-
Safe Cilium rollout with Cast Off
Before I explain what Cast Off is, I like to quickly explain where the idea came from. While reading the last chapter of “Cilium: Up and Running” from O’Reilly about “Operations”, it was discussed in the book to upgrade Cilium or replace the entire cluster to roll out a new Cilium version. -> https://www.oreilly.com/library/view/cilium-up-and/9798341622982/ Pros,…
-
Cilium’s IPsec performance on Azure Kubernetes Service BYOCNI
After looking at Cilium’s transparent encryption performance for WireGuard and ztunnel on Azure Kubernetes Service BYOCNI, we now look at IPsec. -> https://www.danielstechblog.io/an-experiment-enable-cilium-native-routing-on-azure-kubernetes-service-byocni-part-2/ -> https://www.danielstechblog.io/cilium-ztunnel-native-mtls-for-cilium-on-azure-kubernetes-service-byocni/ As in the tests before, the MTU has been left untouched. In other words, jumbo frames have not been used. Set up IPsec in Cilium Similar to the ztunnel encryption…
-
Cilium ztunnel – native mTLS for Cilium on Azure Kubernetes Service BYOCNI
At KubeCon Europe 2026, the Cilium project announced native mTLS support for Cilium via ztunnel. -> https://cilium.io/blog/2026/03/23/native-mtls-cilium/ Cilium’s ztunnel implementation is a fork of Istio’s ztunnel, reengineered to directly integrate it with the Cilium control plane and SPIRE as a certificate authority. Bringing ztunnel to Cilium is a joint effort by Isovalent and Microsoft. In…
-
Performance comparison Cilium native routing on Azure Kubernetes Service BYOCNI
As a follow-up on the series about Cilium native routing on Azure Kubernetes Service BYOCNI, we focus in today’s blog post on the performance comparison between the different configurations. -> https://www.danielstechblog.io/an-experiment-enable-cilium-native-routing-on-azure-kubernetes-service-byocni-part-1/ -> https://www.danielstechblog.io/an-experiment-enable-cilium-native-routing-on-azure-kubernetes-service-byocni-part-2/ -> https://www.danielstechblog.io/an-experiment-enable-cilium-native-routing-on-azure-kubernetes-service-byocni-part-3/ BYOCNI – Cilium VXLAN encapsulation BYOCNI – Cilium VXLAN encapsulation + WireGuard encryption BYOCNI – Cilium native routing + Wire…
-
An experiment – Enable Cilium native routing on Azure Kubernetes Service BYOCNI – Part 3
This is the third and final part of a three-part series about “An experiment – Enable Cilium native routing on Azure Kubernetes Service BYOCNI”. -> https://www.danielstechblog.io/an-experiment-enable-cilium-native-routing-on-azure-kubernetes-service-byocni-part-1/ -> https://www.danielstechblog.io/an-experiment-enable-cilium-native-routing-on-azure-kubernetes-service-byocni-part-2/ We will focus today on how to enable Cilium native routing with Azure Route Server and BGP on Azure Kubernetes Service BYOCNI. Azure Route Server Azure Route…
-
An experiment – Enable Cilium native routing on Azure Kubernetes Service BYOCNI – Part 2
This is the second part of a three-part series about “An experiment – Enable Cilium native routing on Azure Kubernetes Service BYOCNI”. -> https://www.danielstechblog.io/an-experiment-enable-cilium-native-routing-on-azure-kubernetes-service-byocni-part-1/ We will focus today on how to enable Cilium native routing with WireGuard Transparent Encryption on Azure Kubernetes Service BYOCNI. Enable Cilium native routing with WireGuard Transparent Encryption In this example,…