pod-to-a-l3-denied-cnp-64c6c75c5d-xmqhw 1/1 Running 0 4m50s pod-to-b-intra-node-845f955cdc-5nfrt 1/1 Running 0 4m49s pod-to-b-multi-node-clusterip-666594b445-bsn4j pod-to-a-l3-denied-cnp-64c6c75c5d-xmqhw 1/1 Running 0 4m50s pod-to-b-intra-node-845f955cdc-5nfrt 1/1 Running 0 4m49s pod-to-b-multi-node-clusterip-666594b445-bsn4j pod-to-a-l3-denied-cnp-64c6c75c5d-xmqhw 1/1 Running 0 4m50s pod-to-b-intra-node-845f955cdc-5nfrt 1/1 Running 0 4m49s pod-to-b-multi-node-clusterip-666594b445-bsn4j

hubble-relay-5684848cc8-6ldhj 0/1 ContainerCreating 0 2s hubble-ui-54c6bc4cdc-h5drq 0/1 Pending 0 2s kube-apiserver-kind-control-plane 22m hubble-relay-5684848cc8-2z6qk 1/1 Running 0 21s hubble-ui-54c6bc4cdc-g5mgd 1/1 Running 0 17s kube-apiserver-kind-control-plane

hubble-relay-5684848cc8-6ldhj 0/1 ContainerCreating 0 2s hubble-ui-54c6bc4cdc-h5drq 0/1 Pending 0 2s kube-apiserver-kind-control-plane 22m hubble-relay-5684848cc8-2z6qk 1/1 Running 0 21s hubble-ui-54c6bc4cdc-g5mgd 1/1 Running 0 17s kube-apiserver-kind-control-plane

github 项目已有 9.3K star，Contributors 316位 cilium的特色功能： • 网络功能 • 负载均衡 • 网络安全 • 可观察性 • 多集群连通 注：本 PPT 基于 cilium v1.10.4 进行分析 ��������������� ��������������� �������������������� �������������������� user space kernel sockhash map sock_opt sock_opt sk_msg msg_redirect() identity技术应用于网络policy 传统基于 IP 来实现 policy过 滤，不足： • 一条过滤规则可能需要记录诸 多的CIDR • endpoint身份和 IP 地址耦合， 如 pod 重启后 IP 发生变化， 整集群可能需要同步 信息，刷