Introduction to Cilium (edX)

When you deploy Kubernetes, you need to install a networking plug-in implementing the Container Networking Interface (CNI) to provide connectivity between workloads. Cilium is a popular and widely-deployed CNI solution that is now the default across many Kubernetes distributions and cloud provider offerings.

In this course, you will learn the basics of Cilium and how it can be used to connect, observe, and secure Kubernetes clusters. We will start by reviewing Kubernetes container networking and its challenges. We’ll move on to discussing the architecture of Cilium and how it uses eBPF to address those challenges. eBPF is a Linux technology that allows changing the kernel’s behavior through dynamically loaded custom programs. We’ll provide an overview of what eBPF is and how Cilium uses it to benefit cloud native networking.

We will provide a step-by-step guide for installing and setting up Cilium as your CNI. Once installed, we will show how to configure basic network policies to secure your network and how we can use Hubble to observe these network flows. Finally, we will discuss some of the commonly used features of Cilium, such as support for FQDN-based and L7 protocol-aware network policies, and cluster mesh networking.

By the end of this course, you will understand how Cilium and Hubble work and how they can be used to connect, observe, and secure your cloud native environments.

Prerequisites:

Learners should have some familiarity with Kubernetes operations and have basic experience using the kubectl tool. The course assumes that students are comfortable with basic Kubernetes concepts such as pods, nodes, services and clusters. To make the most of this course, we highly recommend the free Introduction to Kubernetes (LFS158x) course available on edX, which covers these prerequisites.

It is sufficient to have used minikube or kind to deploy a demo microservice application in a development cluster environment.

The hands-on exercises require a Kubernetes cluster pre-provisioned without a CNI plugin. The cluster hosts must be using a linux kernel with socket load balancing support (kernel versions v4.19.57, v5.1.16, v5.2.0 or more recent). The learners’ primary system should have the helm, kubectl and curl commands available.

All exercises have been tested using local development clusters based on Kind (v0.17.0) and minikube (v1.26.1) as well as Azure’s AKS service.

What you'll learn

- Describe Kubernetes networking and its challenges

- Discuss Cilium’s architecture and how it leverages eBPF

- Install Cilium and Hubble and verify their operational status

- Craft L3-L7 and DNS based Cilium Network Policy to secure Kubernetes network connectivity

- Use Hubble to observe network flows

- Enhance your network observability by enabling Cilium Prometheus metrics and integrating those metrics into Grafana dashboards

- Configure Cilium to provide transparent encryption of network traffic

- Learn how you can replace kube-proxy with Cilium

- Configure Cilium for cluster mesh operation to connect multiple Kubernetes clusters

Syllabus

Welcome!

Ch1. Introduction to Kubernetes Networking Concepts

Ch2. Introduction to Cilium and eBPF

Ch3. Cilium Network Policy In-Depth

Ch4. Introduction to Hubble

Ch5. Node to Node Transparent Encryption

Ch6. kube-proxy and Kubernetes Service Networking

Ch7. Replacing Kube-Proxy with Cilium

Ch8. Introduction to Cilium Cluster Mesh

Final Exam (verified track only)