What is Cilium and how does it work for providing networking options

 

Cilium is a Kubernetes networking and security solution built using eBPF (extended Berkeley Packet Filter). It acts as a CNI (Container Network Interface) plugin, enabling Pods to communicate across nodes, enforcing network policies, and optionally providing Kubernetes Service load balancing and network observability.

In your Kubernetes environment, Cilium is responsible for much of the networking between your AI Core, API Server, PostgreSQL, and other Pods.

What Cilium does

Function	Description
Pod networking	Connects Pods on the same node and across different nodes
IP address management	Allocates Pod IPs, depending on the configured IPAM mode
Network policies	Allows or blocks traffic based on Kubernetes/Cilium security policies
Service load balancing	Can distribute traffic to Service backends using eBPF
eBPF datapath	Processes packets efficiently in the Linux kernel
Network observability	Hubble can show traffic flows, drops, and network-policy decisions
Encryption	Optionally encrypts traffic between nodes using WireGuard or IPsec, depending on configuration

Cilium is not the same as an Ingress Controller or API Gateway. It handles the underlying networking, while an Ingress Controller or Envoy Gateway handles application-level entry routing.

How traffic flows through Cilium

Consider your AI Core Pod connecting to the PostgreSQL Service on another Kubernetes node.

1. AI Core sends a request to postgres.myapp.svc.cluster.local:5432. CoreDNS resolves the Service name to its ClusterIP.

2. Cilium processes the packet. If Cilium's kube-proxy replacement is enabled, its eBPF service load balancer can select the PostgreSQL backend Pod.

3. Network policies are evaluated. Cilium enforces applicable policies, allowing or denying the connection.

4. The packet travels between nodes. Cilium uses the configured routing mode, such as native routing or an overlay tunnel.

5. The destination receives the packet. PostgreSQL processes the request and sends its response.

The precise packet path depends on your Cilium configuration. For example, service load balancing may instead be handled by kube-proxy.

Cilium vs kube-proxy vs CoreDNS

Component	Main responsibility
CoreDNS	Resolves Service names into IP addresses
Cilium CNI	Provides Pod networking, security, and optionally Service load balancing
kube-proxy	Implements Kubernetes Service forwarding when not replaced by Cilium
Envoy Gateway	Handles HTTP/HTTPS routing, TLS termination, and gateway policies