performed on the source host. For east-west type load balancing, Cilium performs efficient service-to-backend translation right in the Linux kernel’s socket layer (e.g. at TCP connect time) such that per-packet (see Network Plugin Requirements [https://kubernetes.io/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/#network- plugin-requirements]) Linux kernel >= 4.9.17 Tip See System Requirements com/docs/rke/latest/en/installation/] with the below change: From: network: options: flannel_backend_type: "vxlan" plugin: "canal" To: network: plugin: none Install Cilium: Install Cilium into

performed on the source host. For east-west type load balancing, Cilium performs efficient service-to-backend translation right in the Linux kernel’s socket layer (e.g. at TCP connect time) such that per-packet (see Network Plugin Requirements [https://kubernetes.io/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/#network- plugin-requirements]) Linux kernel >= 4.9.17 Tip See System Requirements com/docs/rke/latest/en/installation/] with the below change: From: network: options: flannel_backend_type: "vxlan" plugin: "canal" To: network: plugin: none Install Cilium: Install Cilium into

performed on the source host. For east-west type load balancing, Cilium performs efficient service-to-backend translation right in the Linux kernel’s socket layer (e.g. at TCP connect time) such that per-packet support for the default CNI plugin: curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC='--flannel- backend=none' sh - Install Agent Nodes (Optional) K3s can run in standalone mode or as a cluster making "kube-dns-autoscaler-76fcd5f658-22r72" deleted pod "kube-state-metrics-7d9774bbd5-n6m5k" deleted pod "l7-default-backend-6f8697844f-d2rq2" deleted pod "metrics-server-v0.3.1-54699c9cc8-7l5w2" deleted Note This may error

as you scale up your clusters: etcd nodes operated by the etcd-operator will not use persistent storage. Once the etcd cluster looses quorum, the etcd cluster is automa�cally re- created by the cilium-etcd-operator "kube-dns-autoscaler-76fcd5f658-22r72" deleted pod "kube-state-metrics-7d9774bbd5-n6m5k" deleted pod "l7-default-backend-6f8697844f-d2rq2" deleted pod "metrics-server-v0.3.1-54699c9cc8-7l5w2" deleted Installer Integrations tracking, meaning that if policy allows the frontend to reach backend, it will automa�cally allow all required reply packets that are part of backend replying to frontend within the context of the same TCP/UDP

as you scale up your clusters: etcd nodes operated by the etcd-operator will not use persistent storage. Once the etcd cluster looses quorum, the etcd cluster is automatically re-created by the cilium-etcd-operator "kube-dns-autoscaler-76fcd5f658-22r72" deleted pod "kube-state-metrics-7d9774bbd5-n6m5k" deleted pod "l7-default-backend-6f8697844f-d2rq2" deleted pod "metrics-server-v0.3.1-54699c9cc8-7l5w2" deleted Validate the Installation hostPort-CNI plugin documentation [https://kubernetes.io/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/#support-hostport]. Note Before using HostPort, read the Kubernetes Configuration

support for the default CNI plugin: curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC='--flannel-backend=none --no-flannel' sh - Install Agent Nodes (Optional) K3s can run in standalone mode or as a "kube-dns-autoscaler-76fcd5f658-22r72" deleted pod "kube-state-metrics-7d9774bbd5-n6m5k" deleted pod "l7-default-backend-6f8697844f-d2rq2" deleted pod "metrics-server-v0.3.1-54699c9cc8-7l5w2" deleted Validate the Installation as you scale up your clusters: etcd nodes operated by the etcd-operator will not use persistent storage. Once the etcd cluster looses quorum, the etcd cluster is automatically re-created by the cilium-etcd-operator

support for the default CNI plugin: curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC='--flannel-backend=none --no-flannel' sh - Install Agent Nodes (Optional) K3s can run in standalone mode or as a "kube-dns-autoscaler-76fcd5f658-22r72" deleted pod "kube-state-metrics-7d9774bbd5-n6m5k" deleted pod "l7-default-backend-6f8697844f-d2rq2" deleted pod "metrics-server-v0.3.1-54699c9cc8-7l5w2" deleted Note This may error as you scale up your clusters: etcd nodes operated by the etcd-operator will not use persistent storage. Once the etcd cluster looses quorum, the etcd cluster is automatically re-created by the cilium-etcd-operator

XDP kernel ethernet driver kube-proxy DNAT kube-proxy SNAT worker node nodePort request backend endpoint tc eBPF NAT XDP eBPF NAT DSR 加速南北向 nodePort 访问 传统的 nodePort 转发，伴随着 SNAT的发生。而 Cilium

httpd httpd void loadbalance(skb) { svc = bpf_map_lookup_elem(..); if (svc) { b = select_backend(svc); dnat(skb, b); snat(skb); redirect(skb); } } CC BY-SA 3.0, https://commons

2020 1 The data deluge on modern storage 2 Compute node CPU Network Storage node Flash The data deluge on modern storage 3 Compute node 3 CPU Network Storage node Flash 16-lane PCIe, 16GB/s research group ● Work with eBPF for storage! 5 eBPF and DoS 6 Compute node CPU Network Storage node Flash eBPF and DoS 7 Compute node CPU Network Storage node Flash DoS eBPF and DoS 8 Compute node CPU Network Storage node Flash DoS DoS in reverse! 9 Compute node CPU Network Storage node Flash DoS in reverse! 10 Compute node CPU Network Storage node Flash Data DoS in