- Project Calico
- Products
- Solutions
- Learn
- Support
- Company
Cilium is an open-source solution for providing networking and security between container workloads. Developed using the go language, it heavily relies on eBPF technology in the Linux kernel. However, since eBPF is still under development in some niche cases, it relies on well-established technologies such as iptables to provide compatibility for older Kernels.
Cilium enables fine-grained policies for applications and services. It allows developers and Kubernetes operators to define and enforce network-level and application-level security policies.
Unlike traditional networking solutions that operate at Layer 3 (Network layer), Cilium works at Layer 7 (Application layer), offering visibility over networking protocols and payloads, and enabling Cilium’s network security, traffic management, and observability capabilities.
In this article:
In cloud-native environments where Kubernetes is often the orchestrator of choice, Cilium is often used as a core networking component. It provides a network fabric that supports a large number of microservices. By using eBPF, Cilium enables monitoring and security at the packet level without requiring changes to application code or container configurations.
Cilium is useful for networking in cloud-native environments because it integrates with Kuberetes and can enforce policies dynamically across a large distributed architecture. As applications are deployed, updated, or moved across the cloud-native infrastructure, Cilium can dynamically update their communication policies and requirements.
The following diagram illustrates the Cilium architecture. We describe the main components in more detail below.
Source: Cilium
The Cilium Daemon runs on each node in the cluster, responsible for enforcing security policies, managing network flows, and gathering metrics. It communicates with the Kubernetes API server to be aware of policy changes, pod lifecycle events, and network configuration updates. This agent uses eBPF to manipulate network traffic on the fly according to the required network policies.
Running on each node, the agent ensures that policies are consistently enforced across the cluster, regardless of where services or workloads are deployed. This ensures the networking component does not become a bottleneck or single point of failure.
The Cilium Command Line Interface (CLI) Client allows administrators and developers to manage and interact with Cilium components. It makes it possible to inspect and manipulate Cilium’s state, manage policies, and troubleshoot issues directly from the command line. In addition, the CLI provides commands for configuring Cilium, viewing status information, and performing operational tasks.
The Cilium Operator automates the management tasks of Cilium within a Kubernetes cluster. It handles cluster-wide operations such as managing global Cilium configurations, scaling Cilium components, and orchestrating IP address management for pods. The operator reduces the manual overhead involved in maintaining Cilium installations.
By monitoring the state of the cluster and making adjustments as necessary, the operator ensures Cilium is correctly configured and optimized for the current workload and network conditions.
As a Container Network Interface (CNI) plugin, Cilium enables container orchestration systems like Kubernetes to configure network namespaces and attach containers to the network. The plugin is central to establishing the pod-to-pod, pod-to-service, and external network communication within Kubernetes clusters. It translates high-level policies into low-level eBPF programs that enforce these policies at runtime.
Through its CNI plugin, Cilium supports Kubernetes networking features like network policy enforcement, service load balancing, and encryption.
Extended Berkeley Packet Filter (eBPF) is a technology that allows ‘userspace programs’ (custom software code) to run within the Linux kernel. Cilium inserts networking and security logic into the datapath, enabling high-performance packet processing without changing kernel source code or loading kernel modules.
Cilium uses eBPF for many of its features, including enforcement of security policies and delivery of detailed network metrics.
Cilium utilizes a distributed key-value store (like etcd) as its data store for storing and managing the state of network policies, identities, and configurations. This data store ensures consistent, persistent state management across the Cilium deployment, important for coordinating network policies and maintaining a coherent network state.
The data store can support large clusters and withstands node failures, ensuring that network operations continue smoothly without interruptions or data loss.
Related content: Read our guide to Cilium cluster mesh
Cilium provides service load balancing by distributing incoming requests among available service instances. By operating at Layer 7, it can make load-balancing decisions based on HTTP headers, enabling advanced routing strategies like canary deployments and A/B testing.
As applications scale, Cilium’s load balancing handles fluctuations in traffic and service capacity, ensuring reliable application performance.
Cilium is a Kubernetes CNI, supporting secure network connectivity for pods across a cluster. It can scale to a large number of pods with low overhead, owing to its use of eBPF. Cilium can also enable communication across Kubernetes clusters, making it possible to support large-scale, distributed applications that require consistent network performance.
Cilium provides detailed network metrics and aids in policy troubleshooting. This combination enables real-time monitoring of network performance, as well as quick identification and resolution of policy misconfigurations or security breaches. The ability to trace and visualize the flow of traffic through the network simplifies troubleshooting, saves time and reduces operational complexity.
Cilium offers transparent encryption using IPsec and WireGuard, securing data in transit without requiring modifications to application code or container configurations. This ensures that data is protected as it travels across potentially unsecured networks, such as the internet or multi-tenant data centers.
While Cilium is a powerful technology, it has its shortcomings. Here are the main limitations of the solution, as reported by users on the software marketplace and review platform, G2.
One of the primary concerns with Cilium revolves around network stability. Users have encountered situations where network connectivity crashes unexpectedly, leading to significant application downtime. This is especially problematic in environments that demand high availability, as the sudden loss of network connection can halt operations.
Cilium’s close integration with the Linux kernel, through its use of eBPF, results in a certain level of platform dependency. This tight coupling means that Cilium’s functionality and performance may not be consistent across different operating environments. For organizations operating in diverse or hybrid cloud setups, this lack of platform independence can complicate network management and limit the solution’s applicability.
Cilium is a complex solution, requiring a steep learning curve, particularly for individuals new to container networking and Kubernetes. This complexity is not limited to just understanding Cilium’s capabilities but extends to its setup and configuration processes.
Additionally, when network issues arise, the process of debugging and troubleshooting Cilium’s operations can be intricate. Given the advanced nature of the technologies involved, pinpointing specific problems without a deep understanding of the underlying systems can be challenging.
Calico is a comprehensive networking and security solution designed to support containers, virtual machines, and native host-based workloads across a range of platforms including Kubernetes, OpenShift, Docker EE, OpenStack, and bare metal. Unlike other CNIs, Calico offers a pluggable data plane model that gives you the freedom to use the technology that has the most benefits for your environment. Data planes such as eBPF, Windows HNS, VPP, and Standard Linux are among the ones that Calico currently supports.
Calico delivers high-performance and cloud-native scalability, ensuring a consistent and efficient experience across public clouds, on-premises setups, and clusters of any size, up to thousands of nodes.
Key features include:
Related content: Our guide to Cilium vs Calico
Flannel is an overlay networking tool designed to simplify IP address management for containers. It assigns each host in a network a range of subnet addresses, typically using IPv4 with a /24 or /16 subnet mask, to allocate IPs to containers individually.
Originally created for Kubernetes, Flannel can function as a generic overlay network beyond Kubernetes environments. By configuring each host with an IP range and subnet size, and utilizing etcd for subnet-host mapping, Flannel can help deploy distributed systems, like Hadoop, across multiple container hosts, addressing limitations in Docker’s native IP allocation mechanism.
Key features include:
Calico Cloud offers robust features for container networking and network security in cloud-native applications:
Next steps:
