Welcome to Cilium’s documentation! The documenta�on is divided into the following sec�ons: Ge�ng Started Guides: Provides a simple tutorial for running a small Cilium setup on your laptop. Intended as code or documenta�on. Ge�ng Started Introduc�on to Cilium What is Cilium? Why Cilium? Func�onality Overview Ge�ng Started Guides Installa�on Security Tutorials Advanced Networking Opera�ons Is�o Other Requirements Configura�on Network Policy Endpoint CRD Kubernetes Compa�bility Troubleshoo�ng Is�o Ge�ng Started Using Is�o Docker Cilium with Docker & libnetwork Mesos Cilium with Mesos/Marathon Envoy Envoy Go

Running 0 75s echo-585798dd9d-tn9t4 1/1 Running 0 75s echo-585798dd9d-xmr4p 1/1 Running 0 75s probe-866bb6f696-9lhfw 1/1 Running 0 75s probe-866bb6f696-br4dr Running 0 75s echo-585798dd9d-tn9t4 1/1 Running 0 75s echo-585798dd9d-xmr4p 1/1 Running 0 75s probe-866bb6f696-9lhfw 1/1 Running 0 75s probe-866bb6f696-br4dr Running 0 75s echo-585798dd9d-tn9t4 1/1 Running 0 75s echo-585798dd9d-xmr4p 1/1 Running 0 75s probe-866bb6f696-9lhfw 1/1 Running 0 75s probe-866bb6f696-br4dr

echo-a-5995597649-f5d5g 1/1 Running 0 4m51s echo-b-54c9bb5f5c-p6lxf 1/1 Running 0 4m50s echo-b-host-67446447f7-chvsp connectivity provided by Cilium and NetworkPolicy applies to them: kubectl get pods --all-namespaces -o custom- columns=NAMESPACE:.metadata.namespace,NAME:.metadata.name,HOSTNETWORK:. spec.hostNetwork --no-headers=true echo-a-5995597649-f5d5g 1/1 Running 0 4m51s echo-b-54c9bb5f5c-p6lxf 1/1 Running 0 4m50s echo-b-host-67446447f7-chvsp

1/1 Running 0 66s pod-to-a-allowed-cnp-58b7f7fb8f-lkq7p 1/1 Running 0 66s pod-to-a-denied-cnp-6967cb6f7f-7h9fn hubble release: curl -LO "https://raw.githubusercontent.com/cilium/hubble/master/stable.txt" set /p HUBBLE_VERSION=o custom- columns=NAMESPACE:.metadata.namespace,NAME:.metadata.name,HOSTNETWORK:. spec.hostNetwork --no-headers=true

to prevent conflict behavior. kubectl -n kube-system patch daemonset aws-node --type='strategic' - p='{"spec":{"template":{"spec":{"nodeSelector":{"io.cilium/aws-node- enabled":"true"}}}}}' Install Cilium: connectivity provided by Cilium and NetworkPolicy applies to them: $ kubectl get pods --all-namespaces -o custom- columns=NAMESPACE:.metadata.namespace,NAME:.metadata.name,HOSTNETWORK:. spec.hostNetwork --no-headers=true 1/1 Running 0 66s pod-to-a-allowed-cnp-58b7f7fb8f-lkq7p 1/1 Running 0 66s pod-to-a-denied-cnp-6967cb6f7f-7h9fn

db65b4d-x74nz 1/1 Running 0 68s host-to-b-multi-node-headless-77c64bc7d8-kgf8p 1/1 Running 0 67s pod-to-a-allowed-cnp-87b5895c8-bfw4x 1/1 1/1 Running 0 68s pod-to-external-fqdn-allow-google-cnp-b7b6bcdcb-97p75 1/1 Running 0 68s Note If you deploy the connectivity check to a single node cluster connectivity provided by Cilium and NetworkPolicy applies to them: kubectl get pods --all-namespaces -o custom- columns=NAMESPACE:.metadata.namespace,NAME:.metadata.name,HOSTNETWORK:. spec.hostNetwork --no-headers=true

to prevent conflict behavior. kubectl -n kube-system patch daemonset aws-node --type='strategic' - p='{"spec":{"template":{"spec":{"nodeSelector":{"io.cilium/aws-node- enabled":"true"}}}}}' Install Cilium: connectivity provided by Cilium and NetworkPolicy applies to them: $ kubectl get pods --all-namespaces -o custom- columns=NAMESPACE:.metadata.namespace,NAME:.metadata.name,HOSTNETWORK:. spec.hostNetwork --no-headers=true 1/1 Running 0 66s pod-to-a-allowed-cnp-58b7f7fb8f-lkq7p 1/1 Running 0 66s pod-to-a-denied-cnp-6967cb6f7f-7h9fn

global dynamic noprefixroute eth0 valid_lft 2563sec preferred_lft 2563sec host $ nmap -sT -p 1-1000 192.168.122.221 … Not shown: 999 closed ports PORT STATE SERVICE 22/tcp open ssh Nmap echo_dispatch.bpf.o clang -I…/linux/usr/include -I…/linux/tools/lib -g -O2 -Wall -Wextra -target bpf -c -o echo_dispatch.bpf.o echo_dispatch.bpf.c # bpftool prog load echo_dispatch.bpf.o /sys/fs/bpf/echo_dispatch_prog 0x0007 = 7 0x004d = 77 0x0309 = 777 dump map contents Re-scan open ports on VM host $ nmap -sT -p 1-1024 192.168.122.221 Starting Nmap 7.80 ( https://nmap.org ) at 2020-10-24 21:56 CEST Nmap scan report

nux-next.git /source/linux cd linux mkdir build make O=$PWD/build ARCH=x86_64 x86_64_defconfig make O=$PWD/build ARCH=x86_64 menuconfig make O=$PWD/build ARCH=x86_64 -j16 Kernel image Remember to:

10.99.38.155/32 -p tcp -m comment --comment "default/nginx-59: has no endpoints" -m tcp --dport 80 -j REJECT --reject-with icmp-port-unreachable -A KUBE-SERVICES -d 10.96.61.252/32 -p tcp -m comment --comment 10.104.166.10/32 -p tcp -m comment --comment "default/nginx-67: has no endpoints" -m tcp --dport 80 -j REJECT --reject-with icmp-port-unreachable -A KUBE-SERVICES -d 10.98.85.41/32 -p tcp -m comment --comment 10.97.138.144/32 -p tcp -m comment --comment "default/nginx-17: has no endpoints" -m tcp --dport 80 -j REJECT --reject-with icmp-port-unreachable -A KUBE-SERVICES -d 10.106.49.80/32 -p tcp -m comment --comment