Rewiring Cilium: Operator-Driven Scale and Security With CiliumEndpointSlice
summary
CiliumEndpointSlice batches per-pod CiliumEndpoints into namespace-scoped slices (default max 100), moving identity and slice management into the operator so agents watch slices not millions of endpoints. This reduces API server watches (5k nodes × 200k pods = ~1 billion watches) and yields measured gains at AKS: 3x node scale, 50% API responsiveness, 60% faster pod startup. Reconcile queuing and endpoint propagation stay under ~1s in high churn; migration is a two-step operator-then-agent roll, with tunables like slice size, dynamic rate limits and priority namespaces.
AI-written summary · about
chapters (20)
- 0:00Introduction
- 0:20Agenda and Cilium basics
- 1:02Cilium networking and policies
- 2:03Cilium identity and security
- 3:09Endpoint and IP-to-identity mapping
- 3:51Endpoint creation and API pressure
- 4:54Scale challenges with endpoints
- 5:37Cilium endpoint slice intro
- 5:58How endpoint slice works
- 7:24Endpoint slice batching and reconciliation
- 8:51API load reduction with slices
- 10:15Production results and performance
- 11:18Scale testing metrics
- 12:23Trade-offs and latency
- 13:46Migration to endpoint slice
- 14:51Monitoring and tuning slices
- 16:33Optimizing slice configs
- 17:58Priority namespaces and future
- 18:39Operator-driven scale and security
- 19:47Q&A
related talks
25mThat’s Just My Cup of Tea: Configuring Cilium for Performance and Scale
43mScale Kubernetes Service Endpoints 100x
20mTackling Container Networking at Scale
27mSimplifying Multi-Cluster Networking With Cilium...
16mCilium Wars: Scaling Up Your Network with Jedi-like Cilium Handling Techniques - Yash Tandon
25mMore Churn No Problem: Lessons Learned Running Cilium in Production
26mScaling Network Policy Enforcement Beyond the Cluster Boundary with Cilium
28mLessons from Building Scalable Network Policy Enforcement with eBPF