DOCSEARCHbyAlgolia
Submit Docs

Cilium on TKE

website·Indexed 33 days ago

https://imroc.cc/istio

Documentation for deploying and managing Cilium, an eBPF-based cloud-native networking solution, on TKE clusters. Covers installation, Native Routing (VPC-CNI) and Overlay modes, Egress Gateway, Gateway API, and Hubble observability. Includes performance benchmarks, connectivity testing, large-scale tuning, and troubleshooting guides for APIServer connectivity and CrashLoopBackoff issues.

Tokens
405.4K
Snippets
1.8K
Records
2.6K
Agent score
67%

What's inside Cilium

  1. Overview of the Linux kernel packet transmission flow

    The process of sending data from a user-space application through the Linux kernel follows a layered architecture. The high-level flow is: Application $\rightarrow$ System Call $\rightarrow$ Transport Layer $\rightarrow$ Network Layer $\rightarrow$ Data Link Layer $\rightarrow$ Network Device Subsystem $\rightarrow$ Network Device Driver $\rightarrow$ Network Hardware.

  3. Overview of cert-manager for Kubernetes

    cert-manager is an all-in-one certificate management tool for Kubernetes. It can automate the issuance and renewal of free certificates by using the ACME protocol with Let's Encrypt. It works by watching specific Custom Resource Definitions (CRDs) to trigger certificate actions.

  4. Overview of KEDA (Kubernetes-based Event-Driven Autoscaler)

    KEDA is an event-driven autoscaler for Kubernetes that extends the capabilities of the Horizontal Pod Autoscaler (HPA). While HPA primarily scales based on resource metrics (CPU/Memory), KEDA allows scaling based on external event sources such as message queue lengths, database statistics, QPS, and Cron schedules. A key feature of KEDA is its ability to scale workloads down to 0 replicas when idle and scale them back up when events are detected.

  5. Overview of Cilium transparent encryption methods

    Cilium supports three methods for encrypting inter-node Pod traffic. Note that encryption only applies to inter-node traffic of Cilium-managed pods; traffic between pods on the same node or traffic to destinations outside the cluster remains unencrypted. Encryption decisions rely on Cilium identities, meaning the first packets sent to a newly joined node or pod may be unencrypted until identities propagate.

    • WireGuard (Recommended): A UDP tunnel based on the in-kernel module with automated key management via the network.cilium.io/wg-pub-key annotation on the CiliumNode CRD.
    • IPsec: Based on the Linux XFRM/ESP framework. Requires manual key Secret creation and rotation. Only usable with Overlay plans.
    • ztunnel (Beta): L4 proxy for Istio ambient mode providing mTLS encryption.

  6. Overview of Topology Aware Service Routing

    Topology Aware Service Routing is a Kubernetes feature (introduced in v1.17) designed to reduce network latency and potential cross-zone traffic costs. Instead of the traditional equal-probability load balancing across all endpoints, this feature enables 'proximity routing' by filtering endpoints that reside in the same topology domain (e.g., the same node, rack, zone, or region) as the requesting node.

  7. Overview of KEDA (Kubernetes-based Event-Driven Autoscaler)

    KEDA is an event-driven autoscaler for Kubernetes that allows scaling workloads based on external events. Unlike the standard Horizontal Pod Autoscaler (HPA) which primarily relies on CPU and memory metrics, KEDA supports a wide variety of event sources including message queue lengths, database statistics, QPS, and Cron schedules. A key feature of KEDA is its ability to scale workloads down to 0 replicas when idle.

  8. Overview of Cilium Egress Gateway

    Cilium's Egress Gateway and CiliumEgressGatewayPolicy allow developers to control which external traffic uses specific egress IPs. It is supported on Native Routing (VPC-CNI), Overlay (VPC-CNI), and Overlay (GR) deployment plans.

    Known Issues:

    1. Policy Application Delay: There may be a short delay before an Egress policy takes effect after a new Pod starts.
    2. Incompatibilities: Not compatible with Cilium ClusterMesh and CiliumEndpointSlice features.

  9. Overview of Ollama and OpenWebUI

    Ollama is a tool for running large language models (LLMs) that manages model downloads and exposes an API. OpenWebUI is a web-based interactive interface that connects to Ollama's API to provide a chat experience.

  10. Overview of CLB Direct Access for Nginx Ingress

    CLB direct access allows traffic to flow from the Cloud Load Balancer (CLB) directly to Nginx Ingress pods without passing through NodePort. This improves performance and allows the Nginx Ingress to obtain the real source IP of the client.

    Direct access is enabled by default if:

    1. You are using a TKE Serverless cluster.
    2. All Nginx Ingress Pods are scheduled to super nodes.

  11. Overview of keda-tencentcloud-clb-scaler

    The keda-tencentcloud-clb-scaler is a KEDA External Scaler that allows TKE workloads to scale based on Tencent Cloud Load Balancer (CLB) monitoring metrics. This is particularly useful for long-connection scenarios (e.g., game rooms, online meetings) where scaling is based on connection counts, or HTTP services where scaling is based on QPS (Queries Per Second) or bandwidth.

  12. Overview of CLB Direct Access for Nginx Ingress

    CLB direct access allows traffic to flow from the Cloud Load Balancer directly to Nginx Ingress pods, bypassing the NodePort. This results in better performance and allows the Ingress to capture the real client source IP.

    Note: If you are using a TKE Serverless cluster or can ensure all Nginx Ingress Pods are scheduled to 'Super Nodes', direct access is enabled by default and no additional configuration is required.