Tag: Cilium
-
Use node initialization taints on Azure Kubernetes Service with Cilium
On an Azure Kubernetes Service cluster with Bring Your Own Container Network Interface (BYOCNI) using Cilium, you could not use Cilium’s agent-not-ready taint functionality. -> https://docs.cilium.io/en/stable/installation/taints/ The reason for that is that the Azure control plane blocks add/remove operations on taints via the Kubernetes API. You have to remove taints via the Azure Kubernetes Service…
-
Cilium’s new Hubble flow policy log field
Cilium in version 1.18 introduced a new useful feature called “policy log field” for Hubble flows. -> https://isovalent.com/blog/post/cilium-1-18/#hubble-flow-policy-log-field This feature provides additional possibilities for further insights/checks on which network policy was applied to a network flow. We have a look at how to configure the policy log field and what a Hubble flow looks like…
-
Restrict access to the IMDS endpoint on Azure Kubernetes Service with Cilium
In today’s blog post, we take a look at restricting access to the Azure IMDS endpoint on an Azure Kubernetes Service (AKS) cluster with Cilium using the BYOCNI approach. The Instance Metadata Service (IMDS) endpoint, also known as short IMDS, can be called directly from every Azure VM or VMSS instance via the following command.…
-
How to send Cilium metrics to Azure Managed Prometheus
In today’s blog post, I walk you through the setup on how to send Cilium metrics to Azure Managed Prometheus. Our setup covers two scenarios. The first one is an Azure Kubernetes Service cluster using Cilium via the BYOCNI (Bring Your Own CNI) option, and the second one is a K3s single node cluster running…
-
Provide additional metadata information to Cilium for IP addresses outside of the Kubernetes cluster scope
In Cilium, IP addresses that do not belong to the Pod CIDR or Kubernetes Service CIDR range, and some special ranges like the Kubernetes API server, are recognized as the reserved:world identity. So, to say they do not belong to the Kubernetes cluster scope, known to Cilium itself. -> https://docs.cilium.io/en/stable/gettingstarted/terminology/#special-identities When you start using DNS-based…
-
Using Hubble CLI’s automatic port forwarding
This will be a rather short blog post today, but it will highlight a new feature in the Hubble CLI in version 1.17 and later. Since version 1.17, the option -P has been added to the Hubble CLI. -P enables the automatic port forwarding to the Hubble relay in the Kubernetes cluster. As seen in…