### Verify Development Setup Source: https://docs.cilium.io/en/stable/contributing/development/dev_setup Run this command to quickly verify many elements of your development setup, assuming Go is installed. ```bash $ make dev-doctor ``` -------------------------------- ### Deploy Example Service - Cluster 1 Source: https://docs.cilium.io/en/stable/network/clustermesh/services Deploys necessary configurations for cluster 1, including the cluster mesh setup and a global service example. ```bash kubectl apply -f https://raw.githubusercontent.com/cilium/cilium/1.19.5/examples/kubernetes/clustermesh/cluster1.yaml kubectl apply -f https://raw.githubusercontent.com/cilium/cilium/1.19.5/examples/kubernetes/clustermesh/global-service-example.yaml ``` -------------------------------- ### Install and Start Nginx Source: https://docs.cilium.io/en/stable/network/egress-gateway/egress-gateway Installs and starts the Nginx web server on a Linux node. This is used as an external service to test egress traffic. ```bash $ sudo apt install nginx $ sudo systemctl start nginx ``` -------------------------------- ### Deploy Example Service - Cluster 2 Source: https://docs.cilium.io/en/stable/network/clustermesh/services Deploys necessary configurations for cluster 2, including the cluster mesh setup and a global service example. This should be run after cluster 1 is configured. ```bash kubectl apply -f https://raw.githubusercontent.com/cilium/cilium/1.19.5/examples/kubernetes/clustermesh/cluster2.yaml kubectl apply -f https://raw.githubusercontent.com/cilium/cilium/1.19.5/examples/kubernetes/clustermesh/global-service-example.yaml ``` -------------------------------- ### Install Kind for Kubernetes Cluster Setup Source: https://docs.cilium.io/en/stable/contributing/development/dev_setup Use this command to install Kind, a tool for running local Kubernetes clusters, essential for Kind-based setups. ```bash go install sigs.k8s.io/kind@v0.19.0 ``` -------------------------------- ### BPF Integration Test Example Source: https://docs.cilium.io/en/stable/contributing/testing/bpf This example demonstrates the structure of an integration test for BPF programs using PKTGEN, SETUP, and CHECK. It includes map definitions, packet generation, setup logic with tail calls, and result verification. ```c #include "common.h" #include "bpf/ctx/xdp.h" #include "bpf_xdp.c" struct { __uint(type, BPF_MAP_TYPE_PROG_ARRAY); __uint(key_size, sizeof(__u32)); __uint(max_entries, 2); __array(values, int()); } entry_call_map __section(".maps") = { .values = { [0] = &cil_xdp_entry, }, }; PKTGEN("xdp", "l2_example") int test1_pktgen(struct __ctx_buff *ctx) { /* Create room for our packet to be crafted */ unsigned int data_len = ctx->data_end - ctx->data; int offset = offset = sizeof(struct ethhdr) - data_len; bpf_xdp_adjust_tail(ctx, offset); void *data = (void *)(long)ctx->data; void *data_end = (void *)(long)ctx->data_end; if (data + sizeof(struct ethhdr) > data_end) return TEST_ERROR; /* Writing just the L2 header for brevity */ struct ethhdr l2 = { .h_source = {0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF}, .h_dest = {0x12, 0x23, 0x34, 0x45, 0x56, 0x67}, .h_proto = bpf_htons(ETH_P_IP) }; memcpy(data, &l2, sizeof(struct ethhdr)); return 0; } SETUP("xdp", "l2_example") int test1_setup(struct __ctx_buff *ctx) { /* OMITTED setting up map state */ /* Jump into the entrypoint */ tail_call_static(ctx, entry_call_map, 0); /* Fail if we didn't jump */ return TEST_ERROR; } CHECK("xdp", "l2_example") int test1_check(__maybe_unused const struct __ctx_buff *ctx) { test_init(); void *data = (void *)(long)ctx->data; void *data_end = (void *)(long)ctx->data_end; if (data + sizeof(__u32) > data_end) test_fatal("status code out of bounds"); __u32 *status_code = data; if (*status_code != XDP_TX) test_fatal("status code != XDP_TX"); data += sizeof(__u32); if (data + sizeof(struct ethhdr) > data_end) test_fatal("ctx doesn't fit ethhdr"); struct ethhdr *l2 = data; data += sizeof(struct ethhdr); if (memcmp(l2->h_source, fib_smac, sizeof(fib_smac))) test_fatal("l2->h_source != fib_smac"); if (memcmp(l2->h_dest, fib_dmac, sizeof(fib_dmac))) test_fatal("l2->h_dest != fib_dmac"); if (data + sizeof(struct iphdr) > data_end) test_fatal("ctx doesn't fit iphdr"); test_finish(); } ``` -------------------------------- ### Run StateDB Kubernetes Reflection Example Source: https://docs.cilium.io/en/stable/contributing/development/statedb Execute this command to start the StateDB example and watch pods in your cluster. Ensure you are in the `contrib/examples/statedb_k8s` directory and provide the path to your kubeconfig file. ```bash cd contrib/examples/statedb_k8s && go run . --k8s-kubeconfig-path ~/.kube/config ``` ```text level=info msg=Starting time="2024-09-05T11:22:15+02:00" level=info msg="Establishing connection to apiserver" host="https://127.0.0.1:44261" subsys=k8s-client time="2024-09-05T11:22:15+02:00" level=info msg="Connected to apiserver" subsys=k8s-client level=info msg=Started duration=9.675917ms Pod(default/nginx): Running (revision: 1, deleted: false) Pod(kube-system/cilium-envoy-8xwp7): Running (revision: 2, deleted: false) ... ``` -------------------------------- ### Example: Recursive kvstore get Source: https://docs.cilium.io/en/stable/cmdref/cilium-dbg_kvstore_get Demonstrates how to recursively retrieve all keys under a given prefix. ```bash cilium kvstore get --recursive foo ``` -------------------------------- ### Run StateDB Example Application Source: https://docs.cilium.io/en/stable/contributing/development/statedb This command shows how to navigate to the example directory and execute the StateDB example application using Go. ```bash $ cd contrib/examples/statedb && go run . ``` -------------------------------- ### Cilium Installation Restarted Unmanaged Pods Example Source: https://docs.cilium.io/en/stable/gettingstarted/k8s-install-default Example output from `cilium install` indicating that unmanaged pods in the cluster were automatically restarted to ensure they receive networking provided by Cilium. ```text ♻️ Restarted unmanaged pod kube-system/event-exporter-gke-564fb97f9-rv8hg ♻️ Restarted unmanaged pod kube-system/kube-dns-6465f78586-hlcrz ♻️ Restarted unmanaged pod kube-system/kube-dns-autoscaler-7f89fb6b79-fsmsg ♻️ Restarted unmanaged pod kube-system/l7-default-backend-7fd66b8b88-qqhh5 ♻️ Restarted unmanaged pod kube-system/metrics-server-v0.3.6-7b5cdbcbb8-kjl65 ♻️ Restarted unmanaged pod kube-system/stackdriver-metadata-agent-cluster-level-6cc964cddf-8n2rt ``` -------------------------------- ### Install Kubeadm and Dependencies Source: https://docs.cilium.io/en/stable/operations/performance/benchmark Install kubeadm and its necessary dependencies on the nodes using an Ansible playbook. This prepares the nodes for Kubernetes cluster setup. ```bash $ ansible-playbook -i packet-hosts.ini playbooks/install-kubeadm.yaml ``` -------------------------------- ### Install qemu-utils Source: https://docs.cilium.io/en/stable/contributing/development/bpf_tests Installs the necessary qemu-utils package on Debian/Ubuntu systems. ```bash $ sudo apt-get install qemu-utils ``` -------------------------------- ### Kind Cluster and CNI Setup Commands Source: https://docs.cilium.io/en/stable/installation/k8s-install-migration Commands to create a Kind cluster with a custom configuration, install reference CNI plugins, and deploy Flannel as the initial CNI. ```bash $ kind create cluster --config=kind-config.yaml $ kubectl apply -n kube-system --server-side -f https://raw.githubusercontent.com/cilium/cilium/1.19.5/examples/misc/migration/install-reference-cni-plugins.yaml $ kubectl apply --server-side -f https://github.com/flannel-io/flannel/releases/latest/download/kube-flannel.yml $ kubectl wait --for=condition=Ready nodes --all ``` -------------------------------- ### Deploy Example Service in Cluster 1 Source: https://docs.cilium.io/en/stable/network/clustermesh/mcsapi Applies the necessary Kubernetes manifests to cluster 1 for the MCS-API example. This includes cluster-specific configurations and the example service. ```bash kubectl apply -f https://raw.githubusercontent.com/cilium/cilium/1.19.5/examples/kubernetes/clustermesh/cluster1.yaml kubectl apply -f https://raw.githubusercontent.com/cilium/cilium/1.19.5/examples/kubernetes/clustermesh/mcsapi-example.yaml ``` -------------------------------- ### Deploy Example Service in Cluster 2 Source: https://docs.cilium.io/en/stable/network/clustermesh/mcsapi Applies the necessary Kubernetes manifests to cluster 2 for the MCS-API example. This includes cluster-specific configurations and the example service. ```bash kubectl apply -f https://raw.githubusercontent.com/cilium/cilium/1.19.5/examples/kubernetes/clustermesh/cluster2.yaml kubectl apply -f https://raw.githubusercontent.com/cilium/cilium/1.19.5/examples/kubernetes/clustermesh/mcsapi-example.yaml ``` -------------------------------- ### Example: View ipcache Events Source: https://docs.cilium.io/en/stable/cmdref/cilium-dbg_map_events This example shows how to view events related to the `cilium_ipcache` BPF map. ```bash cilium map events cilium_ipcache ``` -------------------------------- ### Install Ginkgo for Testing Source: https://docs.cilium.io/en/stable/contributing/development/dev_setup Use this command to install the Ginkgo testing framework, required for certain development tasks. ```bash go install github.com/onsi/ginkgo/ginkgo@v1.16.5 ``` -------------------------------- ### Start Local KV Stores Source: https://docs.cilium.io/en/stable/contributing/testing/unit Run this command to start local etcd instances required for some tests. ```bash $ make start-kvstores ``` -------------------------------- ### Define Example Module and Commands with Hive Source: https://docs.cilium.io/en/stable/contributing/development/hive Defines an example module for Hive, providing an `Example` object and script commands to interact with it. Use this to create custom commands for testing and agent inspection. ```go package script import ( "fmt" "log/slog" "sync/atomic" "github.com/cilium/hive" "github.com/cilium/hive/cell" "github.com/cilium/hive/script" "github.com/spf13/pflag" ) // Cell defines our example module that provides the [Example] object // and script commands to interact with it. var Cell = cell.Module( "example", "Example module", cell.Provide( New, ExampleCommands, ), ) type Example struct { log *slog.Logger count atomic.Int32 } func New(log *slog.Logger) *Example { return &Example{log: log} } func (e *Example) SayHello(name, greeting string) string { e.log.Info("SayHello() called", "name", name, "greeting", greeting) e.count.Add(1) return fmt.Sprintf("%s %s\n", greeting, name) } func ExampleCommands(e *Example) hive.ScriptCmdsOut { return hive.NewScriptCmds(map[string]script.Cmd{ // example/hello command says a greeting to the stdout buffer. "example/hello": script.Command( script.CmdUsage{ Summary: "Say hello", Args: "name", Flags: func(fs *pflag.FlagSet) { fs.String("greeting", "Hello,", "Greeting to use") }, }, // Define the function for executing the command. The function takes // [script.State] that provides logging, flags and utilities, and the // command arguments that are left over from parsing [CmdUsage.Flags]. // // The function can either directly execute the command and return a // nil [script.WaitFunc] or if the command should run in the background // ([script.CmdUsage.Async] is true) or the if the command needs to write // to stdout/stderr buffers, then a [script.WaitFunc] should be returned. // // It is preferable to return output in stdout and not Logf'd so it // can be matched against. In "cilium-dbg shell" the output looks the // same regardless of whether Logf() or stdout is used (the "[stdout]" // banner is stripped). func(s *script.State, args ...string) (script.WaitFunc, error) { if len(args) != 1 { return nil, fmt.Errorf("%w: expected name", script.ErrUsage) } name := args[0] return func(s *script.State) (stdout, stderr string, err error) { greeting, err := s.Flags.GetString("greeting") if err != nil { return "", "", err } // In addition to [stdout] and [stderr] the command can also write to // a separate log buffer. The logs however are not matchable in tests. s.Logf("calling SayHello(%s, %s)\n", name, greeting) stdout = e.SayHello(name, greeting) return }, nil }, ), // example/counts command writes the number of times SayHello() has been called to // stdout. "example/counts": script.Command( script.CmdUsage{ Summary: "Show the call counts of the example module", }, func(s *script.State, args ...string) (script.WaitFunc, error) { return func(s *script.State) (stdout, stderr string, err error) { stdout = fmt.Sprintf("%d SayHello()\n", e.count.Load()) return }, nil }, ), }) } ``` -------------------------------- ### Enable XDP Acceleration Source: https://docs.cilium.io/en/stable/operations/performance/tuning To enable XDP Acceleration, follow the getting started guide. Validate the installation by checking 'cilium status' for 'XDP Acceleration: Native'. ```bash cilium status ``` -------------------------------- ### Provision VM with Qemu Source: https://docs.cilium.io/en/stable/contributing/testing/e2e_legacy Starts a Qemu virtual machine using the prepared image. This command configures networking, shared filesystem, and serial console for interaction. ```bash $ qemu-system-x86_64 \ -nodefaults \ -no-reboot \ -smp 4 \ -m 12G \ -enable-kvm \ -cpu host \ -drive file=/tmp/_images/datapath-conformance.qcow2,if=virtio,index=0,media=disk \ -netdev user,id=user.0,hostfwd=tcp::2222-:22 \ -device virtio-net-pci,netdev=user.0 \ -fsdev local,id=host_id,path=./,security_model=none \ -device virtio-9p-pci,fsdev=host_id,mount_tag=host_mount \ -serial mon:stdio ``` -------------------------------- ### Install New