Add experimental Cilium CNI provider #760
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
dghubble
force-pushed
the
experimental-cilium-cni
branch
4 times, most recently
from
c01721b to
e6c7463
Compare
|
Fedora CoreOS 32 updates to systemd 245 which changes |
dghubble
force-pushed
the
experimental-cilium-cni
branch
2 times, most recently
from
a4cf528 to
29f914f
Compare
* Accept experimental CNI `networking` mode "cilium"
* Run Cilium v1.8.0-rc4 with overlay vxlan tunnels and a
minimal set of features. We're interested in:
* IPAM: Divide pod_cidr into /24 subnets per node
* CNI networking pod-to-pod, pod-to-external
* BPF masquerade
* NetworkPolicy as defined by Kubernetes (no L7 Policy)
* Continue using kube-proxy with Cilium probe mode
* Firewall changes:
* Require UDP 8472 for vxlan (Linux kernel default) between nodes
* Optional ICMP echo(8) between nodes for host reachability
(health)
* Optional TCP 4240 between nodes for endpoint reachability (health)
Known Issues:
* Containers with `hostPort` don't listen on all host addresses,
these workloads must use `hostNetwork` for now
cilium/cilium#12116
* Erroneous warning on Fedora CoreOS
cilium/cilium#10256
Note: This is experimental. It is not listed in docs and may be
changed or removed without a deprecation notice
Related:
* poseidon/terraform-render-bootstrap#192
* cilium/cilium#12217
dghubble
force-pushed
the
experimental-cilium-cni
branch
from
29f914f to
e9c8520
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
networkingmode "cilium"Known Issues:
hostPortdon't listen on all host addresses, these workloads must usehostNetworkfor now Cilium native hostport only listens on a internal IP, unlike CNI portmap cilium/cilium#12116Enable by setting
networking = "cilium"Warning: This is experimental. It is not listed in docs and may be changed or removed without a deprecation notice
Related: