Cilium Kubernetes CNI Provider: Part 4, IP Routing Modes (Direct and Encapsulated)

In this episode, we will learn about Cilium’s supported IP routing modes. IP routing essentially means how the PODs on one node communicate with PODs on other nodes.

To start with, we will discuss the default mode which uses L2 VXLAN encapsulation. We will then discuss situations where all nodes are on the same subnet, and how to set up Direct routing (no encapsulation).

Next, we will discuss how to leverage Border Gateway Protocol (BGP) to set up a hybrid mode where nodes exchange routes through BGP and use Direct IP routing for nodes on the same L2 domain, and IPinIP encapsulations for nodes on different subnets.

Finally, we will set up a cluster mesh between two clusters leveraging Direct IP routing.

*** Please note: There is a typo in the slide @ 0.6:40, the Dst IP in the center should read "10.107.72.75", NOT "10.101.79.42" . My apologies and thank you to viewer @SuperBitbucket to point it out. **

Links:

Timecodes
0:00 - Intro
4:37 - Overview of VXLAN encapsulated POD traffic.
15:44 - Demo: Capture VXLAN POD network traffic.
25:35 - Examine node routes when VXLAN encapsulation is used.
28:53 - Direct IP routing overview.
31:07 - Demo: Set up L2 Direct IP routing in a brand-new cluster.
34:11 - Cilium's helm settings to enable L2 Direct IP routing.
49:50 - L3 Direct IP routing overview.
50:34 - Overview of Border Gateway Protocol (BGP).
53:39 - How BGP is implemented in the Kubernetes environment.
55:12 - Demo: Set up L3 BGP-based Direct IP routing in a brand-new cluster.
1:05:19 - Cluster Mesh and Direct IP routing.
1:10:17 - Demo: Set up a Cluster Mesh between two clusters leveraging L2 Direct IP routing.
1:17:58 - Final Thoughts.

My Other Videos:

►Cilium Kubernetes CNI Provider, Part 2: Security Policies and Observability Leveraging Hubble
► Cilium Kubernetes CNI Provider, Part 3: Cluster Mesh

► What is VXLAN and How It is Used as an Overlay Network in Kubernetes?
► Managing Linux Log-ins, Users, and Machines in Active Directory (AD): Part 2- Join Linux Machines to AD:
► Managing Linux Log-ins, Users, and Machines in Active Directory (AD): Part 1- Setup AD:
► Sharing Resources between Windows and Linux:
► Kubernetes kube-proxy Modes: iptables and ipvs, Deep Dive:
►Kubernetes: Configuration as Data: Environment Variables, ConfigMaps, and Secrets:
►Configuring and Managing Storage in Kubernetes:
► Istio Service Mesh – Securing Kubernetes Workloads:

► Istio Service Mesh – Intro
► Understanding Kubernetes Networking. Part 6: Calico Network Policies:
► Understanding Kubernetes Networking. Part 5: Intro to Kubernetes Network Policies:
► Understanding Kubernetes Networking. Part 4: Kubernetes Services:

► Understanding Kubernetes Networking Part 3: Calico Kubernetes CNI Provider in depth:

► Setup a Linux-Windows (Calico based) Hybrid Kubernetes Cluster to Host .NET Containers:

► A Docker and Kubernetes tutorial for beginners:
A Docker and Kubernetes tutorial for beginners. - YouTube

► Setup a "Docker-less" Multi-node Kubernetes Cluster on Ubuntu Server:

► Detailed Windows Terminal, (WSL 2), Linux, Docker, and Kubernetes Install Guide on Windows 10:

[spiraldynamics]

Thank you! very good videos!!
Please continue ! ❤️

[darpanmalhotra]

I have been following all CNI videos you have posted. You are doing an amazing work of sharing this knowledge with us. Many thanks !

[ola-lrvc]

Great job, thanks you. It helped me to learn a lot, you deserve more views !

[agestar]

You're doing great job, thank you for videos!

[jankoprowski]

Thank you for your videos :) They are the best videos I watched related with networking and kubernetes. I would be thrilled if you could add video explaining keepalived :D

[amukher]

You have been a huge help for me in learning Cilium. There is one things that isn't clear though. In the direct routing mode, which CIDR can you use for the pod network? Is it any arbitrary CIDR or something that depends on the existing node network? EDIT: Never mind, I figured that I can use any CIDR. Thank you again.

[nikhilsrivastava]

how can we embed some custom identity to the vxlan routing based approach in order to have isolation when traffic egresses to another pod on another node?

[SuperBitbucket]

Thank you for the great content!! I was a tad confused at 6:40. The Dst IP in the center shows 10.101.79.42. Is this just a typo and really should be the cluster IP of 10.107.72.75?

[jingairpi]

Possible to mesh between vxlan and direct routing?

[keratishvili]

would we see more cilium series videos?

[eBPFCilium]

Thanks for making this video and all the other ones too! If you want some Cilium swag, DM us your address on Twitter and we will get it to you :)