Command Cheatsheet

Cilium is controlled via an easy command-line interface. This CLI is a single application that takes subcommands that you can find in the command reference guide.

  1. $ cilium
  2. CLI for interacting with the local Cilium Agent
  4. Usage:
  5.   cilium [command]
  7. Available Commands:
  8.   bpf                      Direct access to local eBPF maps
  9.   cleanup                  Reset the agent state
  10.   completion               Output shell completion code for bash
  11.   config                   Cilium configuration options
  12.   debuginfo                Request available debugging information from agent
  13.   endpoint                 Manage endpoints
  14.   identity                 Manage security identities
  15.   kvstore                  Direct access to the kvstore
  16.   monitor                  Monitoring
  17.   policy                   Manage security policies
  18.   prefilter                Manage XDP CIDR filters
  19.   service                  Manage services & loadbalancers
  20.   status                   Display status of daemon
  21.   version                  Print version information
  23. Flags:
  24.       --config string   config file (default is $HOME/.cilium.yaml)
  25.   -D, --debug           Enable debug messages
  26.   -H, --host string     URI to server-side API
  28. Use "cilium [command] --help" for more information about a command.

All commands and subcommands have the option -h that will provide information about the options and arguments that the subcommand has. In case of any error in the command, Cilium CLI will return a non-zero status.

Command utilities:

JSON Output

All the list commands will return a pretty printed list with the information retrieved from Cilium Daemon. If you need something more detailed you can use JSON output, to get the JSON output you can use the global option -o json

  1. $ cilium endpoint list -o json

Moreover, Cilium also provides a JSONPath support, so detailed information can be extracted. JSONPath template reference can be found in Kubernetes documentation

  1. $ cilium endpoint list -o jsonpath='{[*].id}'
  2. 29898 38939 56326
  3. $ cilium endpoint list -o jsonpath='{range [*]}{@.id}{"="}{@.status.policy.spec.policy-enabled}{"\n"}{end}'
  4. 29898=none
  5. 38939=none
  6. 56326=none

Shell Tab-completion

If you use bash or zsh, Cilium CLI can provide tab completion for subcommands. If you want to install tab completion, you should run the following command in your terminal.

  1. $ source <(cilium completion)

If you want to have Cilium completion always loaded, you can install using the following:

  1. $ echo "source <(cilium completion)" >> ~/.bashrc

Command examples:

Basics

Check the status of the agent

  1. $ cilium status
  2. KVStore:                Ok         Consul: 172.17.0.3:8300
  3. ContainerRuntime:       Ok
  4. Kubernetes:             Disabled
  5. Cilium:                 Ok         OK
  6. NodeMonitor:            Listening for events on 2 CPUs with 64x4096 of shared memory
  7. Cilium health daemon:   Ok
  8. Controller Status:      6/6 healthy
  9. Proxy Status:           OK, ip 10.15.28.238, port-range 10000-20000
  10. Cluster health:   1/1 reachable   (2018-04-11T07:33:09Z)
  11. $

Get a detailed status of the agent:

  1. $ cilium status --all-controllers --all-health --all-redirects
  2. KVStore:                Ok         Consul: 172.17.0.3:8300
  3. ContainerRuntime:       Ok
  4. Kubernetes:             Disabled
  5. Cilium:                 Ok         OK
  6. NodeMonitor:            Listening for events on 2 CPUs with 64x4096 of shared memory
  7. Cilium health daemon:   Ok
  8. Controller Status:      6/6 healthy
  9.   Name                                 Last success   Last error   Count   Message
  10.   kvstore-lease-keepalive              2m52s ago      never        0       no error
  11.   ipcache-bpf-garbage-collection       2m50s ago      never        0       no error
  12.   resolve-identity-29898               2m50s ago      never        0       no error
  13.   sync-identity-to-k8s-pod (29898)     50s ago        never        0       no error
  14.   sync-IPv4-identity-mapping (29898)   2m49s ago      never        0       no error
  15.   sync-IPv6-identity-mapping (29898)   2m49s ago      never        0       no error
  16. Proxy Status:   OK, ip 10.15.28.238, port-range 10000-20000
  17. Cluster health:         1/1 reachable   (2018-04-11T07:32:09Z)
  18.   Name                  IP              Reachable   Endpoints reachable
  19.   runtime (localhost)   10.0.2.15       true        false
  20. $

