mirror of https://github.com/cncf/toc.git
Merge pull request #637 from tgraf/pr/tgraf/cncf-proposal
Proposal: Cilium as an Incubation project
This commit is contained in:
Amye Scavarda Perrin
GitHub
commit
b5b82abb61
|
|
@ -0,0 +1,316 @@
|
||||||
|
# Cilium Project Proposal
|
||||||
|
|
||||||
|
## Name of Project
|
||||||
|
Cilium
|
||||||
|
|
||||||
|
## Description
|
||||||
|
|
||||||
|
Cilium is an open source project for providing and transparently securing network
|
||||||
|
connectivity, and loadbalancing between application workloads such as
|
||||||
|
application containers or processes. Cilium operates at Layer 3/4 to provide
|
||||||
|
traditional networking and security services as well as Layer 7 to protect and
|
||||||
|
secure use of modern application protocols such as HTTP, gRPC and Kafka. Cilium
|
||||||
|
implements the Container Networking Interface (CNI) and integrates directly with
|
||||||
|
Kubernetes.
|
||||||
|
|
||||||
|
A new Linux kernel technology called eBPF is at the foundation of Cilium. It
|
||||||
|
supports dynamic insertion of eBPF bytecode into the Linux kernel at various
|
||||||
|
integration points such as: network IO, application sockets, and tracepoints to
|
||||||
|
implement security, networking and visibility logic. eBPF is highly efficient
|
||||||
|
and flexible. (To learn more about eBPF, visit [eBPF.io](eBPF.io).)
|
||||||
|
|
||||||
|
## Features
|
||||||
|
|
||||||
|
Simple Networking
|
||||||
|
-----------------
|
||||||
|
|
||||||
|
A simple flat Layer 3 network with the ability to span multiple clusters
|
||||||
|
connects all application containers. IP allocation is kept simple by using host
|
||||||
|
scope allocators. This means that each host can allocate IPs without any
|
||||||
|
coordination between hosts.
|
||||||
|
|
||||||
|
The following multi node networking models are supported:
|
||||||
|
|
||||||
|
* **Overlay:** Encapsulation-based virtual network spanning all hosts.
|
||||||
|
Currently VXLAN and Geneve are baked in but all encapsulation formats
|
||||||
|
supported by Linux can be enabled.
|
||||||
|
|
||||||
|
When to use this mode: This mode has minimal infrastructure and integration
|
||||||
|
requirements. It works on almost any network infrastructure as the only
|
||||||
|
requirement is IP connectivity between hosts which is typically already
|
||||||
|
given.
|
||||||
|
|
||||||
|
* **Native Routing:** Use of the regular routing table of the Linux host.
|
||||||
|
The network is required to be capable to route the IP addresses of the
|
||||||
|
application containers.
|
||||||
|
|
||||||
|
When to use this mode: This mode is for advanced users and requires some
|
||||||
|
awareness of the underlying networking infrastructure. This mode works well
|
||||||
|
with:
|
||||||
|
|
||||||
|
- Native IPv6 networks
|
||||||
|
- In conjunction with cloud network routers
|
||||||
|
- If you are already running routing daemons
|
||||||
|
|
||||||
|
|
||||||
|
Protect and secure APIs transparently
|
||||||
|
-------------------------------------
|
||||||
|
|
||||||
|
Ability to secure modern application protocols such as REST/HTTP, gRPC and
|
||||||
|
Kafka. Traditional firewalls operates at Layer 3 and 4. A protocol running on a
|
||||||
|
particular port is either completely trusted or blocked entirely. Cilium
|
||||||
|
provides the ability to filter on individual application protocol requests such
|
||||||
|
as:
|
||||||
|
|
||||||
|
- Allow all HTTP requests with method ``GET`` and path ``/public/.*``. Deny all
|
||||||
|
other requests.
|
||||||
|
- Allow ``service1`` to produce on Kafka topic ``topic1`` and ``service2`` to
|
||||||
|
consume on ``topic1``. Reject all other Kafka messages.
