登录
立即咨询

语言选择

谐云 谐云
在这里探索云原生
Cilium 流量治理功能与部署实践
2022年12月14日

一、Cilium 概述

Cilium是一个具备API感知的网络和安全的开源软件,用于透明保护使用Docker和Kubernetes等Linux容器管理平台部署的应用程序服务之间的网络连接。Cilium的基础是一种称为BPF的新Linux内核技术,该技术可在Linux自身内部动态插入强大的安全可见性和控制逻辑。

由于BPF在Linux内核中运行,因此可以应用和更新Cilium安全策略,而无需更改应用程序代码或容器配置。与传统的sidecar代理模式相比,不需要在应用容器边上单独部署一个流量代理的容器。可以基于Linux内核收集网络包信息,利用eBPF程序编写包过滤的规则,减少Linux内核网络栈开销。

二、组件及安装方式

包含cilium、hubble、etcd和eBPF四个部分。其中eBPF是Linux 高版本内核自带的特性,无需额外部署。从图中可以看出,以DaemonSet的方式在每一个k8s Node部署了一个Agent,并且与相应的控制面Cilium Operator交互(实例数至少一个)。Hubble提供了一些基础监控的功能,并提供了一个可视化的UI界面,可以基于namespace,协议类型,入流出流等进行一些过滤。在没有service请求的情况下,UI界面下无法展示。

Cilium各组件交互

Mesh 分支的安装:

[1] 系统要求

Linux Kernel>=4.9.17

clang+LLVM>=10.0

不部署calico和flannel,将cilium作为CNI.

[2] cilium install --version -service-mesh:v1.11.0-beta.1 --config enable-envoy-config=true --kube-proxy-replacement=probe --datapath-mode=vxlan

[3] cilium hubble enable --ui

三、官方 mesh demo 功能总结

  1. 作为CNI,提供了CiliumNetworkPolicy。

  2.  CiliumEnvoyConfig 可以定义负载均衡策略,重写访问路径。

  3.  kafka topic的读写也可以通过CiliumNetWorkPolicy定义。

  4. ingress与cilium融合需要k8s1.19+,external-ip需要云厂商提供LB能力,否则会一直pending。支持以 RESTFUL API方式从集群外访问 Service。

  5. 支持以 4 层的方式访问 Service,例如通过 IP+Port。包括 externalIPs Service、LoadBalancer Service。

https://github.com/cilium/cilium-service-mesh-beta

CiliumEnvoyConfig路径重写演示

CiliumNetWorkPolicy拒绝策略演示

正常情况:

[root@master demo]# kubectl exec tiefighter -- curl -s -XPOST deathstar.default.svc.cluster.local/v1/request-landing

Ship landed

应用拒绝策略后:

四、融合istio部署实践

图中的reviews各个版本之间的负载均衡是通过Virtualservice和Destinationrule实现。通过cilium安装istio需要部署融合版的istio,一般只有特定的namespace下的流量会被istio接管,从而可以复用istio已有的CRD及功能。

兼容istio后可以使用的CRD

05

展望

 

