1
# Cilium Helm 配置（关键参数）
2
kubeProxyReplacement: strict     # 完全替代 kube-proxy
3
hubble:
4
  enabled: true                   # 启用 Hubble
5
  relay:
6
    enabled: true                  # 启用 Hubble Relay
7
  ui:
8
    enabled: true                  # 启用 Hubble UI
9
operator:
10
  replicas: 2                     # Operator 副本数
11
ipam:
12
  mode: kubernetes                # IPAM 模式
13
routingMode: native               # 路由模式（直连）
14
tunnelProtocol: vxlan             # 隧道协议
15
autoDirectNodeRoutes: true        # 自动直连路由
16
bandwidthManager:
17
  enabled: true                   # 带宽管理
18
bpf:
19
  lbMode: snat                    # 负载均衡模式

1
# 启用 Cilium Ambient Mesh
2
helm install cilium cilium/cilium \
3
    --set kubeProxyReplacement=strict \
4
    --set hubble.enabled=true \
5
    --set ambient.enabled=true \
6
    --namespace kube-system
7

8
# 将 Namespace 加入 Ambient Mesh
9
kubectl annotate namespace default \
10
    istio.io/dataplane-mode=ambient
11

12
# 验证
13
cilium status
14
kubectl get pods -n kube-system -l app=cilium

1
# L7 HTTP 策略
2
apiVersion: cilium.io/v2
3
kind: CiliumNetworkPolicy
4
metadata:
5
  name: l7-http-rule
6
spec:
7
  endpointSelector:
8
    matchLabels:
9
      app: backend
10
  ingress:
11
  - fromEndpoints:
12
    - matchLabels:
13
        app: frontend
14
    toPorts:
15
    - ports:
16
      - port: "80"
17
        protocol: TCP
18
      rules:
19
        http:
20
        - method: GET
21
          path: "/api/v1/.*"
22
        - method: POST
23
          path: "/api/v1/data"

1
# DNS 策略：只允许访问特定域名
2
apiVersion: cilium.io/v2
3
kind: CiliumNetworkPolicy
4
metadata:
5
  name: dns-rule
6
spec:
7
  endpointSelector:
8
    matchLabels:
9
      app: frontend
10
  egress:
11
  - toEndpoints:
12
    - matchLabels:
13
        k8s:io.kubernetes.pod.namespace: kube-system
14
        k8s-app: kube-dns
15
    toPorts:
16
    - ports:
17
      - port: "53"
18
        protocol: UDP
19
      rules:
20
        dns:
21
        - matchPattern: "myapp.example.com"
22
        - matchPattern: "*.google.com"

1
# 集群 A 配置
2
cilium clustermesh enable --service-id 1
3

4
# 集群 B 配置
5
cilium clustermesh enable --service-id 2
6

7
# 连接集群
8
cilium clustermesh connect --destination-context cluster-b
9

10
# 验证
11
cilium clustermesh status

1
# 全局 Service（跨集群负载均衡）
2
apiVersion: v1
3
kind: Service
4
metadata:
5
  name: my-global-service
6
  annotations:
7
    service.cilium.io/global: "true"
8
spec:
9
  type: ClusterIP
10
  ports:
11
  - port: 80
12
    targetPort: 8080
13
  selector:
14
    app: backend

1
# Tetragon DaemonSet 关键配置
2
apiVersion: apps/v1
3
kind: DaemonSet
4
metadata:
5
  name: tetragon
6
  namespace: kube-system
7
spec:
8
  selector:
9
    matchLabels:
10
      app: tetragon
11
  template:
12
    spec:
13
      serviceAccountName: tetragon
14
      containers:
15
      - name: tetragon
16
        image: cilium/tetragon:latest
17
        securityContext:
18
          capabilities:
19
            add: ["CAP_BPF", "CAP_PERFMON"]

1
# 监控特定 Namespace 的进程执行
2
kubectl exec -n kube-system ds/tetragon -- \
3
    tetra getevents --namespace-allowlist default
4

5
# 检测容器内的 bpf() 系统调用（可能的容器逃逸）
6
kubectl exec -n kube-system ds/tetragon -- \
7
    tetra getevents --process-cred-change

1
# 移除 kube-proxy
2
kubectl -n kube-system delete ds kube-proxy
3

4
# 部署 Cilium
5
helm install cilium cilium/cilium \
6
    --set kubeProxyReplacement=strict \
7
    --set hubble.enabled=true \
8
    --namespace kube-system
9

10
# 验证
11
cilium status
12
kubectl get svc -A  # Service 应正常工作

1
# 启用 Hubble
2
cilium hubble port-forward&
3

4
# 查看流量
5
hubble observe --since 5m
6

7
# 查看 DNS 查询
8
hubble observe --type l7 --protocol dns
9

10
# 查看 DROP 事件
11
hubble observe --type drop

1
# 创建 L7 策略
2
kubectl apply -f cilium-policy.yaml
3

4
# 验证策略生效
5
cilium policy get
6

7
# 测试策略
8
kubectl exec frontend-pod -- curl backend:80/api/v1/users  # 应允许
9
kubectl exec frontend-pod -- curl backend:80/admin          # 应拒绝