README
¶
.. raw:: html
<picture>
<source media="(prefers-color-scheme: light)" srcset="https://cdn.jsdelivr.net/gh/cilium/cilium@main/Documentation/images/logo.png" width="350" alt="Cilium Logo">
<img src="https://cdn.jsdelivr.net/gh/cilium/cilium@main/Documentation/images/logo-dark.png" width="350" alt="Cilium Logo">
</picture>
|cii| |go-report| |clomonitor| |artifacthub| |slack| |go-doc| |rtd| |apache| |bsd| |gpl| |fossa| |gateway-api| |codespaces|
Cilium is a networking, observability, and security solution with an eBPF-based
dataplane. It provides a simple flat Layer 3 network with the ability to span
multiple clusters in either a native routing or overlay mode. It is L7-protocol
aware and can enforce network policies on L3-L7 using an identity based security
model that is decoupled from network addressing.
Cilium implements distributed load balancing for traffic between pods and to
external services, and is able to fully replace kube-proxy, using efficient
hash tables in eBPF allowing for almost unlimited scale. It also supports
advanced functionality like integrated ingress and egress gateway, bandwidth
management and service mesh, and provides deep network and security visibility and monitoring.
A new Linux kernel technology called eBPF_ is at the foundation of Cilium. It
supports dynamic insertion of eBPF bytecode into the Linux kernel at various
integration points such as: network IO, application sockets, and tracepoints to
implement security, networking and visibility logic. eBPF is highly efficient
and flexible. To learn more about eBPF, visit `eBPF.io`_.
.. image:: Documentation/images/cilium-overview.png
:alt: Overview of Cilium features for networking, observability, service mesh, and runtime security
Stable Releases
===============
The Cilium community maintains minor stable releases for the last three minor
Cilium versions. Older Cilium stable versions from minor releases prior to that
are considered EOL.
For upgrades to new minor releases please consult the `Cilium Upgrade Guide`_.
Listed below are the actively maintained release branches along with their latest
patch release, corresponding image pull tags and their release notes:
+---------------------------------------------------------+------------+------------------------------------+----------------------------------------------------------------------------+
| `v1.16 <https://github.com/cilium/cilium/tree/v1.16>`__ | 2024-08-13 | ``quay.io/cilium/cilium:v1.16.1`` | `Release Notes <https://github.com/cilium/cilium/releases/tag/v1.16.1>`__ |
+---------------------------------------------------------+------------+------------------------------------+----------------------------------------------------------------------------+
| `v1.15 <https://github.com/cilium/cilium/tree/v1.15>`__ | 2024-08-12 | ``quay.io/cilium/cilium:v1.15.8`` | `Release Notes <https://github.com/cilium/cilium/releases/tag/v1.15.8>`__ |
+---------------------------------------------------------+------------+------------------------------------+----------------------------------------------------------------------------+
| `v1.14 <https://github.com/cilium/cilium/tree/v1.14>`__ | 2024-08-12 | ``quay.io/cilium/cilium:v1.14.14`` | `Release Notes <https://github.com/cilium/cilium/releases/tag/v1.14.14>`__ |
+---------------------------------------------------------+------------+------------------------------------+----------------------------------------------------------------------------+
Architectures
-------------
Cilium images are distributed for AMD64 and AArch64 architectures.
Software Bill of Materials
--------------------------
Starting with Cilium version 1.13.0, all images include a Software Bill of
Materials (SBOM). The SBOM is generated in `SPDX`_ format. More information
on this is available on `Cilium SBOM`_.
.. _`SPDX`: https://spdx.dev/
.. _`Cilium SBOM`: https://docs.cilium.io/en/latest/configuration/sbom/
Development
===========
For development and testing purpose, the Cilium community publishes snapshots,
early release candidates (RC) and CI container images build from the `main
branch <https://github.com/cilium/cilium/commits/main>`_. These images are
not for use in production.
For testing upgrades to new development releases please consult the latest
development build of the `Cilium Upgrade Guide`_.
Listed below are branches for testing along with their snapshots or RC releases,
corresponding image pull tags and their release notes where applicable:
+--------------------------------------------------------------------------------------+------------+----------------------------------------------+-------------------------------------------------------------------------------------------+
| `main <https://github.com/cilium/cilium/commits/main>`__ | daily | ``quay.io/cilium/cilium-ci:latest`` | N/A |
+--------------------------------------------------------------------------------------+------------+----------------------------------------------+-------------------------------------------------------------------------------------------+
| `v1.16.0-rc.2 <https://github.com/cilium/cilium/commits/v1.16.0-rc.2>`__ | 2024-07-15 | ``quay.io/cilium/cilium:v1.16.0-rc.2`` | `Release Candidate Notes <https://github.com/cilium/cilium/releases/tag/v1.16.0-rc.2>`__ |
+--------------------------------------------------------------------------------------+------------+----------------------------------------------+-------------------------------------------------------------------------------------------+
Functionality Overview
======================
.. begin-functionality-overview
Protect and secure APIs transparently
-------------------------------------
Ability to secure modern application protocols such as REST/HTTP, gRPC and
Kafka. Traditional firewalls operate at Layer 3 and 4. A protocol running on a
particular port is either completely trusted or blocked entirely. Cilium
provides the ability to filter on individual application protocol requests such
as:
- Allow all HTTP requests with method ``GET`` and path ``/public/.*``. Deny all
other requests.
- Allow ``service1`` to produce on Kafka topic ``topic1`` and ``service2`` to
consume on ``topic1``. Reject all other Kafka messages.
- Require the HTTP header ``X-Token: [0-9]+`` to be present in all REST calls.
See the section `Layer 7 Policy`_ in our documentation for the latest list of
supported protocols and examples on how to use it.
Secure service to service communication based on identities
-----------------------------------------------------------
Modern distributed applications rely on technologies such as application
containers to facilitate agility in deployment and scale out on demand. This
results in a large number of application containers being started in a short
period of time. Typical container firewalls secure workloads by filtering on
source IP addresses and destination ports. This concept requires the firewalls
on all servers to be manipulated whenever a container is started anywhere in
the cluster.
In order to avoid this situation which limits scale, Cilium assigns a security
identity to groups of application containers which share identical security
policies. The identity is then associated with all network packets emitted by
the application containers, allowing to validate the identity at the receiving
node. Security identity management is performed using a key-value store.
Secure access to and from external services
-------------------------------------------
Label based security is the tool of choice for cluster internal access control.
In order to secure access to and from external services, traditional CIDR based
security policies for both ingress and egress are supported. This allows to
limit access to and from application containers to particular IP ranges.
Simple Networking
-----------------
A simple flat Layer 3 network with the ability to span multiple clusters
connects all application containers. IP allocation is kept simple by using host
scope allocators. This means that each host can allocate IPs without any
coordination between hosts.
The following multi node networking models are supported:
* **Overlay:** Encapsulation-based virtual network spanning all hosts.
Currently, VXLAN and Geneve are baked in but all encapsulation formats
supported by Linux can be enabled.
When to use this mode: This mode has minimal infrastructure and integration
requirements. It works on almost any network infrastructure as the only
requirement is IP connectivity between hosts which is typically already
given.
* **Native Routing:** Use of the regular routing table of the Linux host.
The network is required to be capable to route the IP addresses of the
application containers.
When to use this mode: This mode is for advanced users and requires some
awareness of the underlying networking infrastructure. This mode works well
with:
- Native IPv6 networks
- In conjunction with cloud network routers
- If you are already running routing daemons
Load Balancing
--------------
Cilium implements distributed load balancing for traffic between application
containers and to external services and is able to fully replace components
such as kube-proxy. The load balancing is implemented in eBPF using efficient
hashtables allowing for almost unlimited scale.
For north-south type load balancing, Cilium's eBPF implementation is optimized
for maximum performance, can be attached to XDP (eXpress Data Path), and supports
direct server return (DSR) as well as Maglev consistent hashing if the load
balancing operation is not performed on the source host.
For east-west type load balancing, Cilium performs efficient service-to-backend
translation right in the Linux kernel's socket layer (e.g. at TCP connect time)
such that per-packet NAT operations overhead can be avoided in lower layers.
Bandwidth Management
--------------------
Cilium implements bandwidth management through efficient EDT-based (Earliest Departure
Time) rate-limiting with eBPF for container traffic that is egressing a node. This
allows to significantly reduce transmission tail latencies for applications and to
avoid locking under multi-queue NICs compared to traditional approaches such as HTB
(Hierarchy Token Bucket) or TBF (Token Bucket Filter) as used in the bandwidth CNI
plugin, for example.
Monitoring and Troubleshooting
------------------------------
The ability to gain visibility and troubleshoot issues is fundamental to the
operation of any distributed system. While we learned to love tools like
``tcpdump`` and ``ping`` and while they will always find a special place in our
hearts, we strive to provide better tooling for troubleshooting. This includes
tooling to provide:
- Event monitoring with metadata: When a packet is dropped, the tool doesn't
just report the source and destination IP of the packet, the tool provides
the full label information of both the sender and receiver among a lot of
other information.
- Metrics export via Prometheus: Key metrics are exported via Prometheus for
integration with your existing dashboards.
- Hubble_: An observability platform specifically written for Cilium. It
provides service dependency maps, operational monitoring and alerting,
and application and security visibility based on flow logs.
.. _Hubble: https://github.com/cilium/hubble/
.. _`Layer 7 Policy`: https://docs.cilium.io/en/stable/security/policy/language/#layer-7-examples
.. end-functionality-overview
Getting Started
===============
* `Why Cilium?`_
* `Getting Started`_
* `Architecture and Concepts`_
* `Installing Cilium`_
* `Frequently Asked Questions`_
* Contributing_
What is eBPF and XDP?
=====================
Berkeley Packet Filter (BPF) is a Linux kernel bytecode interpreter originally
introduced to filter network packets, e.g. for tcpdump and socket filters. The
BPF instruction set and surrounding architecture have recently been
significantly reworked with additional data structures such as hash tables and
arrays for keeping state as well as additional actions to support packet
mangling, forwarding, encapsulation, etc. Furthermore, a compiler back end for
LLVM allows for programs to be written in C and compiled into BPF instructions.
An in-kernel verifier ensures that BPF programs are safe to run and a JIT
compiler converts the BPF bytecode to CPU architecture-specific instructions
for native execution efficiency. BPF programs can be run at various hooking
points in the kernel such as for incoming packets, outgoing packets, system
calls, kprobes, uprobes, tracepoints, etc.
BPF continues to evolve and gain additional capabilities with each new Linux
release. Cilium leverages BPF to perform core data path filtering, mangling,
monitoring and redirection, and requires BPF capabilities that are in any Linux
kernel version 4.8.0 or newer (the latest current stable Linux kernel is
4.14.x).
Many Linux distributions including CoreOS, Debian, Docker's LinuxKit, Fedora,
openSUSE and Ubuntu already ship kernel versions >= 4.8.x. You can check your Linux
kernel version by running ``uname -a``. If you are not yet running a recent
enough kernel, check the Documentation of your Linux distribution on how to run
Linux kernel 4.9.x or later.
To read up on the necessary kernel versions to run the BPF runtime, see the
section Prerequisites_.
.. image:: https://cdn.jsdelivr.net/gh/cilium/cilium@main/Documentation/images/bpf-overview.png
:align: center
XDP is a further step in evolution and enables running a specific flavor of BPF
programs from the network driver with direct access to the packet's DMA buffer.
This is, by definition, the earliest possible point in the software stack,
where programs can be attached to in order to allow for a programmable, high
performance packet processor in the Linux kernel networking data path.
Further information about BPF and XDP targeted for developers can be found in
the `BPF and XDP Reference Guide`_.
To know more about Cilium, its extensions and use cases around Cilium and BPF
take a look at `Further Readings <FURTHER_READINGS.rst>`_ section.
Community
=========
Slack
-----
Join the Cilium `Slack channel <https://slack.cilium.io>`_ to chat with
Cilium developers and other Cilium users. This is a good place to learn about
Cilium, ask questions, and share your experiences.
Special Interest Groups (SIG)
-----------------------------
See `Special Interest groups
<https://docs.cilium.io/en/stable/community/community/#special-interest-groups>`_ for a list of all SIGs and their meeting times.
Developer meetings
------------------
The Cilium developer community hangs out on Zoom to chat. Everybody is welcome.
* Weekly, Wednesday,
5:00 pm `Europe/Zurich time <https://time.is/Canton_of_Zurich>`__ (CET/CEST),
usually equivalent to 8:00 am PT, or 11:00 am ET. `Join Zoom`_
* Third Wednesday of each month, 9:00 am `Japan time <https://time.is/Tokyo>`__ (JST). `Join Zoom`_
eBPF & Cilium Office Hours livestream
-------------------------------------
We host a weekly community `YouTube livestream called eCHO <https://www.youtube.com/channel/UCJFUxkVQTBJh3LD1wYBWvuQ>`_ which (very loosely!) stands for eBPF & Cilium Office Hours. Join us live, catch up with past episodes, or head over to the `eCHO repo <https://github.com/isovalent/eCHO>`_ and let us know your ideas for topics we should cover.
Governance
----------
The Cilium project is governed by a group of `Maintainers and Committers <https://raw.githubusercontent.com/cilium/cilium/main/MAINTAINERS.md>`__.
How they are selected and govern is outlined in our `governance document <https://github.com/cilium/community/blob/main/GOVERNANCE.md>`__.
Adopters
--------
A list of adopters of the Cilium project who are deploying it in production, and of their use cases,
can be found in file `USERS.md <https://github.com/cilium/cilium/blob/main/USERS.md>`__.
Roadmap
-------
Cilium maintains a `public roadmap <https://docs.cilium.io/en/latest/community/roadmap/>`__. It gives a high-level view of the main priorities for the project, the maturity of different features and projects, and how to influence the project direction.
License
=======
.. _apache-license: LICENSE
.. _bsd-license: bpf/LICENSE.BSD-2-Clause
.. _gpl-license: bpf/LICENSE.GPL-2.0
The Cilium user space components are licensed under the
`Apache License, Version 2.0 <apache-license_>`__.
The BPF code templates are dual-licensed under the
`General Public License, Version 2.0 (only) <gpl-license_>`__
and the `2-Clause BSD License <bsd-license_>`__
(you can use the terms of either license, at your option).
.. _`Cilium Upgrade Guide`: https://docs.cilium.io/en/stable/operations/upgrade/
.. _`Why Cilium?`: https://docs.cilium.io/en/stable/overview/intro
.. _`Getting Started`: https://docs.cilium.io/en/stable/#getting-started
.. _`Architecture and Concepts`: https://docs.cilium.io/en/stable/overview/component-overview/
.. _`Installing Cilium`: https://docs.cilium.io/en/stable/gettingstarted/k8s-install-default/
.. _`Frequently Asked Questions`: https://github.com/cilium/cilium/issues?utf8=%E2%9C%93&q=is%3Aissue+label%3Akind%2Fquestion+
.. _Contributing: https://docs.cilium.io/en/stable/contributing/development/
.. _Prerequisites: https://docs.cilium.io/en/stable/operations/system_requirements/
.. _`BPF and XDP Reference Guide`: https://docs.cilium.io/en/stable/bpf/
.. _`eBPF`: https://ebpf.io
.. _`eBPF.io`: https://ebpf.io
.. _`Join Zoom`: https://zoom.us/j/596609673
.. |go-report| image:: https://goreportcard.com/badge/github.com/cilium/cilium
:alt: Go Report Card
:target: https://goreportcard.com/report/github.com/cilium/cilium
.. |go-doc| image:: https://godoc.org/github.com/cilium/cilium?status.svg
:alt: GoDoc
:target: https://godoc.org/github.com/cilium/cilium
.. |rtd| image:: https://readthedocs.org/projects/docs/badge/?version=latest
:alt: Read the Docs
:target: https://docs.cilium.io/
.. |apache| image:: https://img.shields.io/badge/license-Apache-blue.svg
:alt: Apache licensed
:target: apache-license_
.. |bsd| image:: https://img.shields.io/badge/license-BSD-blue.svg
:alt: BSD licensed
:target: bsd-license_
.. |gpl| image:: https://img.shields.io/badge/license-GPL-blue.svg
:alt: GPL licensed
:target: gpl-license_
.. |slack| image:: https://img.shields.io/badge/slack-cilium-brightgreen.svg?logo=slack
:alt: Join the Cilium slack channel
:target: https://slack.cilium.io
.. |cii| image:: https://bestpractices.coreinfrastructure.org/projects/1269/badge
:alt: CII Best Practices
:target: https://bestpractices.coreinfrastructure.org/projects/1269
.. |clomonitor| image:: https://img.shields.io/endpoint?url=https://clomonitor.io/api/projects/cncf/cilium/badge
:alt: CLOMonitor
:target: https://clomonitor.io/projects/cncf/cilium
.. |artifacthub| image:: https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/cilium
:alt: Artifact Hub
:target: https://artifacthub.io/packages/helm/cilium/cilium
.. |fossa| image:: https://app.fossa.com/api/projects/custom%2B162%2Fgit%40github.com%3Acilium%2Fcilium.git.svg?type=shield
:alt: FOSSA Status
:target: https://app.fossa.com/projects/custom%2B162%2Fgit%40github.com%3Acilium%2Fcilium.git?ref=badge_shield
.. |gateway-api| image:: https://img.shields.io/badge/Gateway%20API%20Conformance%20v1.0.0-Cilium-green
:alt: Gateway API Status
:target: https://github.com/kubernetes-sigs/gateway-api/blob/main/conformance/reports/v1.0.0/cilium.yaml
.. |codespaces| image:: https://img.shields.io/badge/Open_in_GitHub_Codespaces-gray?logo=github
:alt: Github Codespaces
:target: https://github.com/codespaces/new?hide_repo_select=true&ref=master&repo=48109239&machine=standardLinux32gb&location=WestEurope
Directories
¶
| Path | Synopsis |
|---|---|
|
api
|
|
|
v1/health/server
Package server Cilium-Health API
|
Package server Cilium-Health API |
|
v1/kvstoremesh/server
Package server KvstoreMesh
|
Package server KvstoreMesh |
|
v1/models
Package models defines all models to be used in the Cilium API.
|
Package models defines all models to be used in the Cilium API. |
|
v1/operator/server
Package server Cilium Operator
|
Package server Cilium Operator |
|
v1/server
Package server Cilium API
|
Package server Cilium API |
|
bpf
|
|
|
cilium-cli
|
|
|
k8s
Package k8s provides various helper functions for interacting with Kubernetes APIs.
|
Package k8s provides various helper functions for interacting with Kubernetes APIs. |
|
k8s
Package k8s abstracts all Kubernetes specific behaviour
|
Package k8s abstracts all Kubernetes specific behaviour |
|
cmd/common
Package common implements utilities that are meant to be used commonly by all sub-commands to ensure consistency across them.
|
Package common implements utilities that are meant to be used commonly by all sub-commands to ensure consistency across them. |
|
cmd/common/validate
Package validate implements utilities to validate the command configuration by, for example, validating a set of given options.
|
Package validate implements utilities to validate the command configuration by, for example, validating a set of given options. |
|
images
|
|
|
auth
Package auth provides routines to manage mutual authentication identities in Cilium.
|
Package auth provides routines to manage mutual authentication identities in Cilium. |
|
doublewrite
SPDX-License-Identifier: Apache-2.0 Copyright Authors of Cilium
|
SPDX-License-Identifier: Apache-2.0 Copyright Authors of Cilium |
|
pkg/ciliumendpointslice/testutils
SPDX-License-Identifier: Apache-2.0 Copyright Authors of Cilium
|
SPDX-License-Identifier: Apache-2.0 Copyright Authors of Cilium |
|
pkg/ciliumenvoyconfig
Package service contains the logic for Cilium Load Balancer Controller via envoy config
|
Package service contains the logic for Cilium Load Balancer Controller via envoy config |
|
pkg/ingress
Package ingress contains all the logic for Cilium Ingress Controller.
|
Package ingress contains all the logic for Cilium Ingress Controller. |
|
pkg/ingress/annotations
Package annotations contains all annotations that supported by cilium ingress controller along with some sensible defaults.
|
Package annotations contains all annotations that supported by cilium ingress controller along with some sensible defaults. |
|
pkg/model
Package model contains a data model for translations from upstream Kubernetes resources to Cilium Kubernetes resources.
|
Package model contains a data model for translations from upstream Kubernetes resources to Cilium Kubernetes resources. |
|
pkg/model/ingestion
Package ingestion holds functions that translate from Kubernetes resources into Listener types for storage in the model.
|
Package ingestion holds functions that translate from Kubernetes resources into Listener types for storage in the model. |
|
pkg/model/translation
Package translation building block for translation from model to CiliumEnvoyConfig, Service, etc.
|
Package translation building block for translation from model to CiliumEnvoyConfig, Service, etc. |
|
pkg/model/translation/ingress
Package ingress contains the translation logic from Ingress to CiliumEnvoyConfig and related resources.
|
Package ingress contains the translation logic from Ingress to CiliumEnvoyConfig and related resources. |
|
pkg
|
|
|
alibabacloud/eni/types
Package types provides Alibaba Cloud specific types
|
Package types provides Alibaba Cloud specific types |
|
alignchecker
Package alignchecker provides routines to check Go and C struct alignments
|
Package alignchecker provides routines to check Go and C struct alignments |
|
allocator
Package allocator provides a kvstore based ID allocator
|
Package allocator provides a kvstore based ID allocator |
|
api
Package api provides the Cilium useful helpers for the external API
|
Package api provides the Cilium useful helpers for the external API |
|
aws/eni
Package eni implements AWS ENI allocation logic
|
Package eni implements AWS ENI allocation logic |
|
azure/ipam
Package ipam implements Azure IPAM logic
|
Package ipam implements Azure IPAM logic |
|
azure/types
+groupName=azure
|
+groupName=azure |
|
bgp/config
Package config provides BGP configuration logic.
|
Package config provides BGP configuration logic. |
|
bgp/k8s
Package k8s provides a Kubernetes client to be used with MetalLB integration.
|
Package k8s provides a Kubernetes client to be used with MetalLB integration. |
|
bgp/log
Package log provides a central logging package that wraps MetalLB's logging.
|
Package log provides a central logging package that wraps MetalLB's logging. |
|
bgp/manager
Package manager provides functionality relating to the integration between Cilium and MetalLB, namely providing abstractions that help manage MetalLB from Cilium.
|
Package manager provides functionality relating to the integration between Cilium and MetalLB, namely providing abstractions that help manage MetalLB from Cilium. |
|
bgp/speaker
Package speaker abstracts the BGP speaker controller from MetalLB.
|
Package speaker abstracts the BGP speaker controller from MetalLB. |
|
bgpv1/agent/signaler
SPDX-License-Identifier: Apache-2.0 Copyright Authors of Cilium
|
SPDX-License-Identifier: Apache-2.0 Copyright Authors of Cilium |
|
bpf
Package bpf provides functions that allow golang programs to interact with bpf maps.
|
Package bpf provides functions that allow golang programs to interact with bpf maps. |
|
byteorder
Package byteorder provides functions to convert from and to network byte order.
|
Package byteorder provides functions to convert from and to network byte order. |
|
command/exec
Package exec provides useful wrappers around the standard "exec" library.
|
Package exec provides useful wrappers around the standard "exec" library. |
|
completion
Package completion implements a variant of sync.WaitGroup that is associated with a context.Context.
|
Package completion implements a variant of sync.WaitGroup that is associated with a context.Context. |
|
controller
Package controller provide a simple pattern for async operations that require retries and/or regular intervals.
|
Package controller provide a simple pattern for async operations that require retries and/or regular intervals. |
|
counter
Package counter provides generic reference counter objects
|
Package counter provides generic reference counter objects |
|
crypto/certloader
package certloader aim to provide a facility to ease dynamic tls.Config handling.
|
package certloader aim to provide a facility to ease dynamic tls.Config handling. |
|
datapath
Package datapath defines the interfaces to abstract all platform specific datapath components.
|
Package datapath defines the interfaces to abstract all platform specific datapath components. |
|
datapath/alignchecker
Package alignchecker is a thin wrapper around pkg/alignchecker to validate datapath object alignment.
|
Package alignchecker is a thin wrapper around pkg/alignchecker to validate datapath object alignment. |
|
datapath/connector
Package connector is responsible for the datapath specific plumbing to connect an endpoint to the network
|
Package connector is responsible for the datapath specific plumbing to connect an endpoint to the network |
|
datapath/fake
Package fake is a fake datapath implementation.
|
Package fake is a fake datapath implementation. |
|
datapath/ipcache
Package ipcache provides a BPF datapath implementation of the IPCache store.
|
Package ipcache provides a BPF datapath implementation of the IPCache store. |
|
datapath/iptables
Package iptables manages iptables-related configuration for Cilium.
|
Package iptables manages iptables-related configuration for Cilium. |
|
datapath/link
Package link provides the Cilium specific abstraction and useful helpers to manage network interfaces
|
Package link provides the Cilium specific abstraction and useful helpers to manage network interfaces |
|
datapath/linux
Package linux implements the Linux specific datapath implementation
|
Package linux implements the Linux specific datapath implementation |
|
datapath/linux/bandwidth
Package bandwidth provides efficient EDT-based rate-limiting.
|
Package bandwidth provides efficient EDT-based rate-limiting. |
|
datapath/linux/bigtcp
Package bigtcp provides helpers to probe and enable BIG TCP for the Linux datapath
|
Package bigtcp provides helpers to probe and enable BIG TCP for the Linux datapath |
|
datapath/linux/ipsec
Package ipsec provides the Linux datapath specific abstraction and useful helpers to manage IPSec via Linux xfrm.
|
Package ipsec provides the Linux datapath specific abstraction and useful helpers to manage IPSec via Linux xfrm. |
|
datapath/linux/linux_defaults
Package linux_defaults provides the Linux datapath defaults
|
Package linux_defaults provides the Linux datapath defaults |
|
datapath/linux/modules
Package modules contains a manager of loaded modules which supports search operation.
|
Package modules contains a manager of loaded modules which supports search operation. |
|
datapath/linux/probes
Package probes provides BPF features checks based on bpftool.
|
Package probes provides BPF features checks based on bpftool. |
|
datapath/linux/route
Package route provides the Cilium specific abstraction and useful helpers to manage network routes
|
Package route provides the Cilium specific abstraction and useful helpers to manage network routes |
|
datapath/linux/sysctl
Package sysctl allows to change kernel parameters at runtime.
|
Package sysctl allows to change kernel parameters at runtime. |
|
datapath/linux/utime
Package utime converts between time.Time and Unix Epoch time in 512ns time unit.
|
Package utime converts between time.Time and Unix Epoch time in 512ns time unit. |
|
datapath/loader
Package loader provides accessors to compilation and BPF load routines necessary for creating datapath objects and attaching them to links.
|
Package loader provides accessors to compilation and BPF load routines necessary for creating datapath objects and attaching them to links. |
|
datapath/maps
Package maps performs various lifecycle operations related to maps in the datapath.
|
Package maps performs various lifecycle operations related to maps in the datapath. |
|
datapath/prefilter
Package prefilter provides a means of configuring XDP pre-filters for DDoS-mitigation.
|
Package prefilter provides a means of configuring XDP pre-filters for DDoS-mitigation. |
|
ebpf
Package ebpf provides functions that allow golang programs to interact with ebpf maps by wrapping the cilium/ebpf library.
|
Package ebpf provides functions that allow golang programs to interact with ebpf maps by wrapping the cilium/ebpf library. |
|
egressgateway
Package egressgateway defines an internal representation of the Cilium Egress Policy.
|
Package egressgateway defines an internal representation of the Cilium Egress Policy. |
|
endpointmanager
Package endpointmanager manages the list of all local endpoints
|
Package endpointmanager manages the list of all local endpoints |
|
envoy/xds
Package xds is an implementation of Envoy's xDS (Discovery Service) protocol.
|
Package xds is an implementation of Envoy's xDS (Discovery Service) protocol. |
|
eventqueue
Package eventqueue implements a queue-based system for event processing in a generic fashion in a first-in, first-out manner.
|
Package eventqueue implements a queue-based system for event processing in a generic fashion in a first-in, first-out manner. |
|
fqdn
Package fqdn handles some of the DNS-based policy functions:
|
Package fqdn handles some of the DNS-based policy functions: |
|
fqdn/re
Package re provides a simple function to access compile regex objects for the FQDN subsystem.