|
||||||
|
- Require the HTTP header ``X-Token: [0-9]+`` to be present in all REST calls.
|
||||||
|
|
||||||
|
See the section `Layer 7 Policy`_ in our documentation for the latest list of
|
||||||
|
supported protocols and examples on how to use it.
|
||||||
|
|
||||||
|
Secure service to service communication based on identities
|
||||||
|
-----------------------------------------------------------
|
||||||
|
|
||||||
|
Modern distributed applications rely on technologies such as application
|
||||||
|
containers to facilitate agility in deployment and scale out on demand. This
|
||||||
|
results in a large number of application containers to be started in a short
|
||||||
|
period of time. Typical container firewalls secure workloads by filtering on
|
||||||
|
source IP addresses and destination ports. This concept requires the firewalls
|
||||||
|
on all servers to be manipulated whenever a container is started anywhere in
|
||||||
|
the cluster.
|
||||||
|
|
||||||
|
In order to avoid this situation which limits scale, Cilium assigns a security
|
||||||
|
identity to groups of application containers which share identical security
|
||||||
|
policies. The identity is then associated with all network packets emitted by
|
||||||
|
the application containers, allowing to validate the identity at the receiving
|
||||||
|
node. Security identity management is performed using a key-value store.
|
||||||
|
|
||||||
|
Secure access to and from external services
|
||||||
|
-------------------------------------------
|
||||||
|
|
||||||
|
Label based security is the tool of choice for cluster internal access control.
|
||||||
|
In order to secure access to and from external services, traditional CIDR based
|
||||||
|
security policies for both ingress and egress are supported. This allows to
|
||||||
|
limit access to and from application containers to particular IP ranges.
|
||||||
|
|
||||||
|
Load balancing
|
||||||
|
--------------
|
||||||
|
|
||||||
|
Distributed load balancing for traffic between application containers and to
|
||||||
|
external services. The loadbalancing is implemented using BPF using efficient
|
||||||
|
hashtables allowing for almost unlimited scale and supports direct server
|
||||||
|
return (DSR) if the loadbalancing operation is not performed on the source
|
||||||
|
host.
|
||||||
|
*Note: load balancing requires connection tracking to be enabled. This is the
|
||||||
|
default.*
|
||||||
|
|
||||||
|
Monitoring and Troubleshooting
|
||||||
|
------------------------------
|
||||||
|
|
||||||
|
The ability to gain visibility and to troubleshoot issues is fundamental to the
|
||||||
|
operation of any distributed system. While we learned to love tools like
|
||||||
|
``tcpdump`` and ``ping`` and while they will always find a special place in our
|
||||||
|
hearts, we strive to provide better tooling for troubleshooting. This includes
|
||||||
|
tooling to provide:
|
||||||
|
|
||||||
|
- Event monitoring with metadata: When a packet is dropped, the tool doesn't
|
||||||
|
just report the source and destination IP of the packet, the tool provides
|
||||||
|
the full label information of both the sender and receiver among a lot of
|
||||||
|
other information.
|
||||||
|
|
||||||
|
- Policy decision tracing: Why is a packet being dropped or a request rejected.
|
||||||
|
The policy tracing framework allows to trace the policy decision process for
|
||||||
|
both, running workloads and based on arbitrary label definitions.
|
||||||
|
|
||||||
|
- Metrics export via Prometheus: Key metrics are exported via Prometheus for
|
||||||
|
integration with your existing dashboards.
|
||||||
|
|
||||||
|
- [Hubble](https://github.com/cilium/hubble/): An observability platform specifically written for Cilium. It
|
||||||
|
provides service dependency maps, operational monitoring and alerting,
|
||||||
|
and application and security visibility based on flow logs.
