1
# 查看 Cilium 身份
2
cilium identity list
3

4
# 输出示例：
5
# ID    LABELS
6
# 1     reserved:host
7
# 2     reserved:world
8
# 10001 app=frontend,env=prod
9
# 10002 app=backend,env=prod
10
# 10003 app=database,env=prod

1
# Cilium NetworkPolicy（基于身份）
2
apiVersion: cilium.io/v2
3
kind: CiliumNetworkPolicy
4
metadata:
5
  name: frontend-to-backend
6
spec:
7
  endpointSelector:
8
    matchLabels:
9
      app: backend
10
  ingress:
11
  - fromEndpoints:
12
    - matchLabels:
13
        app: frontend
14
    toPorts:
15
    - ports:
16
      - port: "8080"
17
        protocol: TCP

1
Identity 10001 (frontend) → Identity 10002 (backend) : TCP/8080 → ALLOW
2
其他 → Identity 10002 (backend) : DROP

1
// Cilium 连接跟踪条目（简化）
2
struct ct_entry {
3
    __u16 src_port;
4
    __u16 dst_port;
5
    __u32 src_ip;
6
    __u32 dst_ip;
7
    __u8 protocol;
8
    __u8 state;          // SYN_ESTABLISHED, ESTABLISHED, FIN, etc.
9
    __u32 src_identity;  // 源身份 ID
10
    __u32 dst_identity;  // 目标身份 ID
11
    __u64 last_seen;     // 最后活跃时间
12
    __u32 backend_ip;    // 后端 IP（DNAT）
13
    __u16 backend_port;  // 后端端口
14
};

1
// egress 方向简化处理逻辑
2
SEC("tc")
3
int tc_egress(struct __sk_buff *skb)
4
{
5
    // 查找源身份
6
    __u32 src_id = lookup_identity(skb->local_ip4);
7
    __u32 dst_id = lookup_identity(skb->remote_ip4);
8

9
    // egress 策略检查
10
    if (!policy_allow(src_id, dst_id, skb->protocol))
11
        return TC_ACT_SHOT;
12

13
    // SNAT：Pod IP → Node IP
14
    if (needs_snat(skb))
15
        do_snat(skb);
16

17
    return TC_ACT_OK;
18
}

1
# 启用 Bandwidth Manager
2
helm install cilium cilium/cilium \
3
    --set bandwidthManager.enabled=true \
4
    --set bandwidthManager.bbr=true

1
# 查看 Pod 间流量
2
hubble observe --since 1m
3

4
# 过滤特定 Pod 的流量
5
hubble observe --to-pod app=backend
6

7
# 查看 DROP 事件
8
hubble observe --type drop
9

10
# 查看特定身份的流量
11
hubble observe --from-identity 10001
12

13
# 输出 JSON 格式
14
hubble observe -o json

1
# 启用 ClusterMesh
2
cilium clustermesh enable
3

4
# 连接两个集群
5
cilium clustermesh connect --destination-context cluster-b
6

7
# 验证连接
8
cilium clustermesh status
9
cilium clustermesh vm list

1
# 检查跨集群连通性
2
cilium clustermesh connectivity status
3

4
# 查看远程集群的身份同步
5
cilium identity list --cluster
6

7
# 检查 etcd 连接状态
8
cilium clustermesh status --verbose

1
# Helm 安装 Cilium，完全替代 kube-proxy
2
helm install cilium cilium/cilium \
3
    --set kubeProxyReplacement=strict \
4
    --set hubble.enabled=true \
5
    --set hubble.relay.enabled=true \
6
    --set hubble.ui.enabled=true \
7
    --namespace kube-system

1
# 使用 Helm 部署 Cilium
2
helm repo add cilium https://helm.cilium.io/
3
helm install cilium cilium/cilium \
4
    --set kubeProxyReplacement=partial \
5
    --set hubble.enabled=true \
6
    --namespace kube-system
7

8
# 验证 Cilium 状态
9
cilium status
10
cilium connectivity test

1
# 启用 Hubble
2
cilium hubble port-forward&
3

4
# 查看实时流量
5
hubble observe --since 1m
6

7
# 查看 DROP 事件
8
hubble observe --type drop
9

10
# 查看 DNS 查询
11
hubble observe --type l7 --verdict ERROR

1
# 创建 CiliumNetworkPolicy
2
kubectl apply -f - <<EOF
3
apiVersion: cilium.io/v2
4
kind: CiliumNetworkPolicy
5
metadata:
6
  name: l7-rule
7
spec:
8
  endpointSelector:
9
    matchLabels:
10
      app: backend
11
  ingress:
12
  - fromEndpoints:
13
    - matchLabels:
14
        app: frontend
15
    toPorts:
16
    - ports:
17
      - port: "80"
18
        protocol: TCP
19
      rules:
20
        http:
21
        - method: GET
22
          path: "/api/.*"
23
EOF
24

25
# 验证策略
26
cilium policy get

1
# 1. 检查 Cilium Agent 状态
2
cilium status
3

4
# 2. 查看 eBPF 程序加载情况
5
cilium bpf lb list       # Service 负载均衡规则
6
cilium bpf ct list global # 全局连接跟踪表
7
cilium bpf tunnel list    # 隧道映射
8

9
# 3. 导出连接跟踪表
10
cilium bpf ct dump global
11

12
# 4. 查看身份映射
13
cilium bpf identity list