项目简介
Cilium 是基于 eBPF 数据平面的云原生网络、可观测性与安全解决方案。它支持 L3-L7 网络策略、可替代 kube-proxy 的分布式负载均衡，并提供深度流量可视化，支持 overlay 与原生路由、多集群互联及服务网格。
README 预览
.. raw:: html\n\n \n \n \n \n\n|cii| |go-report| |clomonitor| |artifacthub| |slack| |go-doc| |rtd| |apache| |bsd| |gpl| |fossa| |gateway-api| |codespaces|\n\nCilium is a networking, observability, and security solution with an eBPF-based\ndataplane. It provides a simple flat Layer 3 network with the ability to span\nmultiple clusters in either a native routing or overlay mode. It is L7-protocol\naware and can enforce network policies on L3-L7 using an identity-based security\nmodel that is decoupled from network addressing.\n\nCilium implements distributed load balancing for traffic between pods and to\nexternal services, and is able to fully replace kube-proxy, using efficient\nhash tables in eBPF, allowing for almost unlimited scale. It also supports\nadvanced functionality like integrated ingress and egress gateways, bandwidth\nmanagement, and service mesh, and provides deep network and security visibility and monitoring.\n\nA new Linux kernel technology called eBPF_ is at the foundation of Cilium. It\nsupports dynamic insertion of eBPF bytecode into the Linux kernel at various\nintegration points such as: network IO, application sockets, and tracepoints to\nimplement security, networking, and visibility logic. eBPF is highly efficient\nand flexible. To learn more about eBPF, visit `eBPF.io`_.\n\n.. image:: Documentation/images/cilium-overview.png\n :alt: Overview of Cilium features for networking, observability, service mesh, and runtime security\n\n.. raw:: html\n\n \n \n \n \n \n \n \n \n \n \n \n \n\nStable Releases\n===============\n\nThe Cilium community maintains minor stable releases for the last three minor\nCilium versions. Older Cilium stable versions from minor releases prior to that\nare considered EOL.\n\nFor upgrades to new minor releases, please consult the `Cilium Upgrade Guide`_.\n\nListed below are the actively maintained release branches along with their latest\npatch
常见问题 (1)
故障排除为什么从工作节点到同一节点上的 Cilium Ingress 服务的连接会失败，并提示 'upstream connect error or disconnect/reset before headers'？
故障排除
为什么从工作节点到同一节点上的 Cilium Ingress 服务的连接会失败，并提示 'upstream connect error or disconnect/reset before headers'？这是一个已确认的回归问题，在 Cilium 1.17.6 中引入（在 1.18.x、1.19.x 和 1.20.0-pre 中仍然存在）。当 Cilium ingress（或使用 hostNetwork envoy 的 Gateway API）与 kubeProxyReplacement 一起启用时，node-A 上的 pod 或进程无法访问运行在同一 node-A 上的后端 pod 的 ingress LoadBalancer IP。来自其他节点的连接则工作正常。Envoy 返回 HTTP 503 'upstream connect error or disconnect/reset before headers. reset reason: connection timeout'。临时解决方案：降级到 Cilium 1.17.5，报告者已验证该版本可恢复同节点 ingress 连接，例如 helm upgrade cilium cilium/cilium --version 1.17.5 -n kube-system -f values.yaml。目前尚未发布根因修复（GitHub issue #44529 仍未解决）。如果您受到影响，请使用 cilium sysdump 收集诊断信息并将其附加到该 issue 中，以帮助维护者进行调查。