CRDs Source: https://docs.cilium.io/en/stable/contributing/development/introducing_new_crds Ensure new CRDs are installed into Kubernetes by updating the CRD installation logic. This example adds `v2alpha1.BGPPName` and `v2alpha1.BGPPoolName` to the list of CRDs to be installed. ```go diff --git a/pkg/k8s/synced/crd.go b/pkg/k8s/synced/crd.go index 52d975c449..10c554cf8a 100644 --- a/pkg/k8s/synced/crd.go +++ b/pkg/k8s/synced/crd.go @@ -42,6 +42,11 @@ func agentCRDResourceNames() []string { CRDResourceName(v2.CCNPName), CRDResourceName(v2.CNName), CRDResourceName(v2.CIDName), + CRDResourceName(v2.CIDName), + // TODO(louis) make this a conditional install + // based on --enable-bgp-control-plane flag + CRDResourceName(v2alpha1.BGPPName), + CRDResourceName(v2alpha1.BGPPoolName), } ``` -------------------------------- ### Example of showing BPF filesystem mount details Source: https://docs.cilium.io/en/stable/cmdref/cilium-dbg_bpf_fs_show This is a basic example of how to invoke the command to show BPF filesystem mount details. It requires no additional flags. ```bash cilium bpf fs show ``` -------------------------------- ### Create and Register Example Table Source: https://docs.cilium.io/en/stable/contributing/development/statedb Provides a function `NewExampleTable` to create a new StateDB table for `Example` objects, registering the defined `idIndex`. It also defines a `Cell` module for dependency injection and table registration. ```go // NewExampleTable creates the table and registers it. func NewExampleTable(db *statedb.DB) (statedb.RWTable[Example], error) { return statedb.NewTable( db, TableName, idIndex, ) } // Cell provides the Table[Example] and registers a controller to populate // the table. var Cell = cell.Module( "example", "Examples", // Provide RWTable[Example] privately cell.ProvidePrivate(NewExampleTable), // Provide Table[Example] publicly cell.Provide(statedb.RWTable[Example].ToTable), // Register a controller that manages the contents of the // table. cell.Invoke(registerExampleController), ) ``` -------------------------------- ### Set Up kind Cluster and Install Cilium Source: https://docs.cilium.io/en/stable/security/standalone-dns-proxy Initializes a kind Kubernetes cluster and installs Cilium from source. Ensure you have kind and Docker set up before running. ```bash $ make kind && make kind-image && make kind-install-cilium ``` -------------------------------- ### Monitor Cilium Pods During Installation Source: https://docs.cilium.io/en/stable/installation/cni-chaining-calico Watches the status of Cilium and related pods in the kube-system namespace during installation to ensure they are starting and running correctly. ```bash $ kubectl -n kube-system get pods --watch ``` ```text NAME READY STATUS RESTARTS AGE cilium-operator-cb4578bc5-q52qk 0/1 Pending 0 8s cilium-s8w5m 0/1 PodInitializing 0 7s coredns-86c58d9df4-4g7dd 0/1 ContainerCreating 0 8m57s coredns-86c58d9df4-4l6b2 0/1 ContainerCreating 0 8m57s ``` ```text cilium-operator-cb4578bc5-q52qk 1/1 Running 0 4m13s cilium-s8w5m 1/1 Running 0 4m12s coredns-86c58d9df4-4g7dd 1/1 Running 0 13m coredns-86c58d9df4-4l6b2 1/1 Running 0 13m ``` -------------------------------- ### Deploy Example App and Ingress Source: https://docs.cilium.io/en/stable/network/servicemesh/path-types Apply the base definitions for the ingress-conformance-echo tool and the Ingress resource. Ensure Cilium Ingress is enabled. ```bash $ kubectl apply -f https://raw.githubusercontent.com/cilium/cilium/main/examples/kubernetes/servicemesh/ingress-path-types.yaml $ kubectl apply -f https://raw.githubusercontent.com/cilium/cilium/main/examples/kubernetes/servicemesh/ingress-path-types-ingress.yaml ``` -------------------------------- ### Install MCS-API CRDs Source: https://docs.cilium.io/en/stable/network/clustermesh/mcsapi Apply the MCS-API Custom Resource Definitions (CRDs) to your cluster. This is necessary if Cilium has not yet started or automatic CRD installation is disabled. ```bash kubectl apply -f https://raw.githubusercontent.com/cilium/cilium/1.19.5/vendor/sigs.k8s.io/mcs-api/config/crd/multicluster.x-k8s.io_serviceexports.yaml ``` ```bash kubectl apply -f https://raw.githubusercontent.com/cilium/cilium/1.19.5/vendor/sigs.k8s.io/mcs-api/config/crd/multicluster.x-k8s.io_serviceimports.yaml ``` -------------------------------- ### Install Cilium via OCI Registry Source: https://docs.cilium.io/en/stable/installation/kind Installs the Cilium release directly from an OCI registry (Quay.io in this example). This method bypasses the need to add a Helm repository. ```bash helm install