|
||||||
|
|
||||||
|
## Sponsor / Advisor from TOC
|
||||||
|
Justin Cormack
|
||||||
|
|
||||||
|
## Unique Identifier
|
||||||
|
cilium
|
||||||
|
|
||||||
|
## License
|
||||||
|
|
||||||
|
* The main agent is licensered under [Apache 2.0](https://github.com/cilium/cilium/blob/master/LICENSE)
|
||||||
|
* Portions of the eBPF datapath code are licensed under the [GPL](https://github.com/cilium/cilium/blob/master/bpf/COPYING)
|
||||||
|
|
||||||
|
## Maturity Level
|
||||||
|
|
||||||
|
Incubating
|
||||||
|
|
||||||
|
## Source control repositories
|
||||||
|
|
||||||
|
https://github.com/cilium
|
||||||
|
|
||||||
|
## External dependencies
|
||||||
|
|
||||||
|
From [go.mod](https://github.com/cilium/cilium/blob/master/go.mod):
|
||||||
|
|
||||||
|
- github.com/Azure/azure-sdk-for-go MIT License
|
||||||
|
- github.com/Azure/go-autorest Apaache 2.0
|
||||||
|
- github.com/asaskevich/govalidator MIT License
|
||||||
|
- github.com/aws/aws-sdk-go-v2 Apache 2.0
|
||||||
|
- github.com/aws/smithy-go Apache 2.0
|
||||||
|
- github.com/blang/semver MIT License
|
||||||
|
- github.com/cncf/udpa Apache 2.0
|
||||||
|
- github.com/containernetworking/cni Apache 2.0
|
||||||
|
- github.com/containernetworking/plugins Apache 2.0
|
||||||
|
- github.com/davecgh/go-spew ISC License
|
||||||
|
- github.com/docker/distribution Apache 2.0
|
||||||
|
- github.com/docker/docker Apache 2.0
|
||||||
|
- github.com/docker/go-connections Apache 2.0
|
||||||
|
- github.com/docker/libnetwork Apache 2.0
|
||||||
|
- github.com/fsnotify/fsnotify BSD-3-Clause
|
||||||
|
- github.com/go-bindata/go-bindata Public Domain
|
||||||
|
- github.com/go-openapi/errors Apache 2.0
|
||||||
|
- github.com/go-openapi/loads APache 2.0
|
||||||
|
- github.com/go-openapi/runtime Apache 2.0
|
||||||
|
- github.com/go-openapi/spec Apache 2.0
|
||||||
|
- github.com/go-openapi/strfmt Apache 2.0
|
||||||
|
- github.com/go-openapi/swag Apache 2.0
|
||||||
|
- github.com/go-openapi/validate Apache 2.0
|
||||||
|
- github.com/gogo/protobuf BSD-3-Clause
|
||||||
|
- github.com/golang/protobuf BSD-3-Clause
|
||||||
|
- github.com/google/go-cmp BSD-3-Clause
|
||||||
|
- github.com/google/gopacket BSD-3-Clause
|
||||||
|
- github.com/google/gops BSD-3-Clause
|
||||||
|
- github.com/google/renameio Apache 2.0
|
||||||
|
- github.com/google/uuid BSD-3-Clause
|
||||||
|
- github.com/gorilla/mux BSD-3-Clause
|
||||||
|
- github.com/hashicorp/consul/api MPL-2.0
|
||||||
|
- github.com/hashicorp/go-immutable-radix MPL-2.0
|
||||||
|
- github.com/hashicorp/golang-lru MPL-2.0
|
||||||
|
- github.com/ishidawataru/sctp Apache 2.0
|
||||||
|
- github.com/jeremywohl/flatten MIT
|
||||||
|
- github.com/kevinburke/ssh_config MIT
|
||||||
|
- github.com/kr/pretty MIT
|
||||||
|
- github.com/mattn/go-shellwords MIT
|
||||||
|
- github.com/miekg/dns BSD-3-Clause
|
||||||
|
- github.com/morikuni/aec MIT
