1"use strict";(self.webpackChunkcilium_io=self.webpackChunkcilium_io||[]).push([[1915],{5074:function(n,e,a){a.r(e),a.d(e,{Head:function(){return d},default:function(){return m}});var t=a(8453),s=a(6540);function o(n){const e=Object.assign({span:"span",p:"p",a:"a",h2:"h2",ul:"ul",li:"li",strong:"strong",blockquote:"blockquote",h1:"h1",em:"em",h3:"h3",img:"img"},(0,t.RP)(),n.components);return s.createElement(s.Fragment,null,s.createElement(e.span,{dangerouslySetInnerHTML:{__html:'<span\n class="gatsby-resp-image-wrapper"\n style="position: relative; display: block; margin-left: auto; margin-right: auto; max-width: 698px; "\n >\n <span\n class="gatsby-resp-image-background-image"\n style="padding-bottom: 39.682539682539684%; position: relative; bottom: 0; left: 0; background-image: url(\'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAICAYAAAD5nd/tAAAACXBIWXMAAAsTAAALEwEAmpwYAAAB2ElEQVR42l2Sb1MSURTG+WZ9j170LXrTOOP0xuFF0/8ZqQFDpshCkDJSIgQRdBFoFxB2RReiUFnQxYQxlZZf224wjnfm3HnOPWee+5w/Dq6d3xcXpl3S7nQ5/XXG5dWQ4fDPtYyRdV+dNUju+nmmtjg37PeRHcJhuf+dt4EQLt97Aqky/qjAU5cHuVSe0HU6x4TngmSdTqTZW9z23eWO5xNKoWjFDcPAMTJsttOCSGVzi7Z2xLvVDJFk1sSHdNcSGL2elaPuq6TXN1DyNWLPJdbfRMmLEtWKYoqyeRxj0P/eJLuZo9o44N7MY2ZfB6k1D6mJ5u+GXbYoiezWZPTeCa4ZD/NuP/3zPpqmMRgMbhAO+rwKruBd2SIQz7EQy+EKREluZicl71XrxAIpUqE8zikngRcRMp9FhETO7rDJ5Rj3T67KxOJx0hmBTC5HWshSMBWtJRLoJ7pdcqVJ+MEGiZBA7OMyXxZXWXB+QIiUGM/CGoqu67jnvfz4VqebUdnZrlIRazSqB3yNJQmGlmyFpZ9478/hezLF4lKYl4+mcU8/JLP8j9CwlsAxlqo26sj5Cuq2jCIp7BRNk0wsK2idjkV4fNSjEC+yV96n0+rRbuqoeY1GpTXZqr+Z9zUs/ohcBgAAAABJRU5ErkJggg==\'); background-size: cover; display: block;"\n ></span>\n <picture>\n <source\n srcset="/static/555ff43ad748c26e6d95763f477ec4cb/2ff5b/gopher_intro.webp 252w,\n/static/555ff43ad748c26e6d95763f477ec4cb/4d583/gopher_intro.webp 504w,\n/static/555ff43ad748c26e6d95763f477ec4cb/8a92d/gopher_intro.webp 698w"\n sizes="(max-width: 698px) 100vw, 698px"\n type="image/webp"\n />\n <source\n srcset="/static/555ff43ad748c26e6d95763f477ec4cb/019e
10/gopher_intro.png 252w,\n/static/555ff43ad748c26e6d95763f477ec4cb/0dcb2/gopher_intro.png 504w,\n/static/555ff43ad748c26e6d95763f477ec4cb/9a68b/gopher_intro.png 698w"\n sizes="(max-width: 698px) 100vw, 698px"\n type="image/png"\n />\n <img\n class="gatsby-resp-image-image"\n src="/static/555ff43ad748c26e6d95763f477ec4cb/9a68b/gopher_intro.png"\n alt="Cilium Kubernetes"\n title=""\n loading="lazy"\n decoding="async"\n style="width:100%;height:100%;margin:0;vertical-align:middle;position:absolute;top:0;left:0;"\n />\n </picture>\n </span>'}}),"\n",s.createElement(e.p,null,"We are excited to announce the Cilium 1.3 release. The release introduces\nseveral new features. The major highlight of the release is the addition of Go\nextensions for ",s.createElement(e.a,{href:"https://github.com/envoyproxy/envoy"},"Envoy")," as well as Cassandra and Memcached protocol parsers with\npolicy enforcement capability, both implemented as Envoy Go extension."),"\n",s.createElement(e.p,null,"As usual, a big shout out to the entire community of Cilium developers who have\ncontributed 785 commits in the time period between 1.2 and 1.3."),"\n",s.createElement("a",{id:"what-are-envoy-go-extensions"}),"\n",s.createElement(e.h2,null,"What are Envoy Go extensions?"),"\n",s.createElement(e.p,null,"We have been relying on ",s.createElement(e.a,{href:"https://github.com/envoyproxy/envoy"},"Envoy")," for all processing of HTTP and gRPC as well as\nHTTP derivates such as Elasticsearch since version 1.0. As the community\ndiscussed how to extend the scope of supported L7 protocols, it became clear\nthat Envoy is the right platform to drive future protocol additions. The focus\nquickly shifted to finding ways to simplify the extendability of Envoy and\nallow reuse of existing open source projects such as the CNCF project ",s.createElement(e.a,{href:"https://vitess.io/"},"Vitess"),".