cilium oci://quay.io/cilium/charts/cilium --version 1.19.5 \ --namespace kube-system \ --set image.pullPolicy=IfNotPresent \ --set ipam.mode=kubernetes ``` -------------------------------- ### Interact with Service via Gateway with Headers Source: https://docs.cilium.io/en/stable/network/servicemesh/gateway-api/http This example shows how to make a request to the Gateway with custom headers and query parameters. The output includes verbose information about the request and response, and the HTML content of the bookstore application. ```bash $ curl -v -H 'magic: foo' http://"$GATEWAY"\?great\=example ... (HTML output) ``` -------------------------------- ### Install Cilium via Helm Repository Source: https://docs.cilium.io/en/stable/network/kubernetes/kata Deploy Cilium using Helm, specifying the chart version and namespace. This example installs Cilium version 1.19.5 into the 'kube-system' namespace. ```bash helm install cilium cilium/cilium --version 1.19.5 \ --namespace kube-system \ --set bpf.autoMount.enabled=false ``` -------------------------------- ### Register Example Controller Job Source: https://docs.cilium.io/en/stable/contributing/development/statedb The `registerExampleController` function sets up the `exampleController` and adds its `loop` method as a background job to the provided job group, ensuring it runs as part of the application's lifecycle. ```go func registerExampleController(jg job.Group, db *statedb.DB, examples statedb.RWTable[Example]) { // Construct the controller and add the loop() method as a one-shot background // job to the module's job group. // When the controller doesn't have any useful API to outside we can use this // pattern instead of "Provide(NewController)" to keep things internal. ctrl := &exampleController{db, examples} jg.Add(job.OneShot( "loop", ctrl.loop, )) } ``` -------------------------------- ### Install BIRD 2.x Source: https://docs.cilium.io/en/stable/network/bird Installs the BIRD 2.x package using yum and enables/restarts the BIRD service using systemctl. This is the initial setup step for using BIRD with Cilium. ```bash $ yum install -y bird2 $ systemctl enable bird $ systemctl restart bird ``` -------------------------------- ### Run VM Source: https://docs.cilium.io/en/stable/contributing/development/bpf_tests Starts the Little VM Helper with specified configurations, including image path, host mounts, CPU, memory, and port forwarding. ```bash $ ./lvh run --image /var/tmp/images/complexity-test_bpf-net.qcow2 \ --host-mount \ --cpu-kind=host \ --cpu=2 \ --mem=8G \ -p 2222:22 \ --console-log-file=/tmp/lvh-console.log ``` -------------------------------- ### Example: List BPF maps Source: https://docs.cilium.io/en/stable/cmdref/cilium-dbg_map_list A simple example demonstrating how to list BPF maps. This command is useful for quick checks and debugging. ```bash cilium map list ``` -------------------------------- ### Example SSH Configuration for Remote Testing Source: https://docs.cilium.io/en/stable/contributing/testing/e2e_legacy This is an example of an ssh-config file used to define connection parameters for remote testing environments. Ensure the paths and hostnames match your setup. ```ssh-config Host runtime HostName 127.0.0.1 User vagrant Port 2222 UserKnownHostsFile /dev/null StrictHostKeyChecking no PasswordAuthentication no IdentityFile /home/eloy/.go/src/github.com/cilium/cilium/test/.vagrant/machines/runtime/virtualbox/private_key IdentitiesOnly yes LogLevel FATAL ``` -------------------------------- ### Docker Environment Setup for Backporting Source: https://docs.cilium.io/en/stable/contributing/release/backports Builds a Docker image with necessary dependencies and runs a container for backporting tasks. Mounts local directories for persistence and SSH access. ```bash $ export GITHUB_TOKEN= $ docker build -t cilium-backport contrib/backporting/. $ docker run -e GITHUB_TOKEN -v $(pwd):/cilium -v "$HOME/.ssh":/home/user/.ssh \ -it cilium-backport /bin/bash ``` -------------------------------- ### Install Pre-flight Check with Helm (Kubernetes API Info) Source: https://docs.cilium.io/en/stable/operations/upgrade Installs the Cilium pre-flight check using Helm, including Kubernetes API server details. This is essential for kube-proxy-free setups. ```bash helm install cilium-preflight cilium/cilium --version 1.19.5 \ --namespace kube-system \ --set preflight.enabled=true \ --set agent=false \ --set operator.enabled=false \ --set k8sServiceHost=API_SERVER_IP \ --set k8sServicePort=API_SERVER_PORT ``` -------------------------------- ### etcd Configuration File Example