|
||||||
|
- github.com/onsi/ginkgo MIT
|
||||||
|
- github.com/onsi/gomega MIT
|
||||||
|
- github.com/opencontainers/go-digest Apache 2.0
|
||||||
|
- github.com/opencontainers/image-spec Apache 2.0
|
||||||
|
- github.com/optiopay/kafka MIT
|
||||||
|
- github.com/pmezard/go-difflib https://github.com/pmezard/go-difflib/blob/master/LICENSE
|
||||||
|
- github.com/prometheus/client_golang Apache 2.0
|
||||||
|
- github.com/prometheus/client_model Apache 2.0
|
||||||
|
- github.com/russross/blackfriday/v2 Simplified BSD
|
||||||
|
- github.com/sasha-s/go-deadlock Apache 2.0
|
||||||
|
- github.com/servak/go-fastping MIT
|
||||||
|
- github.com/shirou/gopsutil/v3 BSD
|
||||||
|
- github.com/sirupsen/logrus MIT
|
||||||
|
- github.com/spf13/cobra Apache 2.0
|
||||||
|
- github.com/spf13/pflag BSD-3-Clause
|
||||||
|
- github.com/spf13/viper MIT
|
||||||
|
- github.com/stretchr/testify MIT
|
||||||
|
- github.com/vishvananda/netlink Apache 2.0
|
||||||
|
- github.com/vishvananda/netns Apache 2.0
|
||||||
|
- go.etcd.io/etcd Apache 2.0
|
||||||
|
- go.uber.org/goleak MIT
|
||||||
|
- golang.org/x/crypto BSD-3-Clause
|
||||||
|
- golang.org/x/net BSD-3-Clause
|
||||||
|
- golang.org/x/sync BSD-3-Clause
|
||||||
|
- golang.org/x/sys BSD-3-Clause
|
||||||
|
- golang.org/x/time BSD-3-Clause
|
||||||
|
- golang.org/x/tools BSD-3-Clause
|
||||||
|
- google.golang.org/genproto Apache 2.0
|
||||||
|
- google.golang.org/grpc Apache 2.0
|
||||||
|
- google.golang.org/protobuf BSD-3-Clause
|
||||||
|
- gopkg.in/check.v1 BSD-3-Clause
|
||||||
|
- gopkg.in/ini.v1 Apache 2.0
|
||||||
|
- gopkg.in/natefinch/lumberjack.v2 MIT
|
||||||
|
- gopkg.in/yaml.v2 Apache 2.0
|
||||||
|
- k8s.io/api Apache 2.0
|
||||||
|
- k8s.io/apiextensions-apiserver Apache 2.0
|
||||||
|
- k8s.io/apimachinery Apache 2.0
|
||||||
|
- k8s.io/client-go Apache 2.0
|
||||||
|
- k8s.io/code-generator Apache 2.0
|
||||||
|
- k8s.io/klog/v2 Apache 2.0
|
||||||
|
- k8s.io/kube-openapi Apache 2.0
|
||||||
|
- sigs.k8s.io/controller-tools Apache 2.0
|
||||||
|
- sigs.k8s.io/structured-merge-diff/v4 Apache 2.0
|
||||||
|
- sigs.k8s.io/yaml MIT
|
||||||
|
|
||||||
|
### Runtime dependencies
|
||||||
|
|
||||||
|
- LLVM Apache 2.0
|
||||||
|
- iproute2 GPL
|
||||||
|
|
||||||
|
## Issue tracker
|
||||||
|
|
||||||
|
See [https://github.com/cilium/cilium/issues](https://github.com/cilium/cilium/issues)
|
||||||
|
|
||||||
|
## Initial committers
|
||||||
|
|
||||||
|
See [MAINTAINERS](https://github.com/cilium/cilium/blob/master/MAINTAINERS.md)
|
||||||
|
|
||||||
|
There are currently committers from eight companies, with the majority from Isovalent. The company block vote limit described in the [project governance](https://docs.cilium.io/en/latest/contributing/governance/commit_access/#company-block-vote-limit) already ensures that Isovalent do not have a controlling majority vote.
