Guarantees API Reference Internals Hubble internals Hubble Architecture Cilium Operator Highly Available Cilium Operator CRD Registration IPAM KVStore operations Identity garbage collection CiliumEndpoint examples: Command Reference cilium-agent cilium cilium-health cilium-operator cilium-operator-aws cilium-operator-azure cilium-operator-generic Key-Value Store Key-Value Store Layout Leases Debugging transparently insert security visibility + enforcement, but does so in a way that is based on service / pod / container identity (in contrast to IP address identification in traditional systems) and can filter

Guarantees API Reference Internals Hubble internals Hubble Architecture Cilium Operator Highly Available Cilium Operator CRD Registration IPAM KVStore operations Identity garbage collection CiliumEndpoint examples: Command Reference cilium-agent cilium cilium-health cilium-operator cilium-operator-aws cilium-operator-azure cilium-operator-generic Key-Value Store Key-Value Store Layout Leases Debugging transparently insert security visibility + enforcement, but does so in a way that is based on service / pod / container identity (in contrast to IP address identification in traditional systems) and can filter

examples: Command Reference cilium-agent cilium cilium-health cilium-operator cilium-operator-aws cilium-operator-azure cilium-operator-generic Key-Value Store Key-Value Store Layout Leases Debugging transparently insert security visibility + enforcement, but does so in a way that is based on service / pod / container identity (in contrast to IP address identification in traditional systems) and can filter --watch NAME READY STATUS RESTARTS AGE cilium-operator-cb4578bc5-q52qk 0/1 Pending 0 8s cilium-s8w5m

examples: Command Reference cilium-agent cilium cilium-health cilium-operator cilium-operator-aws cilium-operator-azure cilium-operator-generic Key-Value Store Key-Value Store Layout Leases Debugging transparently insert security visibility + enforcement, but does so in a way that is based on service / pod / container identity (in contrast to IP address identification in traditional systems) and can filter --watch NAME READY STATUS RESTARTS AGE cilium-operator-cb4578bc5-q52qk 0/1 Pending 0 8s cilium-s8w5m

the log output Configuration Core Agent Monitoring & Metrics Installation cilium-agent cilium-operator Troubleshooting Component & Cluster Health Connectivity Problems Policy Troubleshooting Symptom Command examples: Kubernetes examples: Command Reference cilium-agent cilium cilium-health cilium-operator Key-Value Store Key-Value Store Layout Leases Debugging Further Reading Related Material Presentations transparently insert security visibility + enforcement, but does so in a way that is based on service / pod / container identity (in contrast to IP address identification in traditional systems) and can filter

Kubernetes Endpoint Lifecycle Troubleshooting Monitoring & Metrics Installation cilium-agent cilium-operator Troubleshooting Component & Cluster Health Connectivity Problems Policy Troubleshooting Symptom Command examples: Kubernetes examples: Command Reference cilium-agent cilium cilium-health cilium-operator Key-Value Store Key-Value Store Layout Leases Debugging Further Reading Related Material Presentations transparently insert security visibility + enforcement, but does so in a way that is based on service / pod / container identity (in contrast to IP address identification in traditional systems) and can filter

Kubernetes Endpoint Lifecycle Troubleshoo�ng Monitoring & Metrics Exported Metrics Cilium as a Kubernetes pod Cilium as a host-agent on a node Troubleshoo�ng Component & Cluster Health Connec�vity Problems Policy transparently insert security visibility + enforcement, but does so in a way that is based on service / pod / container iden�ty (in contrast to IP address iden�fica�on in tradi�onal systems) and can filter on er- kubeadm/#pod-network]. Standard Installation This guides takes you through the steps required to set up Cilium on Kubernetes using the cilium-etcd-operator. The cilium-etcd-operator replaces the

10% 64K 5% 18K 4% 11K 1% 32K 5% Data read 15% Metadata write 18% Production service (NFS) FS Pod Pod Client Link reliability and concurrency performance Server storage Permission/Resource control/DR/Security leverages Kubernetes' CRD+Operator extension mechanism to create custom resources for OSs. This enables the OS to be treated as a Kubernetes resource, monitored by the OS-Operator and OS-Proxy within the tasks. OS unified O&M and management Pod kube-apiserver Master Node Upgrade OS OS Image Creation Cluster Image Registry Deploy Pod os-operator os-operator KubeOS-scripts KubeOS OCl image KubeOS

15 功能描述 1. 全局管理器 OS-Controller，监控所有节点上的 OS 实例，收集所有节点 OS 信息，实现全局 OS 的生命周期管理， 包括升级、重启、配置，以及关机时驱逐 Pod。OS 轻量化裁剪，减少不必要的冗余包，可实现快速升级、替换等。 2. 节点代理 OS-proxy，部署和运行在工作节点上，监控单节点的 OS 实例，收集单节点 OS 信息，并上报到 OS-agent。 Shim v2 client Containerd-kata- shim-v2 grpc ttrpc StratoVirt Export c interface Lib shim v2 Pod Sandbox vsock CRI client CRI server runtime kata-agent Guest kernel container container openEuler 普通容器，保证容器业务安全和隔离性，可应用于金融、电信、安全等行业及面向多租户的业务场景； 元集群 Eggo-Operator 业务集群 集群 2 集群 3 Git 配置库 配置感知 Node 1 kubeOS ARM X86 Node 2 Node n Operator-framework 部署引擎 openEuler 21.09 技术白皮书 17 06/ 场景创新 openEuler

等。 功能描述 1. 全局管理器 OS-Controller，监控所有节点上的 OS 实例，收集所有节点 OS 信息，实现全局 OS 的生命周期管理， 包括升级、重启、配置，以及关机时驱逐 Pod。 2. 节点代理 OS-proxy，部署和运行在工作节点上，监控单节点的 OS 实例，收集单节点 OS 信息，并上报到 OS-agent。 3. 节点 OS-agent，接受 OS-proxy Shim v2 client Containerd-kata- shim-v2 grpc ttrpc StratoVirt Export c interface Lib shim v2 Pod Sandbox vsock CRI client CRI server runtime kata-agent Guest kernel container container openEuler 开发人员、云场景维测人员可使用 LibcarePlus 为 Qemu 应用程序制作热补丁和管理热补丁。 元集群 Eggo-Operator 业务集群 集群 2 集群 1 集群 3 Git 配置库 配置感知 Node 1 kubeOS ARM x86 Node 2 Node n Operator-framework 部署引擎 openEuler 22.03-LTS 技术白皮书 23 openEuler