Source: https://docs.cilium.io/en/stable/cmdref/kvstore Example of an etcd configuration file. Ensure to set the correct paths for CA, client key, and client certificate files if client authentication is required. ```yaml --- endpoints: - https://192.168.0.1:2379 - https://192.168.0.2:2379 trusted-ca-file: '/var/lib/cilium/etcd-ca.pem' # In case you want client to server authentication key-file: '/var/lib/cilium/etcd-client.key' cert-file: '/var/lib/cilium/etcd-client.crt' ``` -------------------------------- ### Install Cilium with Azure IPAM and Native Routing Source: https://docs.cilium.io/en/stable/network/kubernetes/kubeproxy-free Install Cilium using Helm, configuring it for Azure IPAM and native routing. This setup is recommended for Azure environments to ensure correct pod IP address allocation and routing. ```bash helm install cilium cilium/cilium --version 1.19.5 \ --namespace kube-system \ --set ipam.mode=azure \ --set azure.enabled=true \ --set azure.resourceGroup=$AZURE_NODE_RESOURCE_GROUP \ --set azure.subscriptionID=$AZURE_SUBSCRIPTION_ID \ --set azure.tenantID=$AZURE_TENANT_ID \ --set azure.clientID=$AZURE_CLIENT_ID \ --set azure.clientSecret=$AZURE_CLIENT_SECRET \ --set routingMode=native \ --set enableIPv4Masquerade=false \ --set devices=eth0 \ --set kubeProxyReplacement=true \ --set loadBalancer.acceleration=native \ --set loadBalancer.mode=snat \ --set k8sServiceHost=${API_SERVER_IP} \ --set k8sServicePort=${API_SERVER_PORT} ``` ```bash helm install cilium oci://quay.io/cilium/charts/cilium --version 1.19.5 \ --namespace kube-system \ --set ipam.mode=azure \ --set azure.enabled=true \ --set azure.resourceGroup=$AZURE_NODE_RESOURCE_GROUP \ --set azure.subscriptionID=$AZURE_SUBSCRIPTION_ID \ --set azure.tenantID=$AZURE_TENANT_ID \ --set azure.clientID=$AZURE_CLIENT_ID \ --set azure.clientSecret=$AZURE_CLIENT_SECRET \ --set routingMode=native \ --set enableIPv4Masquerade=false \ --set devices=eth0 \ --set kubeProxyReplacement=true \ --set loadBalancer.acceleration=native \ --set loadBalancer.mode=snat \ --set k8sServiceHost=${API_SERVER_IP} \ --set k8sServicePort=${API_SERVER_PORT} ``` -------------------------------- ### Render Documentation Locally Source: https://docs.cilium.io/en/stable/contributing/docs/docstest Builds a Docker image and starts a container to preview the documentation locally. Changes are reflected in real-time upon saving files. ```bash make render-docs ``` -------------------------------- ### Describe Pending Pods Source: https://docs.cilium.io/en/stable/observability/hubble/setup If pods are in a `Pending` state, use `kubectl describe` to get detailed information about why they are not scheduling or starting. ```bash $ kubectl describe -n kube-system pod/cilium-5bjkq Name: cilium-5bjkq Namespace: kube-system ... ``` -------------------------------- ### Get Node Statuses Source: https://docs.cilium.io/en/stable/installation/k8s-install-rancher-existing-nodes Check the status of all nodes in the cluster using kubectl. This helps confirm that nodes have joined and are ready after Cilium installation. ```bash kubectl get nodes -A ``` -------------------------------- ### Initialize and Run a Hive Application Source: https://docs.cilium.io/en/stable/contributing/development/hive Demonstrates how to create a new Hive application with specified cells and run it. The Run() method starts the hive, waits for a termination signal, and then stops it. Direct Start() and Stop() methods are also available, useful for testing. ```go var myHive = hive.New(foo.Cell, bar.Cell) // Call Run() to run the hive. myHive.Run() // Start(), wait for signal (ctrl-c) and then Stop() // Hive can also be started and stopped directly. Useful in tests. if err := myHive.Start(ctx); err != nil { /* ... */ } if err := myHive.Stop(ctx); err != nil { /* ... */ } // Hive's configuration can be registered with a Cobra command: hive.RegisterFlags(cmd.Flags()) // Hive also provides a sub-command for inspecting it: cmd.AddCommand(hive.Command()) ``` -------------------------------- ### Initialize Control-Plane Node without kube-proxy Source: https://docs.cilium.io/en/stable/network/kubernetes/kubeproxy-free Use this command to initialize the control-plane node during cluster setup, skipping the installation of the kube-proxy add-on. ```bash $ kubeadm init --skip-phases=addon/kube-proxy ``` -------------------------------- ### Install Cilium with XDP LoadBalancer Acceleration (OCI Registry) Source: https://docs.cilium.io/en/stable/network/kubernetes/kubeproxy-free Install Cilium using Helm from an OCI registry, enabling kube-proxy