cilium CLI 部署

架构支持

AMD64

AArch64

内核版本

Linux kernel >= 4.19.57

Linux 发行版兼容性和注意事项

发行版	最低版本
Amazon Linux 2	all
Bottlerocket OS	all
CentOS	>= 8.0
Container-Optimized OS	all
CoreOS	all
Debian	>= 10 Buster
Flatcar	all
LinuxKit	all
Opensuse	Tumbleweed, >=Leap 15.4
RedHat Enterprise Linux	>= 8.0
Ubuntu	>= 18.04.3

ubuntu 22.04 系统要求

# Ubuntu 22.04 上运行 Cilium 之前，请确保安装以下软件包:

sudo apt install linux-modules-extra-raspi

高级功能所需的内核版本

Cilium 特性	最低内核版本
Bandwidth Manager	>= 5.1
Egress Gateway	>= 5.2
VXLAN Tunnel Endpoint (VTEP) Integration	>= 5.2
WireGuard Transparent Encryption	>= 5.6
Full support for Session Affinity	>= 5.7
BPF-based proxy redirection	>= 5.7
Socket-level LB bypass in pod netns	>= 5.7
L3 devices	>= 5.8
BPF-based host routing	>= 5.10
IPv6 BIG TCP support	>= 5.19
IPv4 BIG TCP support	>= 6.3

防火墙规则

主节点

Port Range / Protocol	Ingress/Egress	Source/Destination	Description
2379-2380/tcp	ingress	worker-sg	etcd access
8472/udp	ingress	master-sg (self)	VXLAN overlay
8472/udp	ingress	worker-sg	VXLAN overlay
4240/tcp	ingress	master-sg (self)	health checks
4240/tcp	ingress	worker-sg	health checks
ICMP 8/0	ingress	master-sg (self)	health checks
ICMP 8/0	ingress	worker-sg	health checks
8472/udp	egress	master-sg (self)	VXLAN overlay
8472/udp	egress	worker-sg	VXLAN overlay
4240/tcp	egress	master-sg (self)	health checks
4240/tcp	egress	worker-sg	health checks
ICMP 8/0	egress	master-sg (self)	health checks
ICMP 8/0	egress	worker-sg	health checks

工作节点

Port Range / Protocol	Ingress/Egress	Source/Destination	Description
8472/udp	ingress	master-sg	VXLAN overlay
8472/udp	ingress	worker-sg (self)	VXLAN overlay
4240/tcp	ingress	master-sg	health checks
4240/tcp	ingress	worker-sg (self)	health checks
ICMP 8/0	ingress	master-sg	health checks
ICMP 8/0	ingress	worker-sg (self)	health checks
8472/udp	egress	master-sg	VXLAN overlay
8472/udp	egress	worker-sg (self)	VXLAN overlay
4240/tcp	egress	master-sg	health checks
4240/tcp	egress	worker-sg (self)	health checks
ICMP 8/0	egress	master-sg	health checks
ICMP 8/0	egress	worker-sg (self)	health checks
2379-2380/tcp	egress	master-sg	etcd access

所有节点的其它端口

Port Range / Protocol	Description
4240/tcp	cluster health checks (cilium-health)
4244/tcp	Hubble server
4245/tcp	Hubble Relay
4250/tcp	Mutual Authentication port
4251/tcp	Spire Agent health check port (listening on 127.0.0.1 or ::1)
6060/tcp	cilium-agent pprof server (listening on 127.0.0.1)
6061/tcp	cilium-operator pprof server (listening on 127.0.0.1)
6062/tcp	Hubble Relay pprof server (listening on 127.0.0.1)
9878/tcp	cilium-envoy health listener (listening on 127.0.0.1)
9879/tcp	cilium-agent health status API (listening on 127.0.0.1 and/or ::1)
9890/tcp	cilium-agent gops server (listening on 127.0.0.1)
9891/tcp	operator gops server (listening on 127.0.0.1)
9893/tcp	Hubble Relay gops server (listening on 127.0.0.1)
9962/tcp	cilium-agent Prometheus metrics
9963/tcp	cilium-operator Prometheus metrics
9964/tcp	cilium-envoy Prometheus metrics
51871/udp	WireGuard encryption tunnel endpoint

放行 ESP 流量

sudo firewall-cmd --permanent --add-protocol=esp
sudo firewall-cmd --reload

cilium CLI 部署

CILIUM_CLI_VERSION=$(curl -s https://raw.githubusercontent.com/cilium/cilium-cli/main/stable.txt)
CLI_ARCH=amd64
if [ "$(uname -m)" = "aarch64" ]; then CLI_ARCH=arm64; fi
curl -L --fail --remote-name-all https://github.com/cilium/cilium-cli/releases/download/${CILIUM_CLI_VERSION}/cilium-linux-${CLI_ARCH}.tar.gz{,.sha256sum}
sha256sum --check cilium-linux-${CLI_ARCH}.tar.gz.sha256sum
sudo tar xzvfC cilium-linux-${CLI_ARCH}.tar.gz /usr/local/bin
rm cilium-linux-${CLI_ARCH}.tar.gz{,.sha256sum}

验证 cilium

# cilium version --client

cilium-cli: v0.16.8 compiled with go1.22.3 on linux/amd64
cilium image (default): v1.15.5

参考文档

https://docs.cilium.io/en/stable/operations/system_requirements/