Guarantees API Reference Internals Hubble internals Hubble Architecture Cilium Operator Highly Available Cilium Operator CRD Registration IPAM KVStore operations Identity garbage collection CiliumEndpoint examples: Command Reference cilium-agent cilium cilium-health cilium-operator cilium-operator-aws cilium-operator-azure cilium-operator-generic Key-Value Store Key-Value Store Layout Leases Debugging transparently insert security visibility + enforcement, but does so in a way that is based on service / pod / container identity (in contrast to IP address identification in traditional systems) and can filter

Guarantees API Reference Internals Hubble internals Hubble Architecture Cilium Operator Highly Available Cilium Operator CRD Registration IPAM KVStore operations Identity garbage collection CiliumEndpoint examples: Command Reference cilium-agent cilium cilium-health cilium-operator cilium-operator-aws cilium-operator-azure cilium-operator-generic Key-Value Store Key-Value Store Layout Leases Debugging transparently insert security visibility + enforcement, but does so in a way that is based on service / pod / container identity (in contrast to IP address identification in traditional systems) and can filter

examples: Command Reference cilium-agent cilium cilium-health cilium-operator cilium-operator-aws cilium-operator-azure cilium-operator-generic Key-Value Store Key-Value Store Layout Leases Debugging transparently insert security visibility + enforcement, but does so in a way that is based on service / pod / container identity (in contrast to IP address identification in traditional systems) and can filter --watch NAME READY STATUS RESTARTS AGE cilium-operator-cb4578bc5-q52qk 0/1 Pending 0 8s cilium-s8w5m

examples: Command Reference cilium-agent cilium cilium-health cilium-operator cilium-operator-aws cilium-operator-azure cilium-operator-generic Key-Value Store Key-Value Store Layout Leases Debugging transparently insert security visibility + enforcement, but does so in a way that is based on service / pod / container identity (in contrast to IP address identification in traditional systems) and can filter --watch NAME READY STATUS RESTARTS AGE cilium-operator-cb4578bc5-q52qk 0/1 Pending 0 8s cilium-s8w5m

the log output Configuration Core Agent Monitoring & Metrics Installation cilium-agent cilium-operator Troubleshooting Component & Cluster Health Connectivity Problems Policy Troubleshooting Symptom Command examples: Kubernetes examples: Command Reference cilium-agent cilium cilium-health cilium-operator Key-Value Store Key-Value Store Layout Leases Debugging Further Reading Related Material Presentations transparently insert security visibility + enforcement, but does so in a way that is based on service / pod / container identity (in contrast to IP address identification in traditional systems) and can filter

Kubernetes Endpoint Lifecycle Troubleshooting Monitoring & Metrics Installation cilium-agent cilium-operator Troubleshooting Component & Cluster Health Connectivity Problems Policy Troubleshooting Symptom Command examples: Kubernetes examples: Command Reference cilium-agent cilium cilium-health cilium-operator Key-Value Store Key-Value Store Layout Leases Debugging Further Reading Related Material Presentations transparently insert security visibility + enforcement, but does so in a way that is based on service / pod / container identity (in contrast to IP address identification in traditional systems) and can filter

Kubernetes Endpoint Lifecycle Troubleshoo�ng Monitoring & Metrics Exported Metrics Cilium as a Kubernetes pod Cilium as a host-agent on a node Troubleshoo�ng Component & Cluster Health Connec�vity Problems Policy transparently insert security visibility + enforcement, but does so in a way that is based on service / pod / container iden�ty (in contrast to IP address iden�fica�on in tradi�onal systems) and can filter on er- kubeadm/#pod-network]. Standard Installation This guides takes you through the steps required to set up Cilium on Kubernetes using the cilium-etcd-operator. The cilium-etcd-operator replaces the

sk_msg。记录本地应用之间通信的socket，实现本地数据包的加速转发 加速同节点pod间通信 cilium 使用 eBPF 程序，借助 bpf_redirect() 或 bpf_redirect_peer() 等 helper 函数，快速帮助同宿主机间 的流量转发，节省了大量的内核协议栈 处理流程 pod 1 process kernel network stack raw pod 2 veth process kernel < 5.10 tailCall-> to-container: redirect kernel >= 5.10 redirect_peer routing veth veth kernel network stack node 加速跨节点pod间通信 pod在跨节点通 信的场景下， 借助 eBPF redirect 能力，帮 助数据包在主机物 理网卡和pod虚拟 网卡之间快速转发， 能够完全 bypass 内核协议族的处理。 在某测试场景下， 跨节点间的 pod 通 信的 tcp 性能，比 node间应用通信的 tcp 性能还稍高 woker node2 woker node1 pod1 process kernel network stack