|
Package re provides a simple function to access compile regex objects for the FQDN subsystem. |
|
fqdn/restore
The restore package provides data structures important to restoring DNS proxy rules.
|
The restore package provides data structures important to restoring DNS proxy rules. |
|
identity
Package identity contains code for managing security identities in Cilium.
|
Package identity contains code for managing security identities in Cilium. |
|
identity/identitymanager
Package identitymanager tracks which global identities are being used by the currently running cilium-agent
|
Package identitymanager tracks which global identities are being used by the currently running cilium-agent |
|
ip
Package ip is a library for performing manipulations on IPv4 and IPv6 addresses and CIDR prefixes.
|
Package ip is a library for performing manipulations on IPv4 and IPv6 addresses and CIDR prefixes. |
|
ipam
Package ipam handles address allocation management
|
Package ipam handles address allocation management |
|
ipam/types
+groupName=ipam
|
+groupName=ipam |
|
ipcache
Package ipcache provides a local cache of the mapping of IPs of endpoints managed by Cilium to their corresponding security identities.
|
Package ipcache provides a local cache of the mapping of IPs of endpoints managed by Cilium to their corresponding security identities. |
|
k8s
Package k8s contains all k8s related logic.
|
Package k8s contains all k8s related logic. |
|
k8s/apis/cilium.io/v2
Package v2 is the v2 version of the API.
|
Package v2 is the v2 version of the API. |
|
k8s/apis/cilium.io/v2alpha1
Package v2alpha1 is the v2alpha1 version of the API.
|
Package v2alpha1 is the v2alpha1 version of the API. |
|
k8s/client/clientset/versioned/fake
This package has the automatically generated fake clientset.
|
This package has the automatically generated fake clientset. |
|
k8s/client/clientset/versioned/scheme
This package contains the scheme of the automatically generated clientset.
|
This package contains the scheme of the automatically generated clientset. |
|
k8s/client/clientset/versioned/typed/cilium.io/v2
This package has the automatically generated typed clients.
|
This package has the automatically generated typed clients. |
|
k8s/client/clientset/versioned/typed/cilium.io/v2/fake
Package fake has the automatically generated clients.
|
Package fake has the automatically generated clients. |
|
k8s/client/clientset/versioned/typed/cilium.io/v2alpha1
This package has the automatically generated typed clients.
|
This package has the automatically generated typed clients. |
|
k8s/client/clientset/versioned/typed/cilium.io/v2alpha1/fake
Package fake has the automatically generated clients.
|
Package fake has the automatically generated clients. |
|
k8s/slim/k8s/api/core/v1
Package v1 is the v1 version of the core API.
|
Package v1 is the v1 version of the core API. |
|
k8s/slim/k8s/api/discovery/v1
Package v1 contains slimmer versions of k8s discovery types.
|
Package v1 contains slimmer versions of k8s discovery types. |
|
k8s/slim/k8s/api/discovery/v1beta1
Package v1beta1 contains slimmer versions of k8s discovery types.
|
Package v1beta1 contains slimmer versions of k8s discovery types. |
|
k8s/slim/k8s/api/networking/v1
Package v1 contains slimmer versions of k8s networking types.
|
Package v1 contains slimmer versions of k8s networking types. |
|
k8s/slim/k8s/apiextensions-client/clientset/versioned/fake
This package has the automatically generated fake clientset.
|
This package has the automatically generated fake clientset. |
|
k8s/slim/k8s/apiextensions-client/clientset/versioned/scheme
This package contains the scheme of the automatically generated clientset.
|
This package contains the scheme of the automatically generated clientset. |
|
k8s/slim/k8s/apiextensions-client/clientset/versioned/typed/apiextensions/v1
This package has the automatically generated typed clients.
|
This package has the automatically generated typed clients. |
|
k8s/slim/k8s/apiextensions-client/clientset/versioned/typed/apiextensions/v1/fake
Package fake has the automatically generated clients.
|
Package fake has the automatically generated clients. |
|
k8s/slim/k8s/apis/apiextensions/v1
Package v1 is the v1 version of the API.
|
Package v1 is the v1 version of the API. |
|
k8s/slim/k8s/apis/labels
Package labels implements a simple label system, parsing and matching selectors with sets of labels.
|
Package labels implements a simple label system, parsing and matching selectors with sets of labels. |
|
k8s/slim/k8s/apis/meta/v1
Package types contains slimmer versions of k8s types.
|
Package types contains slimmer versions of k8s types. |
|
k8s/slim/k8s/apis/meta/v1beta1
package v1beta1 is alpha objects from meta that will be introduced.
|
package v1beta1 is alpha objects from meta that will be introduced. |
|
k8s/slim/k8s/apis/util/intstr
Package types contains slimmer versions of k8s types.
|
Package types contains slimmer versions of k8s types. |
|
k8s/slim/k8s/client/clientset/versioned/fake
This package has the automatically generated fake clientset.
|
This package has the automatically generated fake clientset. |
|
k8s/slim/k8s/client/clientset/versioned/scheme
This package contains the scheme of the automatically generated clientset.
|
This package contains the scheme of the automatically generated clientset. |
|
k8s/slim/k8s/client/clientset/versioned/typed/core/v1
This package has the automatically generated typed clients.
|
This package has the automatically generated typed clients. |
|
k8s/slim/k8s/client/clientset/versioned/typed/core/v1/fake
Package fake has the automatically generated clients.
|
Package fake has the automatically generated clients. |
|
k8s/slim/k8s/client/clientset/versioned/typed/discovery/v1
This package has the automatically generated typed clients.
|
This package has the automatically generated typed clients. |
|
k8s/slim/k8s/client/clientset/versioned/typed/discovery/v1/fake
Package fake has the automatically generated clients.
