When using Cilium you can reach an application using the Pod IP address or using a LoadBalance IP assigned to a Service. In the previous article we only advertised the Pod Address to our BGP neighbors, lets add more stuff so we can be close to a real deployment.<\/p>\n
If you already have cloned the repo, go and do a pull so you can get the new config files and other stuff in the Makefile, or better yet, go and do a new clone of the repo and start from scratch, that\u2019s the idea of the repo!<\/p>\n
<\/p>\n
New stuff in this LAB.<\/p>\n
- \n
- \n
- \n
- \n
- \n
- serviceSubnet in cluster.yaml<\/strong> (10.2.0.0\/16)<\/li>\n
- serviceSelector in the CiliumBGPPeeringPolicy<\/strong> (service = public), this useful to identify what LoadBalancer will be announced by this peering policy.<\/li>\n
- public-pool.yaml with the configuration for the LoadBalancer IP Pool.<\/li>\n
- If you look at the topo.yaml<\/strong> file, will find a new Linux node (client0) for testing, this is based on alpine:latest, will test reachability to our LoadBalancer IP from this container that is connected to tor1 with IP address 10.0.100.2\/24<\/li>\n
- Bookinfo application so we can have something to reach from client0.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
Now let’s build the environment, just like before, running make<\/strong><\/em> will create a KinD<\/strong> cluster with 4 nodes (1 control-plane and 3 workers), a containerlab<\/strong> topology with 3 routers (FRR), and 1 client (Alpine). decide to let alone the Cilium install manually or with make cilium<\/em>,<\/strong>\u00a0in case there is a need to do something different with the same KinD cluster or add another option to Cilium at install time.<\/p>\n
![\"A](\"https:\/\/arielantigua.com\/weblog\/wp-content\/uploads\/2024\/07\/a-black-screen-with-white-text-description-automa.png\")
<\/a><\/p>\nThis is the result of running make, as you can see in the image, now you can go and install Cilium in whatever way you like the most, in this case, I will use these options:<\/p>\n
cilium install --version=1.15 \\\r\n--helm-set ipam.mode=kubernetes \\\r\n--helm-set tunnel-protocol=vxlan \\\r\n--helm-set ipv4NativeRoutingCIDR=\"10.0.0.0\/8\" \\\r\n--helm-set bgpControlPlane.enabled=true \\\r\n--helm-set k8s.requireIPv4PodCIDR=true<\/pre>\n
The fastest way is to do this: make cilium<\/strong><\/em><\/p>\n
![\"A](\"https:\/\/arielantigua.com\/weblog\/wp-content\/uploads\/2024\/07\/a-screen-shot-of-a-computer-description-automatic-1.png\")
<\/p>\n![\"A](\"https:\/\/arielantigua.com\/weblog\/wp-content\/uploads\/2024\/07\/a-screen-shot-of-a-computer-screen-description-au.png\")
<\/p>\nThe nodes are ready for workloads.<\/p>\n
Now is the time to apply both, the CiliumBGPPeeringPolicy and the CiliumLoadBalancerIPPool.<\/p>\n
You can do it with make<\/strong><\/em> or the official way with kubectl<\/strong><\/em>.<\/p>\n
kubectl apply -f cilium-bgp-peering-policies.yaml \r\n\r\nkubectl apply -f public-pool.yaml<\/pre>\n
![\"A](\"https:\/\/arielantigua.com\/weblog\/wp-content\/uploads\/2024\/07\/a-screen-shot-of-a-computer-screen-description-au-1.png\")
<\/p>\nYou can validate the configurations with the following commands.<\/p>\n
kubectl get -f cilium-bgp-peering-policies.yaml -oyaml\r\n\r\nkubectl get -f public-pool.yaml -oyaml<\/pre>\n
Our lab environment is ready to assign IP to LoadBalancer services, lest check the existing ones first.<\/p>\n
![\"\"](\"https:\/\/arielantigua.com\/weblog\/wp-content\/uploads\/2024\/07\/word-image-3304-5.png\")
