# Install Cilium eBPF

> [HTML Version](cilium-ebpf.html)

Cilium is a CNI plugin that provides efficient traffic routing for BRIX application services through integration with eBPF technology. Unlike traditional proxies, eBPF applies filtering, load balancing, and L7 policies directly in the Linux kernel without consuming resources to copy data between the kernel and the application.

This makes it possible to:

- Eliminate performance losses caused by context switching.

- Provide linear scalability as the load increases.

- Handle BRIX peak loads with minimal latency. 

Installing the plugin consists of the following steps:

1. [Download the Helm chart and configuration file](#download-chart).

2. [Fill in the configuration file](#config-file).

3. [Install the chart in a Kubernetes cluster using Helm](#install).

````
начало внимание

````
If you previously used another CNI plugin, completely remove it before installing Cilium, along with the **kube-proxy**, to avoid conflicts.

````
конец внимание

## ````
Step 1: Download the Helm chart and configuration file

To install over the Internet, obtain the `values-cilium.yaml `file, by running the following commands:

````
helm repo add brix365 https://charts.brix365.com  
helm repo update  
helm show values brix365/cilium > values-cilium.yaml

````
**Get the configuration file for installation in an isolated environment without Internet access**

1. On a computer with Internet access, download the archive of the latest version of the **cilium **chart:

````
helm repo add brix365 https://charts.brix365.com  
helm repo update  
helm pull brix365/cilium

2. ````
Copy the downloaded `cilium-X.Y.Z.tgz` chart archive to the server where the installation will be performed.

3. Extract the `cilium-X.Y.Z.tgz` chart and create a copy of the `values.yaml` configuration file named `values-cilium.yaml`:

````
tar -xf cilium-X.Y.Z.tgz  
cp cilium/values.yaml values-cilium.yaml
````

## ````
Step 2: Fill in the configuration file

Specify the Cilium installation settings in the `values-cilium.yaml `configuration file. 

**Important**: make sure that the `url: http://kube-system-kube-prometheus-prometheus.kube-system.svc` parameter specifies the path to your Prometheus service.

**Example of the values-cilium.yaml file**

````
\## Cilium settings  
cilium:  
\# Disable L2 service announcements (Advertisement)  
  l2announcements:  
    enabled: false  
  
\## Kubernetes API host (empty = auto-detection)  
  k8sServiceHost: ""  
  k8sServicePort: "6443"  
  
\## Enable Kubernetes Gateway API support  
  gatewayAPI:  
    enabled: false  
\## Use hostNetwork for Gateway (otherwise CNI); uncomment envoy.securityContext.capabilities  
    hostNetwork:  
      enabled: false  
  
\## Automatically generate TLS certificates for internal communication  
  certgen:  
    generateCA: true  
  
\## Hubble — network observability (eBPF)  
  hubble:  
    metrics:  
\## Metrics to collect  
      enabled: \[dns,drop,tcp,flow,icmp,http\]  
    relay:  
      enabled: false  
\## Enable Hubble UI  
    ui:  
      enabled: false  
      backend:  
        image:  
  
\## IP Address Management — IP address management  
  ipam:  
\## Mode: IP pool for the entire cluster  
    mode: "cluster-pool"  
    operator:  
      clusterPoolIPv4PodCIDRList: \["10.0.0.0/8"\]  
      clusterPoolIPv4MaskSize: 24  
      clusterPoolIPv6PodCIDRList: \["fd00::/104"\]  
      clusterPoolIPv6MaskSize: 120  
  
\## Enable IP ranges  
  ipv4:  
    enabled: true  
  ipv6:  
    enabled: false  
  
\## Full replacement of kube-proxy with eBPF (including kube-proxy)  
  kubeProxyReplacement: "true"  
\## Enable the L7 proxy (HTTP/gRPC through Envoy)  
  l7Proxy: true  
\## L7 proxy mode  
  loadBalancer:  
    l7:  
      backend: envoy  
\## Enable Envoy inside Cilium  
  envoy:  
    enabled: false  
\##  When hostNetwork.enabled=true, uncomment securityContext  
\#    securityContext:  
\#      capabilities:  
\#        keepCapNetBindService: true  
\#        envoy: \[NET\_BIND\_SERVICE,BPF,SYS\_ADMIN,NET\_ADMIN,NET\_RAW\]  
  
  
\## Cilium Operator — cluster management  
  operator:  
    enabled: true
````

````
**Configure connection parameters for a private registry when installing in an isolated environment without Internet access**

  
To connect to a private registry:

1. Download the BRIX images and upload them to a local image registry. For more information, see [Download BRIX images](downloadin-images-elma365.md).

2. In the `values-cilium.yaml`:

	- In the `image.repository`, specify the path to the private registry in the `registry.example.com` format.

	- In the `imagePullSecrets`, specify the name of the secret that provides access to the private registry. Create the secret manually and encode it in Base64.