|
Package fake has the automatically generated clients. |
|
k8s/slim/k8s/client/clientset/versioned/typed/discovery/v1beta1
This package has the automatically generated typed clients.
|
This package has the automatically generated typed clients. |
|
k8s/slim/k8s/client/clientset/versioned/typed/discovery/v1beta1/fake
Package fake has the automatically generated clients.
|
Package fake has the automatically generated clients. |
|
k8s/slim/k8s/client/clientset/versioned/typed/networking/v1
This package has the automatically generated typed clients.
|
This package has the automatically generated typed clients. |
|
k8s/slim/k8s/client/clientset/versioned/typed/networking/v1/fake
Package fake has the automatically generated clients.
|
Package fake has the automatically generated clients. |
|
k8s/synced
Package synced provides tools for tracking if k8s resources have been initially sychronized with the k8s apiserver.
|
Package synced provides tools for tracking if k8s resources have been initially sychronized with the k8s apiserver. |
|
k8s/types
Package types contains slimmer versions of k8s types.
|
Package types contains slimmer versions of k8s types. |
|
k8s/version
Package version keeps track of the Kubernetes version the client is connected to
|
Package version keeps track of the Kubernetes version the client is connected to |
|
k8s/watchers/resources
This package contains exported resource identifiers and metric resource labels related to K8s watchers.
|
This package contains exported resource identifiers and metric resource labels related to K8s watchers. |
|
k8s/watchers/subscriber
Package subscriber implements a mechanism to represent K8s watcher subscribers and allows K8s events to objects / resources to notify their respective subscribers.
|
Package subscriber implements a mechanism to represent K8s watcher subscribers and allows K8s events to objects / resources to notify their respective subscribers. |
|
kvstore
Package kvstore abstracts KVstore access and provides a high level API to atomically manage cluster wide resources
|
Package kvstore abstracts KVstore access and provides a high level API to atomically manage cluster wide resources |
|
kvstore/allocator
Package allocator provides a kvstore based ID allocator
|
Package allocator provides a kvstore based ID allocator |
|
kvstore/allocator/doublewrite
SPDX-License-Identifier: Apache-2.0 Copyright Authors of Cilium
|
SPDX-License-Identifier: Apache-2.0 Copyright Authors of Cilium |
|
kvstore/store
Package store implements a shared store backed by a kvstore or similar with the following properties:
|
Package store implements a shared store backed by a kvstore or similar with the following properties: |
|
labels
Package api defines the API of the Cilium network policy interface
|
Package api defines the API of the Cilium network policy interface |
|
loadbalancer
Package loadbalancer contains all logic related with the loadbalancer +groupName=pkg
|
Package loadbalancer contains all logic related with the loadbalancer +groupName=pkg |
|
loadbalancer/experimental
Package experimental contains a new experimental load-balancer control-plane based on StateDB.
|
Package experimental contains a new experimental load-balancer control-plane based on StateDB. |
|
loadinfo
Package loadinfo provides the ability to log system load information either at a particular time or periodically in the background
|
Package loadinfo provides the ability to log system load information either at a particular time or periodically in the background |
|
lock/lockfile
SPDX-License-Identifier: Apache-2.0 Copyright Authors of Cilium
|
SPDX-License-Identifier: Apache-2.0 Copyright Authors of Cilium |
|
logging/logfields
Package logfields defines common logging fields which are used across packages
|
Package logfields defines common logging fields which are used across packages |
|
maps/authmap
Package auth represents the BPF map used to keep track of authentication state between security identities.
|
Package auth represents the BPF map used to keep track of authentication state between security identities. |
|
maps/bwmap
Package bwmap represents the BPF map used to enforce Pod bandwidth limitations via EDT (Earliest Departure Time) + BPF.
|
Package bwmap represents the BPF map used to enforce Pod bandwidth limitations via EDT (Earliest Departure Time) + BPF. |
|
maps/callsmap
Package callsmap represents the internal calls map for endpoint and host datapaths.
|
Package callsmap represents the internal calls map for endpoint and host datapaths. |
|
maps/configmap
Package config stores runtime configuration state for the Cilium datapath.
|
Package config stores runtime configuration state for the Cilium datapath. |
|
maps/ctmap
+groupName=maps
|
+groupName=maps |
|
maps/egressmap
+groupName=maps
|
+groupName=maps |
|
maps/encrypt
Package encrypt represents the nodes current encryption state.
|
Package encrypt represents the nodes current encryption state. |
|
maps/eventsmap
Package eventsmap represents the perf event map used by the datapath to send events to the Cilium agent.
|
Package eventsmap represents the perf event map used by the datapath to send events to the Cilium agent. |
|
maps/fragmap
Package fragmap represents the BPF map used to associate IPv4 datagram fragments to the L4 ports of the datagram they belong to, in order to retrieve the full 5-tuple necessary to do L4-based lookups.
|
Package fragmap represents the BPF map used to associate IPv4 datagram fragments to the L4 ports of the datagram they belong to, in order to retrieve the full 5-tuple necessary to do L4-based lookups. |
|
maps/ipcache
+groupName=maps
|
+groupName=maps |
|
maps/lbmap
+groupName=maps
|
+groupName=maps |
|
maps/lxcmap
Package lxcmap represents the endpoints BPF map in the BPF programs.
|
Package lxcmap represents the endpoints BPF map in the BPF programs. |
|
maps/metricsmap
Package metricsmap represents the BPF metrics map in the BPF programs.
|
Package metricsmap represents the BPF metrics map in the BPF programs. |
|
maps/multicast
+groupName=maps
|
+groupName=maps |
|
maps/nat
Package nat implements the BPF NAT map interaction code.
|
Package nat implements the BPF NAT map interaction code. |
|
maps/neighborsmap
Package neighborsmap represents the map that stores IP to mac address mappings for NodePort clients.