replacement, native XDP acceleration for load balancers, and hybrid mode. This setup optimizes the forwarding of requests to remote nodes by leveraging XDP. ```bash helm install cilium oci://quay.io/cilium/charts/cilium --version 1.19.5 \ --namespace kube-system \ --set routingMode=native \ --set kubeProxyReplacement=true \ --set loadBalancer.acceleration=native \ --set loadBalancer.mode=hybrid \ --set k8sServiceHost=${API_SERVER_IP} \ --set k8sServicePort=${API_SERVER_PORT} ``` -------------------------------- ### Start Backporting Process Source: https://docs.cilium.io/en/stable/contributing/release/backports Initiates the backporting process for a specific release version. Requires a GitHub token. ```bash $ GITHUB_TOKEN=xxx contrib/backporting/start-backport 1.0 ``` -------------------------------- ### Visualizing CPU and Memory Profiles Source: https://docs.cilium.io/en/stable/contributing/testing/scalability Launch a local web server to visualize the aggregated CPU and memory profiles using the go tool pprof. ```bash go tool pprof -http=localhost:8080 cpu.pprof go tool pprof -http=localhost:8080 heap.pprof ``` -------------------------------- ### Generate Bash Completion Script Source: https://docs.cilium.io/en/stable/cmdref/cilium-health_completion_bash This command generates the bash completion script. You will need to start a new shell for the setup to take effect after saving the script. ```bash cilium-health completion bash ``` -------------------------------- ### Build and Install iproute2 Source: https://docs.cilium.io/en/stable/reference-guides/bpf/toolchain After cloning, navigate into the iproute2 directory, configure the build with a prefix, and then compile and install. Ensure 'ELF support: yes' is shown during configuration for LLVM BPF backend compatibility. ```bash cd iproute2/ ./configure --prefix=/usr make [...] sudo make install ``` -------------------------------- ### Install Hubble UI Standalone with Helm (OCI Registry) Source: https://docs.cilium.io/en/stable/observability/hubble/hubble-ui Configure Helm to deploy Hubble UI as a standalone application from an OCI registry. This method allows for fine-grained control over the installation, especially when integrating with an existing Hubble Relay setup and requires specific TLS certificate configurations. ```yaml helm upgrade cilium oci://quay.io/cilium/charts/cilium --version 1.19.5 \ --namespace $CILIUM_NAMESPACE \ --reuse-values \ --set hubble.relay.enabled=true \ --set hubble.ui.enabledd=true \ --values - < $(brew --prefix)/share/zsh/site-functions/_clustermesh-apiserver ``` -------------------------------- ### kvstore get command options Source: https://docs.cilium.io/en/stable/cmdref/cilium-dbg_kvstore_get Lists available options for the 'get' command, including output formatting and recursive lookup. ```bash -h, --help help for get -o, --output string json| yaml| jsonpath='{}' --recursive Recursive lookup ``` -------------------------------- ### Load Zsh Completions for New Sessions (Linux) Source: https://docs.cilium.io/en/stable/cmdref/clustermesh-apiserver_completion_zsh Copy this command to load the autocompletion script for all new shell sessions on Linux. You will need to start a new shell for this setup to take effect. ```shell clustermesh-apiserver completion zsh > "${fpath[1]}/_clustermesh-apiserver" ``` -------------------------------- ### Deploy GKE Cluster and Get Credentials Source: https://docs.cilium.io/en/stable/network/clustermesh/gke-clustermesh-prep Creates a single-node GKE cluster with IP aliasing enabled and a node taint to prevent pod scheduling until Cilium is installed. It also retrieves kubectl credentials. ```bash gcloud container clusters create ${CLUSTER} \ --zone ${ZONE} \ --node-locations ${ZONE} \ --network=${VPC_NETWORK} \ --enable-ip-alias \ --cluster-ipv4-cidr=${POD_CIDR} \ --services-ipv4-cidr=${SERVICES_CIDR} \ --machine-type=e2-medium \ --max-nodes=1 \ --num-nodes=1 \ --node-taints node.cilium.io/agent-not-ready=true:NoSchedule \ --project ${PROJECT_ID} # Get kubectl credentials, the command will merge the new credentials # with the existing ~/.kube/config gcloud container clusters get-credentials ${CLUSTER} \ --zone ${ZONE} \ --project ${PROJECT_ID} ``` -------------------------------- ### Multi-homing with Default Gateway Auto-Discovery Source: https://docs.cilium.io/en/stable/network/bgp-control-plane/bgp-control-plane-configuration Configuration example for multi-homing setups where a Cilium node connects to two different Top-of-Rack switches. Cilium selects the default route with the lower metric for the BGP