|
||||||
|
|
||||||
|
## Infrastructure requirements (CI / CNCF Cluster)
|
||||||
|
|
||||||
|
N/A
|
||||||
|
|
||||||
|
## Statement on alignment with CNCF mission
|
||||||
|
|
||||||
|
Cilium's misson is to provide open source networking and network security for
|
||||||
|
the cloud native ecosystem. Cilium is deeply integrated with Kubernetes, etcd,
|
||||||
|
Prometheus, Envoy, and other CNCF projects. More and more users are adopting Cilium
|
||||||
|
and making it a key part of their infrastructure. As such, there is a mutual
|
||||||
|
interest in building a strong community involving Cilium core developers and
|
||||||
|
users to provide a neutral home for Cilium, and guarantee open governance for
|
||||||
|
the future.
|
||||||
|
|
||||||
|
## Communication channels
|
||||||
|
|
||||||
|
- Slack: http://cilium.io/slack (5877 members)
|
||||||
|
- GitHub: https://github.com/cilium/cilium
|
||||||
|
|
||||||
|
## Website
|
||||||
|
|
||||||
|
https://cilium.io/
|
||||||
|
|
||||||
|
## Release methodology and mechanics
|
||||||
|
|
||||||
|
Cilium employs semantic versioning to name each release ([release process details](https://docs.cilium.io/en/v1.9/contributing/release/)) and compiled container images hosted on [Quay](https://quay.io/repository/cilium/cilium) and [Docker Hub](https://hub.docker.com/u/cilium). SHA256 checksums are provided for all distributed binaries. The release process is fully automated. A new minor release is released every 4 months with extensive release notes. In between minor releaess, micro releaes for the last 3 minor releases are provided regularly with backports of crucial bugfixes and security fixes.
|
||||||
|
|
||||||
|
## Security processes
|
||||||
|
|
||||||
|
See [SECURITY.md](https://github.com/cilium/cilium/blob/master/SECURITY.md)
|
||||||
|
|
||||||
|
## Roadmap
|
||||||
|
|
||||||
|
The roadmap is driven by community requests and feedback:
|
||||||
|
* GitHub [issues](https://github.com/cilium/cilium/issues?q=is%3Aopen+is%3Aissue+label%3Akind%2Fenhancement) with the `enhancement` label
|
||||||
|
* Annual public user surveys ([2021 survey](https://cilium.io/blog/2021/02/25/user-survey-2021))
|
||||||
|
|
||||||
|
The features committed to the next release are tracked in GitHub projects ([1.10 release example](https://github.com/cilium/cilium/projects/131)).
|
||||||
|
|
||||||
|
## Social media account
|
||||||
|
Twitter: https://twitter.com/ciliumproject
|
||||||
|
|
||||||
|
## Community size
|
||||||
|
|
||||||
|
Adopters: Adobe, Alibaba, Canonical, Datadog, DigitalOcean, GitLab, Google, SAP Concur, etc.
|
||||||
|
See [USERS.md](https://github.com/cilium/cilium/blob/master/USERS.md) for a list of over 20 publicly-announced adopters.
|
||||||
|
|
||||||
|
GitHub stars: +7.8K
|
||||||
|
|
||||||
|
Container image pulls: +100M across Docker Hub + Quay
|
||||||
|
|
||||||
|
Slack: 5800+ members
|
||||||
|
|
||||||
|
As of April 6, 2021, we have 263 people who have directly contributed code to
|
||||||
|
the main repository cilium/cilium. Numerous people have contributed by
|
||||||
|
reporting issues, testing, helping out on Slack, and so on.
|
||||||
|
|
||||||
|
We hold a weekly community meeting with 20-40 attendees each week.
|
||||||
Loading…
Reference in New Issue