
      tag: "v0.4.1"
      useDigest: false
## Nodes on which to run Cilium
    nodeSelector: {}
    tolerations: []

  hubble:
    ui:
      backend:
        image:
## Private registry connection parameters
          repository: "registry.example.com/docker/addons/cilium/hubble-ui-backend"
          tag: "v0.13.3"
          useDigest: false
      frontend:
        image:
## Private registry connection parameters
          repository: "registry.example.com/docker/addons/cilium/hubble-ui"
          tag: "v0.13.3"
          useDigest: false
## Nodes on which to run Cilium
      nodeSelector:
        kubernetes.io/os: linux
      tolerations: []

  operator:
    image:
## Private registry connection parameters
      repository: "registry.example.com/docker/addons/cilium/operator"
      tag: "v1.19.3"
## Nodes on which to run Cilium
    nodeSelector:
      kubernetes.io/os: linux
    tolerations:
      - key: "node-role.kubernetes.io/control-plane"
        operator: Exists
      - key: "node-role.kubernetes.io/master
        operator: Exists
      - key: "node.kubernetes.io/not-ready"
        operator: Exists
      - key: "node.cloudprovider.kubernetes.io/uninitialized"
        operator: Exists

Step 3: Install the cilium chart in a Kubernetes cluster

Use Helm to install the cilium chart in the kube-system:

To install over the Internet, run the following command:

helm upgrade --install -n kube-system cilium brix365/cilium -f values-cilium.yaml

To install in an isolated environment without Internet access, go to the directory containing the downloaded chart and run the following command:

helm upgrade --install cilium ./cilium -f values-cilium.yaml -n kube-system

Uninstall the Cilium chart from the Kubernetes cluster

To uninstall the cilium chart from the kube-system, run the following command:

helm uninstall -n kube-system cilium

Use Hubble to visualize clusters

Hubble is a network observability tool built into Cilium that provides a map of services in a Kubernetes cluster. Hubble uses Cilium eBPF programs to collect network flow data with minimal resource consumption.

The Hubble UI web interface is used to visualize and filter data flows. When apps are deployed, it automatically builds a diagram of relationships and dependencies between services at L3, L4, and L7.

You can use Hubble for:

Troubleshooting network issues.
Checking network policies.
Analyzing service behavior.
Diagnosing errors, for example, when processing requests.

To open the Hubble UI in a browser:

Set up port forwarding to the hubble-ui service using the following command:

kubectl port-forward -n kube-system svc/hubble-ui 8080:80 --address 0.0.0.0

Open the web interface at http://<node_ip>:8080/.

install-istio.html cilium-gateway.html