Using kube-router to run BGP

This guide explains how to configure Cilium and kube-router to co-operate to use kube-router for BGP peering and route propagation and Cilium for policy enforcement and load-balancing.

Note

This is a beta feature. Please provide feedback and file a GitHub issue if you experience any problems.

Deploy kube-router

Download the kube-router DaemonSet template:

  1. curl -LO https://raw.githubusercontent.com/cloudnativelabs/kube-router/v1.2/daemonset/generic-kuberouter-only-advertise-routes.yaml

Open the file generic-kuberouter-only-advertise-routes.yaml and edit the args: section. The following arguments are required to be set to exactly these values:

  1. - "--run-router=true"
  2. - "--run-firewall=false"
  3. - "--run-service-proxy=false"
  4. - "--enable-cni=false"
  5. - "--enable-pod-egress=false"

The following arguments are optional and may be set according to your needs. For the purpose of keeping this guide simple, the following values are being used which require the least preparations in your cluster. Please see the kube-router user guide for more information.

  1. - "--enable-ibgp=true"
  2. - "--enable-overlay=true"
  3. - "--advertise-cluster-ip=true"
  4. - "--advertise-external-ip=true"
  5. - "--advertise-loadbalancer-ip=true"

The following arguments are optional and should be set if you want BGP peering with an external router. This is useful if you want externally routable Kubernetes Pod and Service IPs. Note the values used here should be changed to whatever IPs and ASNs are configured on your external router.

  1. - "--cluster-asn=65001"
  2. - "--peer-router-ips=10.0.0.1,10.0.2"
  3. - "--peer-router-asns=65000,65000"

Apply the DaemonSet file to deploy kube-router and verify it has come up correctly:

  1. $ kubectl apply -f generic-kuberouter-only-advertise-routes.yaml
  2. $ kubectl -n kube-system get pods -l k8s-app=kube-router
  3. NAME                READY     STATUS    RESTARTS   AGE
  4. kube-router-n6fv8   1/1       Running   0          10m
  5. kube-router-nj4vs   1/1       Running   0          10m
  6. kube-router-xqqwc   1/1       Running   0          10m
  7. kube-router-xsmd4   1/1       Running   0          10m

Deploy Cilium

In order for routing to be delegated to kube-router, tunneling/encapsulation must be disabled. This is done by setting the tunnel=disabled in the ConfigMap cilium-config or by adjusting the DaemonSet to run the cilium-agent with the argument --tunnel=disabled. Moreover, in the same ConfigMap, we must explicitly set ipam: kubernetes since kube-router pulls the pod CIDRs directly from K8s:

  1. # Encapsulation mode for communication between nodes
  2. # Possible values:
  3. #   - disabled
  4. #   - vxlan (default)
  5. #   - geneve
  6. tunnel: "disabled"
  7. ipam: "kubernetes"

You can then install Cilium according to the instructions in section Requirements.

Ensure that Cilium is up and running:

  1. $ kubectl -n kube-system get pods -l k8s-app=cilium
  2. NAME           READY     STATUS    RESTARTS   AGE
  3. cilium-fhpk2   1/1       Running   0          45m
  4. cilium-jh6kc   1/1       Running   0          44m
  5. cilium-rlx6n   1/1       Running   0          44m
  6. cilium-x5x9z   1/1       Running   0          45m

Verify Installation

Verify that kube-router has installed routes:

  1. $ kubectl -n kube-system exec -ti cilium-fhpk2 -- ip route list scope global
  2. default via 172.0.32.1 dev eth0 proto dhcp src 172.0.50.227 metric 1024
  3. 10.2.0.0/24 via 10.2.0.172 dev cilium_host src 10.2.0.172
  4. 10.2.1.0/24 via 172.0.51.175 dev eth0 proto 17
  5. 10.2.2.0/24 dev tun-172011760 proto 17 src 172.0.50.227
  6. 10.2.3.0/24 dev tun-1720186231 proto 17 src 172.0.50.227

In the above example, we see three categories of routes that have been installed:

  • Local PodCIDR: This route points to all pods running on the host and makes these pods available to * 10.2.0.0/24 via 10.2.0.172 dev cilium_host src 10.2.0.172
  • BGP route: This type of route is installed if kube-router determines that the remote PodCIDR can be reached via a router known to the local host. It will instruct pod to pod traffic to be forwarded directly to that router without requiring any encapsulation. * 10.2.1.0/24 via 172.0.51.175 dev eth0 proto 17
  • IPIP tunnel route: If no direct routing path exists, kube-router will fall back to using an overlay and establish an IPIP tunnel between the nodes. * 10.2.2.0/24 dev tun-172011760 proto 17 src 172.0.50.227 * 10.2.3.0/24 dev tun-1720186231 proto 17 src 172.0.50.227

Validate the Installation

Cilium CLI

Manually

Install the latest version of the Cilium CLI. The Cilium CLI can be used to install Cilium, inspect the state of a Cilium installation, and enable/disable various features (e.g. clustermesh, Hubble).

