Cilium Up and Running (Nico Vibert, Filip Nikolic, James Laverack)（Z-Library）

# Cilium: Up and Running — Reading Guide ## 【One-Line Pitch】 A practical, comprehensive guide to mastering Cilium—the de facto cloud native networking, security, and observability platform for Kubernetes—written by core maintainers who helped build it. Essential reading for platform engineers, network architects, and SREs who want to move beyond basic Kubernetes networking and run Cilium confidently in production. ## 【Book Arc】 - **Opening (~0%–9%)**: Foreword by Cilium's cocreator Thomas Graf sets the stage—the project's journey from a bold eBPF experiment to CNCF-graduated critical infrastructure powering stock exchanges, AI clusters, and hyperscale platforms. Establishes the book's credibility and the technology's real-world significance. - **Early (~16%–28%)**: The preface and introductory material frame the core problem—Kubernetes clusters are cluttered with dozens of purpose-built networking tools (CNIs, proxies, service meshes, ingress controllers). The authors position Cilium as the emerging unified layer for cloud native networking, security, and observability, and outline what readers need to know (Kubernetes familiarity, IP networking fundamentals) plus how to follow along with examples using kind or the free companion lab. - **Early (~34%)**: Chapter 1 ("Why Cilium?") traces Kubernetes' rise as the standard API for cloud native applications, then explains why traditional networking stacks (iptables-based CNIs like Flannel, Weave Net, and Calico) struggle with Kubernetes' scale and dynamism—setting up the need for a fundamentally different approach. - **Middle (~38%–44%)**: The book introduces eBPF as the enabling kernel technology, covering its origins, primary use cases (observability, security, load balancing), and why its parallel rise with Kubernetes was no coincidence. Cilium's own origin story follows—from a modest 2015 commit to a platform with Cluster Mesh, transparent encryption, Hubble observability, and sidecar-free service mesh capabilities. - **Middle (~47%–53%)**: Industry adoption is documented—Google (GKE Dataplane V2), Amazon (EKS Anywhere), and Microsoft (Azure CNI) all chose Cilium, making it the default networking layer for many users who never made an explicit choice. The chapter covers Cilium's 2023 CNCF graduation (the only graduated project in Cloud Native Networking) and begins exploring Cilium's core architectural capabilities, including node connectivity, overlay networks, and IP address management. ## 【Key Takeaways】 - **The problem Cilium solves is tool sprawl** (Early): Kubernetes clusters today accumulate CNIs, proxies, service meshes, ingress controllers, and multicluster utilities—each a separate system to maintain. Cilium consolidates networking, security, and observability into one eBPF-powered layer, addressing the "cognitive exhaustion" of managing dozens of tools. - **eBPF is the enabling technology** (Middle): Cilium's power comes from eBPF, which allows programmable packet processing inside the Linux kernel without modifying kernel source or loading modules. This enables performance that iptables-based approaches can't match, especially at scale. - **Traditional CNIs hit a scalability wall** (Middle): Early implementations like Flannel and Weave Net focused on basic connectivity with limited policy support; Calico added BGP-based policy but still depended on iptables for filtering, NAT, and load balancing. These rules had to be continually updated as pods churned, making them inefficient at Kubernetes scale. - **Cilium's rise was no accident** (Middle): The parallel emergence of Kubernetes and eBPF in 2014 was more than coincidence—Kubernetes needed a networking foundation that could keep up with its dynamism, and eBPF provided the programmable kernel power to make it possible. - **Industry adoption validates production readiness** (Middle): Google, Amazon, and Microsoft independently chose Cilium for their managed Kubernetes offerings (GKE Dataplane V2, EKS Anywhere, Azure CNI), signaling that it meets the demands of multitenant, hyperscale environments—and making it a safe, future-proof choice for self-managed clusters. - **CNCF graduation is a maturity milestone** (Middle): Cilium's 2023 graduation from CNCF incubating status—after just two years—required demonstrating technical stability, governance, security processes, and multi-organization contributions. It remains the only graduated project in the Cloud Native Networking category. - **Cilium is critical infrastructure, not just a tool** (Opening): The foreword emphasizes that Cilium now powers stock exchanges, massive AI training clusters, sports stadiums, and financial institutions—a responsibility the maintainers take seriously and a signal of the platform's real-world reliability. ## 【Reading Tips】 - **Skim the foreword and preface** (~0%–16%): These sections establish context and credibility but contain little technical content. Read them quickly to understand the book's philosophy, then move to the substance. - **Deep-read Chapter 1 and the eBPF introduction** (~34%–44%): This is where the conceptual foundation is laid. Understanding why iptables-based approaches fail at scale and how eBPF solves that problem is essential for everything that follows. If you're new to eBPF, consider pairing this with Liz Rice's *Learning eBPF* as the authors suggest. - **Pay attention to the "why" before the "how"** (throughout): The authors are core maintainers who emphasize not just running Cilium, but running it *well*. Focus on the architectural reasoning and design decisions, not just the commands. - **Use the companion resources**: The book includes downloadable examples from GitHub and a free online companion lab on Isovalent.com. Most features can be tested locally with kind, making hands-on practice accessible at no cost—take advantage of this. - **Note the chapter roadmap** (Early): The preface outlines the book's structure (16 chapters, including Hubble for observability and operations). Use this map to jump to relevant chapters if you're using the book as a reference rather than reading cover to cover. ## 【Coverage Limits】 This guide is based on excerpts covering approximately the first half of the book (through ~53%). The excerpts do not cover the detailed technical chapters on Cilium installation, configuration, network policies, service mesh, Cluster Mesh, Hubble observability, or production operations—these are mentioned in the roadmap but not detailed in the source material. ##