Confluent's Multi-Cloud Journey to Cilium: Pitfalls and Lessons Learned
Talkat Cilium + eBPF Day North America 2024 · on Tuesday, 2024-11-12· at 09:10· Salt Palace | Level 1 | Grand Ballroom B·
summary
Confluent migrates thousands of Kubernetes clusters across AWS, GCP and Azure to Cilium for transparent encryption (WireGuard), DNS FQDN policies and Hubble observability, and reports concrete failures and fixes: AWS pod egress to peered VPCs breaks due to reverse path filter and requires nodePort workarounds; GKE’s netd flips source_valid_mark breaking Cilium’s DNS proxy (found with Falco/Tetragon) and is disabled; GCP node image CNI causes duplicate pod IPs so a controller deletes premature pods; Azure hostPort hiccups stem from iptables startup ordering. Several production clusters successfully run Cilium.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 2:18Migration to Cilium
- 6:15AWS Reverse Path Filtering
- 9:22Cilium DNS Proxy
- 13:05Cilium GCP IPs
- 15:33Misconfiguration
- 17:59IPtables
- 20:59Outro
related talks
26mThe Road To Cilium: Migrating 150+ Kubernetes Clusters at Airbnb
32mSwitching your CNI — Simone Sciarrati & Federico Hernandez
05mLightning Talk: Unveiling 5 Essential Insights from Cilium Implementation in a...
28mConnecting the World: Your Hands-on Guide To Cilium ClusterMesh and MCS-API
52mFast and Furious Multi-Cloud Connectivity
32mBreaking Boundaries: Multi-cluster with Cilium cluster mesh
28mA Decade of Cilium Around the World
20mTackling Container Networking at Scale