|
Package neighborsmap represents the map that stores IP to mac address mappings for NodePort clients. |
|
maps/nodemap
+groupName=maps
|
+groupName=maps |
|
maps/policymap
+groupName=maps
|
+groupName=maps |
|
maps/ratelimitmap
Package ratelimitmap represents the BPF ratelimit maps in the BPF programs.
|
Package ratelimitmap represents the BPF ratelimit maps in the BPF programs. |
|
maps/recorder
Package recorder represents the BPF map used to (wildcard-)filter traffic that is subject to the pcap recorder.
|
Package recorder represents the BPF map used to (wildcard-)filter traffic that is subject to the pcap recorder. |
|
maps/signalmap
Package signalmap represents the perf event map used to signal potential congestion to Cilium agent.
|
Package signalmap represents the perf event map used to signal potential congestion to Cilium agent. |
|
maps/srv6map
+groupName=maps
|
+groupName=maps |
|
maps/tunnel
+groupName=maps
|
+groupName=maps |
|
maps/vtep
+groupName=maps
|
+groupName=maps |
|
maps/worldcidrsmap
+groupName=maps
|
+groupName=maps |
|
mcastmanager
Package mcastmanager manages endpoint's IPv6 addresses and join the node solicitation multicast addresses
|
Package mcastmanager manages endpoint's IPv6 addresses and join the node solicitation multicast addresses |
|
metrics
Package metrics holds prometheus metrics objects and related utility functions.
|
Package metrics holds prometheus metrics objects and related utility functions. |
|
monitor/alignchecker
Package alignchecker is a thin wrapper around pkg/alignchecker to validate monitor object alignment.
|
Package alignchecker is a thin wrapper around pkg/alignchecker to validate monitor object alignment. |
|
monitor/format
Package format provides stdout formatting of monitor messages for reuse by command-line clients of the monitor event channel.
|
Package format provides stdout formatting of monitor messages for reuse by command-line clients of the monitor event channel. |
|
mtu
Package mtu is a library for tracking and configuring MTU for devices and routes.
|
Package mtu is a library for tracking and configuring MTU for devices and routes. |
|
multicast
Package multicast contains various utility functions to work with IPv6 multicast
|
Package multicast contains various utility functions to work with IPv6 multicast |
|
netns
Package netns contains various utility functions to work with network namespaces
|
Package netns contains various utility functions to work with network namespaces |
|
node
Package node provides functionality related to the local and remote node addresses
|
Package node provides functionality related to the local and remote node addresses |
|
option/resolver
Package resolver provides the logic for merging in the various sources of configuration, overrides, and drop-ins.
|
Package resolver provides the logic for merging in the various sources of configuration, overrides, and drop-ins. |
|
policy/api
Package api defines the API of the Cilium network policy interface +groupName=policy
|
Package api defines the API of the Cilium network policy interface +groupName=policy |
|
policy/trafficdirection
package trafficdirection specifies the directionality of policy in a numeric representation.
|
package trafficdirection specifies the directionality of policy in a numeric representation. |
|
pprof
Package pprof enables use of pprof in Cilium
|
Package pprof enables use of pprof in Cilium |
|
proxy/logger
Package logger provides the accesslog logging logic for all proxies
|
Package logger provides the accesslog logging logic for all proxies |
|
rate
Package rate provides a rate limiter to rate limit requests that can be burstable but they should only allowed N per a period defined.
|
Package rate provides a rate limiter to rate limit requests that can be burstable but they should only allowed N per a period defined. |
|
recorder
Package recorder provides an agent API for managing datapath pcap recorders.
|
Package recorder provides an agent API for managing datapath pcap recorders. |
|
redirectpolicy
Package redirectpolicy defines an internal representation of the Cilium Local Redirect Policy.
|
Package redirectpolicy defines an internal representation of the Cilium Local Redirect Policy. |
|
safetime
Package safetime contains a wrapper function for time.Since to deal with negative durations.
|
Package safetime contains a wrapper function for time.Since to deal with negative durations. |
|
signal
Package signal provides handling notifications from perf RB signal map.
|
Package signal provides handling notifications from perf RB signal map. |
|
slices
Package slices contains common utilities to work on slices of any type.
|
Package slices contains common utilities to work on slices of any type. |
|
spanstat
Package spanstat provides a mechanism to measure duration of multiple spans and add them up to a total duration
|
Package spanstat provides a mechanism to measure duration of multiple spans and add them up to a total duration |
|
time
package time is a wrapper for the stdlib time library that aliases most underlying types, but allows overrides for testing purposes.
|
package time is a wrapper for the stdlib time library that aliases most underlying types, but allows overrides for testing purposes. |
|
trigger
Package trigger provides a mechanism to trigger actions that require to be serialized while providing a non-blocking notification mechanism
|
Package trigger provides a mechanism to trigger actions that require to be serialized while providing a non-blocking notification mechanism |
|
tuple
Package tuple defines keys used for connection tuples in multiple BPF maps.
|
Package tuple defines keys used for connection tuples in multiple BPF maps. |
|
versioncheck
Package versioncheck provides utility wrappers for go-version, allowing the constraints to be used as global variables.
|
Package versioncheck provides utility wrappers for go-version, allowing the constraints to be used as global variables. |
|
wireguard/agent
This package contains the agent code used to configure the WireGuard tunnel between nodes.
|
This package contains the agent code used to configure the WireGuard tunnel between nodes. |
|
wireguard/types
Common WireGuard types and constants
|
Common WireGuard types and constants |
|
plugins
|
|
|
test
|
|
|
tools
|
|
|
dev-doctor
Command doctor checks the development setup for common problems.
|
Command doctor checks the development setup for common problems. |
Click to show internal directories.
Click to hide internal directories.