Get the current agent configuration

  1. cilium config

Policy management

Importing a Cilium Network Policy

  1. cilium policy import my-policy.json

Get list of all imported policy rules

  1. cilium policy get

Remove all policies

  1. cilium policy delete --all

Tracing

Check policy enforcement between two labels on port 80:

  1. cilium policy trace -s <app.from> -d <app.to> --dport 80

Check policy enforcement between two identities

  1. cilium policy trace --src-identity <from-id> --dst-identity <to-id>

Check policy enforcement between two pods:

  1. cilium policy trace --src-k8s-pod <namespace>:<pod.from> --dst-k8s-pod <namespace>:<pod.to>

Monitoring

Monitor cilium datapath notifications

  1. cilium monitor

Verbose output (including debug if enabled)

  1. cilium monitor -v

Extra verbose output (including packet dissection)

  1. cilium monitor -v -v

Filter for only the events related to endpoint

  1. cilium monitor --related-to=<id>

Filter for only events on layer 7

  1. cilium monitor -t L7

Show notifications only for dropped packet events

  1. cilium monitor --type drop

Don’t dissect packet payload, display payload in hex information

  1. cilium monitor -v -v --hex

Connectivity

Check cluster Connectivity

  1. cilium-health status

There is also a blog post related to this tool.

Endpoints

Get list of all local endpoints

  1. cilium endpoint list

Get detailed view of endpoint properties and state

  1. cilium endpoint get <id>

Show recent endpoint specific log entries

  1. cilium endpoint log <id>

Enable debugging output on the cilium monitor for this endpoint

  1. cilium endpoint config <id> Debug=true

Loadbalancing

Get list of loadbalancer services

  1. cilium service list

Or you can get the loadbalancer information using bpf list

  1. cilium bpf lb list

Add a new loadbalancer

  1. cilium service update --frontend 127.0.0.1:80 \
  2.     --backends 127.0.0.2:90,127.0.0.3:90 \
  3.     --id 20

eBPF

List node tunneling mapping information

  1. cilium bpf tunnel list

Checking logs for verifier issue

  1. journalctl -u cilium | grep -B20 -F10 Verifier

List connection tracking entries:

  1. sudo cilium bpf ct list global

Flush connection tracking entries:

  1. sudo cilium bpf ct flush

Kubernetes examples:

If you running Cilium on top of Kubernetes you may also want a way to list all cilium endpoints or policies from a single Kubectl commands. Cilium provides all this information to the user by using Kubernetes Resource Definitions:

Policies

In Kubernetes you can use two kinds of policies, Kubernetes Network Policies or Cilium Network Policies. Both can be retrieved from the kubectl command:

Kubernetes Network Policies

  1.  kubectl get netpol

Kubernetes Cilium Policies

  1.  $ kubectl get cnp
  2.  NAME      AGE
  3.  rule1     3m
  4.  $ kubectl get cnp rule1
  5.  NAME      AGE
  6.  rule1     3m
  7.  $ kubectl get cnp rule1 -o json

Endpoints

To retrieve a list of all endpoints managed by cilium, Cilium Endpoint resource can be used.

  1. $ kubectl get cep
  2. NAME                AGE
  3. 34e299f0-b25c2fef   41s
  4. 34e299f0-dd86986c   42s
  5. 4d088f48-83e4f98d   2m
  6. 4d088f48-d04ab55f   2m
  7. 5c6211b5-9217a4d1   1m
  8. 5c6211b5-dccc3d24   1m
  9. 700e0976-6cb50b02   3m
  10. 700e0976-afd3a30c   3m
  11. 78092a35-4874ed16   1m
  12. 78092a35-4b08b92b   1m
  13. 9b74f61f-14571299   7s
  14. 9b74f61f-f9a96f4a   7s
  16. $ kubectl get cep 700e0976-6cb50b02 -o json
  18. $ kubectl get cep -o jsonpath='{range .items[*]}{@.status.id}{"="}{@.status.status.policy.spec.policy-enabled}{"\n"}{end}'
  19. 30391=ingress
  20. 5766=ingress
  21. 51796=none
  22. 40355=none