Linux

macOS

Other

  1. curl -L --remote-name-all https://github.com/cilium/cilium-cli/releases/latest/download/cilium-linux-amd64.tar.gz{,.sha256sum}
  2. sha256sum --check cilium-linux-amd64.tar.gz.sha256sum
  3. sudo tar xzvfC cilium-linux-amd64.tar.gz /usr/local/bin
  4. rm cilium-linux-amd64.tar.gz{,.sha256sum}
  1. curl -L --remote-name-all https://github.com/cilium/cilium-cli/releases/latest/download/cilium-darwin-amd64.tar.gz{,.sha256sum}
  2. shasum -a 256 -c cilium-darwin-amd64.tar.gz.sha256sum
  3. sudo tar xzvfC cilium-darwin-amd64.tar.gz /usr/local/bin
  4. rm cilium-darwin-amd64.tar.gz{,.sha256sum}

See the full page of releases.

To validate that Cilium has been properly installed, you can run

  1. $ cilium status --wait
  2.    /¯¯\
  3. /¯¯\__/¯¯\    Cilium:         OK
  4. \__/¯¯\__/    Operator:       OK
  5. /¯¯\__/¯¯\    Hubble:         disabled
  6. \__/¯¯\__/    ClusterMesh:    disabled
  7.    \__/
  9. DaemonSet         cilium             Desired: 2, Ready: 2/2, Available: 2/2
  10. Deployment        cilium-operator    Desired: 2, Ready: 2/2, Available: 2/2
  11. Containers:       cilium-operator    Running: 2
  12.                   cilium             Running: 2
  13. Image versions    cilium             quay.io/cilium/cilium:v1.9.5: 2
  14.                   cilium-operator    quay.io/cilium/operator-generic:v1.9.5: 2

Run the following command to validate that your cluster has proper network connectivity:

  1. $ cilium connectivity test
  2. ℹ️  Monitor aggregation detected, will skip some flow validation steps
  3. ✨ [k8s-cluster] Creating namespace for connectivity check...
  4. (...)
  5. ---------------------------------------------------------------------------------------------------------------------
  6. 📋 Test Report
  7. ---------------------------------------------------------------------------------------------------------------------
  8. ✅ 69/69 tests successful (0 warnings)

Congratulations! You have a fully functional Kubernetes cluster with Cilium. 🎉

You can monitor as Cilium and all required components are being installed:

  1. $ kubectl -n kube-system get pods --watch
  2. NAME                                    READY   STATUS              RESTARTS   AGE
  3. cilium-operator-cb4578bc5-q52qk         0/1     Pending             0          8s
  4. cilium-s8w5m                            0/1     PodInitializing     0          7s
  5. coredns-86c58d9df4-4g7dd                0/1     ContainerCreating   0          8m57s
  6. coredns-86c58d9df4-4l6b2                0/1     ContainerCreating   0          8m57s

It may take a couple of minutes for all components to come up:

  1. cilium-operator-cb4578bc5-q52qk         1/1     Running   0          4m13s
  2. cilium-s8w5m                            1/1     Running   0          4m12s
  3. coredns-86c58d9df4-4g7dd                1/1     Running   0          13m
  4. coredns-86c58d9df4-4l6b2                1/1     Running   0          13m

You can deploy the “connectivity-check” to test connectivity between pods. It is recommended to create a separate namespace for this.

  1. kubectl create ns cilium-test

Deploy the check with:

  1. kubectl apply -n cilium-test -f https://raw.githubusercontent.com/cilium/cilium/v1.11/examples/kubernetes/connectivity-check/connectivity-check.yaml

It will deploy a series of deployments which will use various connectivity paths to connect to each other. Connectivity paths include with and without service load-balancing and various network policy combinations. The pod name indicates the connectivity variant and the readiness and liveness gate indicates success or failure of the test:

  1. $ kubectl get pods -n cilium-test
  2. NAME                                                     READY   STATUS    RESTARTS   AGE
  3. echo-a-76c5d9bd76-q8d99                                  1/1     Running   0          66s
  4. echo-b-795c4b4f76-9wrrx                                  1/1     Running   0          66s
  5. echo-b-host-6b7fc94b7c-xtsff                             1/1     Running   0          66s
  6. host-to-b-multi-node-clusterip-85476cd779-bpg4b          1/1     Running   0          66s
  7. host-to-b-multi-node-headless-dc6c44cb5-8jdz8            1/1     Running   0          65s
  8. pod-to-a-79546bc469-rl2qq                                1/1     Running   0          66s
  9. pod-to-a-allowed-cnp-58b7f7fb8f-lkq7p                    1/1     Running   0          66s
  10. pod-to-a-denied-cnp-6967cb6f7f-7h9fn                     1/1     Running   0          66s
  11. pod-to-b-intra-node-nodeport-9b487cf89-6ptrt             1/1     Running   0          65s
  12. pod-to-b-multi-node-clusterip-7db5dfdcf7-jkjpw           1/1     Running   0          66s
  13. pod-to-b-multi-node-headless-7d44b85d69-mtscc            1/1     Running   0          66s
  14. pod-to-b-multi-node-nodeport-7ffc76db7c-rrw82            1/1     Running   0          65s
  15. pod-to-external-1111-d56f47579-d79dz                     1/1     Running   0          66s
  16. pod-to-external-fqdn-allow-google-cnp-78986f4bcf-btjn7   1/1     Running   0          66s

Note

If you deploy the connectivity check to a single node cluster, pods that check multi-node functionalities will remain in the Pending state. This is expected since these pods need at least 2 nodes to be scheduled successfully.

Once done with the test, remove the cilium-test namespace:

  1. kubectl delete ns cilium-test