session. ```yaml bgpInstances: - name: "65001" localASN: 65001 peers: - name: "instance-65001" peerASN: 65000 autoDiscovery: mode: "DefaultGateway" defaultGateway: addressFamily: ipv6 peerConfigRef: name: "cilium-peer" ``` -------------------------------- ### Run KVStoreMesh Source: https://docs.cilium.io/en/stable/cmdref/clustermesh-apiserver_kvstoremesh This is the basic command to run the KVStoreMesh. Use this to start the KVStoreMesh component. ```bash clustermesh-apiserver kvstoremesh [flags] ``` -------------------------------- ### Deploy L7 Network Policy Source: https://docs.cilium.io/en/stable/operations/performance/scalability/report Example of a CiliumNetworkPolicy for Layer 7 traffic. This policy selects pods with the label 'my-label: testing' in 'namespace-1' and allows specific HTTP GET and PUT requests to defined paths. ```yaml apiVersion: "cilium.io/v2" kind: CiliumNetworkPolicy metadata: name: "l7-rule-#" namespace: "namespace-1" spec: endpointSelector: matchLabels: my-label: testing fromEndpoints: matchLabels: my-label: testing ingress: - toPorts: - ports: - port: '[126-250]+80' # from 12680 to 25080 protocol: TCP rules: http: - method: GET path: "/path1$" - method: PUT path: "/path2$" headers: - 'X-My-Header: true' ``` -------------------------------- ### Install Cilium with External etcd via OCI (HTTP) Source: https://docs.cilium.io/en/stable/installation/k8s-install-external-etcd Deploys Cilium using Helm from an OCI registry, configuring it to use an external etcd cluster via HTTP endpoints. This method bypasses the need for a Helm repository setup. ```bash helm install cilium oci://quay.io/cilium/charts/cilium --version 1.19.5 \ --namespace kube-system \ --set etcd.enabled=true \ --set "etcd.endpoints[0]=http://etcd-endpoint1:2379" \ --set "etcd.endpoints[1]=http://etcd-endpoint2:2379" \ --set "etcd.endpoints[2]=http://etcd-endpoint3:2379" ``` -------------------------------- ### Install kops on Linux Source: https://docs.cilium.io/en/stable/installation/k8s-install-kops Download the kops binary for Linux, make it executable, and move it to the system's PATH. ```bash curl -LO https://github.com/kubernetes/kops/releases/download/$(curl -s https://api.github.com/repos/kubernetes/kops/releases/latest | grep tag_name | cut -d '"' -f 4)/kops-linux-amd64 chmod +x kops-linux-amd64 sudo mv kops-linux-amd64 /usr/local/bin/kops ``` -------------------------------- ### Load fish shell completions for every new session Source: https://docs.cilium.io/en/stable/cmdref/cilium-bugtool_completion_fish To load completions for every new session, redirect the output of `cilium-bugtool completion fish` to a file in the fish completions directory. You will need to start a new shell for this setup to take effect. ```bash cilium-bugtool completion fish > ~/.config/fish/completions/cilium-bugtool.fish ``` -------------------------------- ### Load Bash Completions for All New Sessions on macOS Source: https://docs.cilium.io/en/stable/cmdref/clustermesh-apiserver_completion_bash To load completions for every new session on macOS, redirect the output of the completion command to a file in the appropriate bash_completion.d directory using brew. You will need to start a new shell for this setup to take effect. ```bash clustermesh-apiserver completion bash > $(brew --prefix)/etc/bash_completion.d/clustermesh-apiserver ``` -------------------------------- ### Implement Example Controller Loop Source: https://docs.cilium.io/en/stable/contributing/development/statedb Defines an `exampleController` struct and its `loop` method, which periodically inserts `Example` objects into the table. It resets the count after 5 insertions and reports health status. ```go type exampleController struct { db *statedb.DB examples statedb.RWTable[Example] } // loop is a simple control-loop that once a second inserts an example object // with an increasing [ID]. When 5 objects are reached it deletes everything // and starts over. func (e *exampleController) loop(ctx context.Context, health cell.Health) error { id := uint64(0) tick := time.NewTicker(time.Second) defer tick.Stop() health.OK("Starting") for { var tickTime time.Time select { case tickTime = <-tick.C: case <-ctx.Done(): return nil } wtxn := e.db.WriteTxn(e.examples) id++ if id <= 5 { e.examples.Insert(wtxn, Example{ID: id, CreatedAt: tickTime}) } else { e.examples.DeleteAll(wtxn) id = 0 } wtxn.Commit() // Report the health of the job. This can be inspected with // "cilium-dbg status --all-health" or with "cilium-dbg shell -- db/show health". health.OK(fmt.Sprintf("%d examples inserted", id)) } } ```