the following fix is required: d5256083f62e [h�ps://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/? id=d5256083f62e2720f75bb3c5a928a0afe47d6bc3] . This fix is included in stable kernels (as we will do in the steps below). So with Docker, we simply create a single network named ‘cilium-net’ for all containers: $ docker network create --ipv6 --subnet ::1/112 --driver cilium --ipam-driv app1 container connected to the Docker network managed by Cilium: $ docker run -d --name app1 --net cilium-net -l "id=app1" cilium/demo-httpd e5723edaa2a1307e7aa7e71b4087882de0250973331bc74a37f6f80667bc5856

like transparent encryption. AWS-CNI Azure CNI Calico Generic Veth Chaining Portmap (HostPort) Weave Net AWS-CNI This guide explains how to set up Cilium in combination with aws-cni. In this hybrid mode "type": "k8s" }, "kubernetes": { "kubeconfig": "/etc/cni/net.d/calico-kubeconfig" } }, { "type": "portmap", "snat": true hostPort-CNI plugin documentation [https://kubernetes.io/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/#support-hostport]. Note Before using HostPort, read the Kubernetes Configuration

like transparent encryption. AWS-CNI Azure CNI Calico Generic Veth Chaining Portmap (HostPort) Weave Net AWS-CNI This guide explains how to set up Cilium in combination with aws-cni. In this hybrid mode "type": "k8s" }, "kubernetes": { "kubeconfig": "/etc/cni/net.d/calico-kubeconfig" } }, { "type": "portmap", "snat": true hostPort-CNI plugin documentation [https://kubernetes.io/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/#support-hostport]. Note Before using HostPort, read the Kubernetes Configuration

\ --set global.cni.binPath=/var/lib/cni/bin \ --set global.cni.confPath=/var/run/multus/cni/net.d \ --set global.ipam.operator.clusterPoolIPv4PodCIDR=10.128.0.0/14 \ --set global.ipam.operator other advanced features. AWS-CNI Azure CNI Calico Generic Veth Chaining Portmap (HostPort) Weave Net AWS-CNI This guide explains how to set up Cilium in combination with aws-cni. In this hybrid mode "type": "k8s" }, "kubernetes": { "kubeconfig": "/etc/cni/net.d/calico-kubeconfig" } }, { "type": "portmap", "snat": true

enable Cilium’s kube-proxy replacement (Kubernetes Without kube- proxy), cgroup v1 controllers net_cls and net_prio have to be disabled, or cgroup v1 has to be disabled (e.g. by setting the kernel cgroup_no_v1="all" mode=cluster-pool \ --set cni.binPath=/var/lib/cni/bin \ --set cni.confPath=/var/run/multus/cni/net.d \ --set ipam.operator.clusterPoolIPv4PodCIDR=10.128.0.0/14 \ --set ipam.operator.clusterPoolIPv4MaskSize=23 /hosts $ echo 'cilium_version: "v1.11.0"' >> ./inventory/my- inventory/group_vars/k8s_cluster/k8s-net-cilium.yml $ ansible-playbook -i ./inventory/my-inventory/hosts ./cluster.yml -e ansible_user=core

Network Plugin Requirements [https://kubernetes.io/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/#network- plugin-requirements]) Linux kernel >= 4.9.17 Tip See System Requirements Network Plugin Requirements [https://kubernetes.io/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/#network- plugin-requirements]) Linux kernel >= 4.9.17 Tip See System Requirements enable Cilium’s kube-proxy replacement (Kubernetes Without kube- proxy), cgroup v1 controllers net_cls and net_prio have to be disabled, or cgroup v1 has to be disabled (e.g. by setting the kernel cgroup_no_v1="all"

Network Plugin Requirements [https://kubernetes.io/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/#network- plugin-requirements]) Linux kernel >= 4.9.17 Tip See System Requirements Network Plugin Requirements [https://kubernetes.io/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/#network- plugin-requirements]) Linux kernel >= 4.9.17 Tip See System Requirements setting the kernel systemd.unified_cgroup_hierarchy=1 parameter. Also, cgroup v1 controllers net_cls and net_prio have to be disabled, or cgroup v1 has to be disabled (e.g. by setting the kernel cgroup_no_v1="all"

ink bpf(BPF_OBJ_GET, {pathname="/sys/fs/bpf/echo_dispatch_prog", …) = 3 openat(…, "/proc/self/ns/net", …) = 4 bpf(BPF_LINK_CREATE, {link_create={prog_fd=3, target_fd=4, netns_ino 4026531992 attach_type sk_lookup $ ls -l /proc/self/ns/net lrwxrwxrwx. 1 vagrant vagrant 0 Oct 23 13:35 /proc/self/ns/net -> 'net:[4026531992]' prog attached to netns syscall trace Enable echo

- Enable debugging symbols under Kernel Hacking -> compile options git clone git://git.buildroot.net/buildroot /source/buildroot cd buildroot make menuconfig make -j16 Rootfs Remember to: - Select

Policy Language Rules and Directives Rules specify access to system objects: ▶ fs(file, access) ▶ net(socket, access) ▶ signal(prog, sig) ▶ etc. Directives augment blocks of rules: ▶ #[directive] syntax