````
cilium:  
\## Private registry connection parameters  
  image:  
    repository: "registry.example.com/docker/addons/cilium/cilium"  
    tag: "v1.19.3"  
    useDigest: false  
\## The secret that provides access to the private registry must be created manually and encoded in Base64  
  imagePullSecrets: \[\]  
\## Nodes on which to run Cilium  
  nodeSelector:  
    kubernetes.io/os: linux  
  tolerations:  
    - operator: Exists  
  
  
  certgen:  
    image:  
\## Private registry connection parameters  
      repository: "registry.example.com/docker/addons/cilium/certgen"  
      tag: "v0.4.1"  
      useDigest: false  
\## Nodes on which to run Cilium  
    nodeSelector: \{\}  
    tolerations: \[\]  
  
  hubble:  
    ui:  
      backend:  
        image:  
\## Private registry connection parameters  
          repository: "registry.example.com/docker/addons/cilium/hubble-ui-backend"  
          tag: "v0.13.3"  
          useDigest: false  
      frontend:  
        image:  
\## Private registry connection parameters  
          repository: "registry.example.com/docker/addons/cilium/hubble-ui"  
          tag: "v0.13.3"  
          useDigest: false  
\## Nodes on which to run Cilium  
      nodeSelector:  
        kubernetes.io/os: linux  
      tolerations: \[\]  
  
  operator:  
    image:  
\## Private registry connection parameters  
      repository: "registry.example.com/docker/addons/cilium/operator"  
      tag: "v1.19.3"  
\## Nodes on which to run Cilium  
    nodeSelector:  
      kubernetes.io/os: linux  
    tolerations:  
      - key: "node-role.kubernetes.io/control-plane"  
        operator: Exists  
      - key: "node-role.kubernetes.io/master  
        operator: Exists  
      - key: "node.kubernetes.io/not-ready"  
        operator: Exists  
      - key: "node.cloudprovider.kubernetes.io/uninitialized"  
        operator: Exists
````

## ````
Step 3: Install the cilium chart in a Kubernetes cluster

Use Helm to install the **cilium** chart in the `kube-system`:

- To install over the Internet, run the following command:

````
helm upgrade --install -n kube-system cilium brix365/cilium -f values-cilium.yaml

- ````
To install in an isolated environment without Internet access, go to the directory containing the downloaded chart and run the following command:

````
helm upgrade --install cilium ./cilium -f values-cilium.yaml -n kube-system

## ````
Uninstall the Cilium chart from the Kubernetes cluster

To uninstall the **cilium** chart from the ** **`kube-system`, run the following command:

````
helm uninstall -n kube-system cilium 

## ````
Use Hubble to visualize clusters

Hubble is a network observability tool built into Cilium that provides a map of services in a Kubernetes cluster. Hubble uses Cilium eBPF programs to collect network flow data with minimal resource consumption.

The Hubble UI web interface is used to visualize and filter data flows. When apps are deployed, it automatically builds a diagram of relationships and dependencies between services at L3, L4, and L7.

You can use Hubble for:

- Troubleshooting network issues.

- Checking network policies.

- Analyzing service behavior.

- Diagnosing errors, for example, when processing requests.

To open the Hubble UI in a browser:

1. Set up port forwarding to the `hubble-ui` service using the following command:

````
kubectl port-forward -n kube-system svc/hubble-ui 8080:80 --address 0.0.0.0

2. ````
Open the web interface at **http://<node\_ip>:8080/**.