<\/a><\/p>\nIs time to deploy our test application.<\/strong><\/p>\n
Now there is an app in the repo, you can deploy the bookinfo application, which is used by Istio to do some demos, I just cloned it and added a Service to pick up an Address from our IP Pool and advertised it to the Tor(0,1) routers.<\/p>\n
https:\/\/github.com\/aredan\/ciliumlabs\/tree\/main\/bookinfo\/kustomize<\/a><\/p>\n
kubectl apply -k kustomize<\/pre>\n
![\"A](\"https:\/\/arielantigua.com\/weblog\/wp-content\/uploads\/2024\/07\/a-screenshot-of-a-computer-program-description-au.png\")
<\/p>\nLet’s check the Services that we have now.<\/p>\n
![\"A](\"https:\/\/arielantigua.com\/weblog\/wp-content\/uploads\/2024\/07\/a-screen-shot-of-a-computer-description-automatic-2.png\")
<\/p>\nThere is our LoadBalancer IP address (10.0.10.1) and others ClusterIP, the LoadBalancer is the one that we will be testing from client0.<\/p>\n
![\"A](\"https:\/\/arielantigua.com\/weblog\/wp-content\/uploads\/2024\/07\/a-screenshot-of-a-computer-program-description-au-1.png\")
<\/p>\nWe can see there is an IP assigned to the Service, but is better if we can validate that this address is being announced to the Tor routers.<\/p>\n
docker exec -it clab-bgp-cplane-router0 vtysh -c 'show bgp ipv4'<\/pre>\n
![\"A](\"https:\/\/arielantigua.com\/weblog\/wp-content\/uploads\/2024\/07\/a-computer-screen-shot-of-a-computer-description.png\")
<\/a><\/p>\nAlso, from Cilium itself we can validate that his address is being announced from the virtualRouters<\/strong><\/em>.<\/p>\n
Within the Cilium CLI exists a subcommand called bgp (hard to pass!!) and with this, we can validate a few things.<\/p>\n
![\"A](\"https:\/\/arielantigua.com\/weblog\/wp-content\/uploads\/2024\/07\/a-screenshot-of-a-computer-description-automatica-1.png\")
<\/p>\n![\"A](\"https:\/\/arielantigua.com\/weblog\/wp-content\/uploads\/2024\/07\/a-screen-shot-of-a-computer-description-automatic-3.png\")
<\/p>\ncilium bgp routes advertised ipv4 unicast<\/pre>\n
![\"A](\"https:\/\/arielantigua.com\/weblog\/wp-content\/uploads\/2024\/07\/a-black-screen-with-white-text-description-automa-1.png\")
<\/a><\/p>\nOur four nodes are announcing the same address to upstream routers, this is because of the trafficPolicy assigned to the service.<\/p>\n
Is time to reach our App.<\/strong><\/p>\n
We need to get into client0 container<\/strong>, this is an alpine container so ash<\/strong> is the shell.<\/p>\n
Installing curl<\/strong> and Lynx<\/strong>. In case you don’t know what Lynx is, is a console browser, this feels like traveling to the past when the one that stayed more in the console was the strongest.<\/p>\n
![\"A](\"https:\/\/arielantigua.com\/weblog\/wp-content\/uploads\/2024\/07\/a-black-screen-with-white-text-description-automa-2.png\")
<\/p>\n![\"A](\"https:\/\/arielantigua.com\/weblog\/wp-content\/uploads\/2024\/07\/a-screenshot-of-a-computer-program-description-au-2.png\")
<\/p>\n![\"A](\"https:\/\/arielantigua.com\/weblog\/wp-content\/uploads\/2024\/07\/a-computer-screen-shot-of-a-black-screen-descript.png\")
<\/p>\nWe can see that curl is reaching the app, this way is hard to interact we the application, now with Lynx!<\/p>\n
- serviceSelector in the CiliumBGPPeeringPolicy<\/strong> (service = public), this useful to identify what LoadBalancer will be announced by this peering policy.<\/li>\n
- serviceSubnet in cluster.yaml<\/strong> (10.2.0.0\/16)<\/li>\n
- \n
![\"A](\"https:\/\/arielantigua.com\/weblog\/wp-content\/uploads\/2024\/07\/a-screenshot-of-a-computer-description-automatica-2.png\")
<\/a><\/p>\n