Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add notes about Cilium's exclusive mode #1794

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Add notes about Cilium's exclusive mode #1794

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
19bf4a6
Add notes about Cilium's exclusive mode
alpeb Jun 25, 2024
eab4284
Update linkerd.io/content/2.15/features/cni.md
kflynn Jul 2, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions linkerd.io/content/2.15/features/cni.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,13 @@ plugin, using _CNI chaining_. It handles only the Linkerd-specific
configuration and does not replace the need for a CNI plugin.
{{< /note >}}

{{< note >}}
If you're installing Linkerd's CNI plugin on top of Cilium, make sure to install the
latter with the option `cni.exclusive=false`, so Cilium doesn't take ownership
over the CNI configurations directory, and allows other plugins to deploy their
configurations there.
{{< /note >}}

## Installation

Usage of the Linkerd CNI plugin requires that the `linkerd-cni` DaemonSet be
Expand Down
11 changes: 11 additions & 0 deletions linkerd.io/content/2.15/reference/cluster-configuration.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,6 +78,8 @@ gcloud compute firewall-rules describe gke-to-linkerd-control-plane

## Cilium

### Turn Off Socket-Level Load Balancing

Cilium can be configured to replace kube-proxy functionality through eBPF. When
running in kube-proxy replacement mode, connections to a `ClusterIP` service
will be established directly to the service's backend at the socket level (i.e.
Expand All @@ -97,6 +99,15 @@ pods](https://docs.cilium.io/en/v1.13/network/istio/#setup-cilium) through the
CLI option `--config bpf-lb-sock-hostns-only=true`, or through the Helm value
`socketLB.hostNamespaceOnly=true`.

### Disable Exclusive Mode

If you're using Cilium as your CNI and then want to install
[linkerd-cni](../../features/cni/) on top of it, make sure you install Cilium
with the option `cni.exclusive=false`. This avoids Cilium taking ownership over
the CNI configurations directory. Other CNI plugins like linkerd-cni install
themselves and operate in chain mode with the other deployed plugins by
deploying their configuration into this directory.

## Lifecycle Hook Timeout

Linkerd uses a `postStart` lifecycle hook for all control plane components, and
Expand Down
Loading