  1. CiliumEnvoyConfig 支持的envoy配置有待扩展

  2. 多租户场景:支持NodePort的单节点暴露,即多租户隔离。

  3. 替代istio 控制面的选择有待确定:Istio , SMI.当前方案直接安装istiod

  4. 单个pod多网卡的支持,以及和其他网络插件的兼容

  5. 基于CiliumEnvoyConfig开发一系列更加用户友好的CRD,便于配置

添加评论
谐云
2024年10月11日
I'm really impressed with your writing skills and also with the layout on your blog. Is this a paid theme or did you customize it yourself? Either way keep up the nice quality writing, it抯 rare to see a nice blog like this one these days..
添加回复
谐云
2024年10月11日
添加回复
回复:Hi, i think that i saw you visited my site thus i came to “return the favor”.I'm trying to find things to enhance my site!I suppose its ok to use some of your ideas!!
添加回复
回复:This information is invaluable. Where can I find out more?
添加回复
回复:Wonderful blog! Do you have any suggestions for aspiring writers? I'm hoping to start my own website soon but I'm a little lost on everything. Would you suggest starting with a free platform like Wordpress or go for a paid option? There are so many choices out there that I'm completely confused .. Any ideas? Many thanks!
添加回复
回复:Thanks on your marvelous posting! I quite enjoyed reading it, you are a great author. I will always bookmark your blog and will come back very soon. I want to encourage you to definitely continue your great posts, have a nice weekend!
添加回复
回复:I'm impressed, I have to admit. Rarely do I encounter a blog that's both educative and entertaining, and let me tell you, you have hit the nail on the head. The issue is an issue that too few folks are speaking intelligently about. Now i'm very happy that I came across this in my hunt for something relating to this.
添加回复
回复:Having read this I believed it was very enlightening. I appreciate you taking the time and energy to put this article together. I once again find myself spending a significant amount of time both reading and posting comments. But so what, it was still worthwhile!
添加回复
回复:Write more, thats all I have to say. Literally, it seems as though you relied on the video to make your point. You definitely know what youre talking about, why throw away your intelligence on just posting videos to your blog when you could be giving us something informative to read?
添加回复
回复:Every weekend i used to pay a quick visit this site, because i want enjoyment, for the reason that this this web page conations really good funny information too.
添加回复
回复:Terrific article! This is the kind of info that are meant to be shared across the web. Shame on Google for now not positioning this publish higher! Come on over and talk over with my website . Thanks =)
添加回复
回复:This website was... how do I say it? Relevant!! Finally I have found something which helped me. Kudos!
添加回复
回复:Its not my first time to visit this website, i am visiting this site dailly and take nice data from here everyday.
添加回复
回复:Hi there every one, here every person is sharing such know-how, so it's good to read this website, and I used to pay a visit this website everyday.
添加回复
回复:fantastic points altogether, you simply received a brand new reader. What may you recommend about your put up that you simply made some days ago? Any positive?
添加回复
回复:I am really loving the theme/design of your site. Do you ever run into any internet browser compatibility issues? A handful of my blog readers have complained about my website not working correctly in Explorer but looks great in Opera. Do you have any suggestions to help fix this problem?
添加回复
回复:If you wish for to get a great deal from this post then you have to apply these methods to your won website.
添加回复
回复:Hi there! This is my 1st comment here so I just wanted to give a quick shout out and tell you I genuinely enjoy reading your articles. Can you suggest any other blogs/websites/forums that go over the same topics? Thanks a ton!
添加回复
回复:Your style is really unique in comparison to other people I have read stuff from. Many thanks for posting when you've got the opportunity, Guess I'll just bookmark this site.
添加回复
回复:I read this piece of writing fully regarding the difference of most up-to-date and preceding technologies, it's amazing article.
添加回复
回复:Hey I know this is off topic but I was wondering if you knew of any widgets I could add to my blog that automatically tweet my newest twitter updates. I've been looking for a plug-in like this for quite some time and was hoping maybe you would have some experience with something like this. Please let me know if you run into anything. I truly enjoy reading your blog and I look forward to your new updates.
添加回复
回复:Good day I am so thrilled I found your blog, I really found you by mistake, while I was searching on Bing for something else, Anyways I am here now and would just like to say thanks a lot for a fantastic post and a all round interesting blog (I also love the theme/design), I don’t have time to go through it all at the minute but I have bookmarked it and also added in your RSS feeds, so when I have time I will be back to read more, Please do keep up the awesome work.
添加回复
回复:You could certainly see your skills in the work you write. The world hopes for more passionate writers like you who aren't afraid to say how they believe. All the time follow your heart.
添加回复
回复:Hi there! Someone in my Myspace group shared this website with us so I came to take a look. I'm definitely loving the information. I'm bookmarking and will be tweeting this to my followers! Exceptional blog and great design.
添加回复
回复:My brother suggested I might like this blog. He was totally right. This post truly made my day. You can not imagine just how much time I had spent for this information! Thanks!
添加回复
谐云
2024年10月11日
添加回复
谐云 CpjJwWHV
2024年10月11日
555
添加回复
gBqsPxAZ回复CpjJwWHV:555
添加回复
gBqsPxAZ回复CpjJwWHV:555
添加回复
gBqsPxAZ回复CpjJwWHV:555
添加回复
gBqsPxAZ回复CpjJwWHV:555
添加回复
回复CpjJwWHV:
添加回复
回复CpjJwWHV:
添加回复
谐云 CpjJwWHV
2024年10月11日
555
添加回复
gBqsPxAZ回复CpjJwWHV:555
添加回复
gBqsPxAZ回复CpjJwWHV:555
添加回复
gBqsPxAZ回复CpjJwWHV:555
添加回复
gBqsPxAZ回复CpjJwWHV:555
添加回复
回复CpjJwWHV:
添加回复
回复CpjJwWHV:
添加回复
回复CpjJwWHV:
添加回复
回复CpjJwWHV:
添加回复
回复CpjJwWHV:
添加回复
申请合作咨询
您可以通过此表单填写您的合作意向,我们将会尽快与您取得联系!
或拨打电话0571-87607309
*姓名:
*手机:
*邮箱:
备注:
备注:
登录
登录
注册账号 忘记密码
注册
{{ code.btn }}
注册
立即登录 忘记密码?
忘记密码
{{ code.btn }}
确定
立即登录 忘记密码?
立即咨询