Open source cloud computing software From Wikipedia, the free encyclopedia
Cilium is a cloud native technology for networking, observability, and security.[1] It is based on the kernel technology eBPF, originally for better networking performance, and now leverages many additional features for different use cases. The core networking component has evolved from only providing a flat Layer 3 network for containers to including advanced networking features, like BGP and Service mesh, within a Kubernetes cluster, across multiple clusters, and connecting with the world outside Kubernetes.[1] Hubble was created as the network observability component and Tetragon was later added for security observability and runtime enforcement.[1] Cilium runs on Linux and is one of the first eBPF applications being ported to Microsoft Windows through the eBPF on Windows project.[7]
| |
 Command line session showing the status of a Cilium installation in a Kind cluster | |
| Original author(s) | Thomas Graf, Daniel Borkmann, André Martins, Madhusudan Challa[1] |
|---|---|
| Developer(s) | Open source community, Isovalent, Google, Datadog, Red Hat, Cloud Native Computing Foundation[2] |
| Initial release | December 16, 2015[1] |
| Stable release | |
| Repository | github |
| Written in | Go, eBPF, C, C++ |
| Operating system | Linux, Windows[4] |
| Platform | x86-64, ARM[5] |
| Available in | English |
| Type | Cloud-native Networking, Security, Observability |
| License | Apache License 2.0, Dual GPL-2.0-only or BSD-2-clause for eBPF[6] |
| Website | cilium.io |
Evolution from Networking CNI (Container Network Interface)
Cilium began as a networking CNI[8] for container workloads. It was originally IPv6 only and supported multiple container orchestrators, like Kubernetes. The original vision for Cilium was to build an intent and identity-based high-performance container networking platform.[9] As the cloud native ecosystem expanded, Cilium added new projects and features to address new problems in the space.
The table below summarises some of the most significant milestones of this evolution:
Cilium was accepted into the Cloud Native Computing Foundation on October 13th, 2021 as an incubation-level project. It applied to become a graduated project on October 27th 2022.[19] It became a Graduated project one year later. Cilium is one of the fastest-moving projects in the CNCF ecosystem.[30]
Cilium has been adopted by many large-scale production users, including over 100 that have stated it publicly,[31] for example:
Cilium is the CNI for many cloud providers including Alibaba,[45] APPUiO,[46] Azure,[47] AWS,[16] DigitalOcean,[48] Exoscale,[49] Google Cloud,[15] Hetzner,[50] and Tencent Cloud.[51]
Cilium began as a container networking project. With the growth of Kubernetes and container orchestration, Cilium became a CNI,[8] providing basic things like configuring container network interfaces and Pod to Pod connectivity. From the beginning, Cilium based its networking on eBPF rather than iptables or IPVS, betting that eBPF would become the future of cloud native networking.[52]
Cilium’s eBPF based dataplane provides a simple flat Layer 3 network with the ability to span multiple clusters in either a native routing or overlay mode with Cilium Cluster Mesh. It is Layer 7-protocol aware and can enforce network policies on Layer 3 to Layer 7 and with FQDN using an identity-based security model that is decoupled from network addressing.
Cilium implements distributed load balancing for traffic between Pods and to external services, and is able to fully replace kube-proxy,[53] using XDP, socket-based load-balancing and efficient hash tables in eBPF. It also supports advanced functionality like integrated ingress and egress gateways,[54] bandwidth management, a stand-alone load balancer, and service mesh.[55]
Cilium is the first CNI to support advanced kernel features such as BBR TCP congestion control[56] and BIG TCP[57] for Kubernetes Pods.[58]
Hubble is the observability, service map, and UI of Cilium which is shipped with the CNI.[59] [60] It can be used to observe individual network packet flows, view network policy decisions to allow or block traffic, and build up service maps showing how Kubernetes services are communicating.[61] Hubble can export this data to Prometheus, OpenTelemetry, Grafana, and Fluentd for further analysis of Layer 3/4 and Layer 7 metrics.[62]
Tetragon is the security observability and runtime enforcement project of Cilium.[63] Tetragon is a flexible Kubernetes-aware security observability and runtime enforcement tool that applies policy and filtering directly with eBPF. It allows users to monitor and observe the complete lifecycle of every process execution on their machine, translate policies for file monitoring, network observability, container security, and more into eBPF programs, and do synchronous monitoring, filtering, and enforcement completely in the kernel.
ebpf-go is a pure-Go library to interact with the eBPF subsystem in the Linux kernel.[64] It has minimal external dependencies, emphasises reliability and compatibility, and is widely deployed in production.
pwru ("Packet, where are you?") is an eBPF-based tool for tracing network packets in the Linux kernel with advanced filtering capabilities. It allows fine-grained introspection of kernel state to facilitate debugging network connectivity issues. Under the hood, pwru attaches eBPF debugging programs to all Linux kernel functions which are responsible for processing network packets.
This gives a user finer-grained view into a packet processing in the kernel than with tcpdump, Wireshark, or more traditional tools. Also, it can show packet metadata such as network namespace, processing timestamp, internal kernel packet representation fields, and more.
Cilium began as a networking project and has many features that allow it to provide a consistent connectivity experience from Kubernetes workloads to virtual machines and physical servers running in the cloud, on-premises, or at the edge. Some of these include:
Being in the kernel, eBPF has complete visibility of everything that is happening on a machine. Cilium leverages this with the following features:
eBPF can stop events in the kernel for security. Cilium projects leverage this through the following features:
The chart below visualises the period for which each Cilium community maintained release is/was supported:
Cilium's official website lists online forums, messaging platforms, and in-person meetups for the Cilium user and developer community.
Conferences dedicated to Cilium development in the past have included:
The Cilium community releases an annual report to cover how the community developed over the course of the year:
Seamless Wikipedia browsing. On steroids.