\nThe idea of Go extensions for Envoy was born."),"\n",s.createElement(e.p,null,"With Cilium 1.3, we introduce Go extensions for Envoy as a Beta feature."),"\n",s.createElement(e.span,{dangerouslySetInnerHTML:{__html:'<span\n class="gatsby-resp-image-wrapper"\n style="position: relative; display: block; margin-left: auto; margin-right: auto; max-width: 781px; "\n >
1\n <span\n class="gatsby-resp-image-background-image"\n style="padding-bottom: 54.36507936507936%; position: relative; bottom: 0; left: 0; background-image: url(\'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAALCAYAAAB/Ca1DAAAACXBIWXMAAAsTAAALEwEAmpwYAAACxUlEQVR42iWSW2/jRBSA847ghZ/AIz+CVwTsKz8B8QMQ70ggBBIIBELAihVC2l0QS2kbWEq3TdI2zaVp2iaOnTSOEzt3J41zcezYTuxvp+1IZzRnzplvzi1mWNfspXfIykmmvolxU2fvZIfTqwNm/oimWRX6NqnCHhN3QHeqcZD9l2wldWcfLFoY0yqtqYy1GhJb+jOuDYm2qeIEc8aLPmflNJJaxNnMmNgDinIWWbsU9inmrEuudExFuxD6DNu3GC06zFYmq7VDDLGCcM1q4+MJsQOb5XohdA/bs8Ujl010a/PuzkEU4G6WuGshQl96jiCsyVcG/Lwl3wJDDssrniU1jvISp2VVpODTnkS0bny0kYe/CcnWAv5M6hwXZFJFGcMKaFsRzbFHfx6QUSy2jnrEIiLUgU+x0SNfK3NazZMT6RabioDZqEMRhb9GG/qcqwPOriUytQIFrcRFSxH2uairR1pZ8bzgEQvDSBR2jdTXORC12a/8zdPEL8TP/6A+GtMYuSL1NSMnpDLs8qJ0xP/SNk9Tj9gpPKY67NOcBZjNMQu5fV/DRmlI9R+dRXVDOzcks12gftJhoUDrao69iWjXJyjxJpbi0ymYnGxlqR23mMshhmRzY9qEC/ceqF5qFJ/E6edVro80qqkG8oGEkcihZUV3IwFWuhR+i9PLCp9kEyVRR9ovC59ztEyJ2dK/Rd0DDeknMg9fpZF+n6q5QRmJT+THJL57hV7iTdYhtBu7nP74Gs2TB8LHQxmDpj4n+cPrtPffwHWte6ATiJRzn1D77x3Khx/y+ZMOH317xoudz6jtvY2efMBw3EOXHqHsvkXl8AO+/F3n4++viP/1BfX999AT79LtlsS8CODtNjfTLLWvmHR2ReccLlsu3U5R3H3NXP9VzFuEbZVY1D/FMp6JCXAoait04wJb+4Z56yGOO7+L8CX7dQqHj2VpRQAAAABJRU5ErkJggg==\'); background-size: cover; display: block;"\n ></span>\n <picture>\n <source\n srcset="/static/44da76cca428d74aed52b111bc4136da/2ff5b/ogimage.webp 252w,\n/static/44da76cca428d74aed52b111bc4136da/4d583/ogimage.webp 504w,\n/static/44da76cca428d74aed52b111bc4136da/8b59e/ogimage.webp 781w"\n sizes="(max-width: 781px) 100vw, 781px"\n type="image/webp"\n />\n <source\n srcset="/static/44da76cca428d74aed52b111bc4136da/019e0/ogimage.png 252w,\n/static/44da76cca428d74aed52b111bc4136da/0dcb2/ogimage.png 504w,\n/static/44da76cca428d74aed52b111bc4136da/f4c47/ogimage.png 781w"\n sizes="(max-width: 781px) 100vw, 781px"\n type="image/png"\n />\n <img\n class="gatsby-resp-image-image"\n src="/static/44da76cca428d74aed52b111bc4136da/f4c47/ogimage.png"\n alt="Envoy Golang Extension Architecture"\n title=""\n loading="lazy"\n decoding="async"\n style="width:100%;height:100%;margin:0;vertical-align:middle;position:absolute;top:0;left:0;"\n />\n </picture>\n </span>'}}),"\n",s.createElement(e.ul,null,"\n",s.createElement(e.li,null,"\n",s.createElement(e.p,null,s.createElement(e.strong,null,"Transparent injection of extensions:")," With the help of Cilium, connections\nare transparently redirected to Envoy without requiring to modify the\napplication or pod. Redirects are configured based on destination ports and can be restricted to source or destination services based on labels, IPs, DNS\nnames, and service names for both ingress and egress connections and map\nconnections to extensions via the extension's name. The redirects are\nconfigured via the CiliumNetworkPolicy CRD or a REST API. Envoy can be\nconfigured to run either as a sidecar in each pod or as a standalone proxy, one\nper node."),"\n"),"\n",s.createElement(e.li,null,"\n",s.createElement(e.p,null,s.createElement(e.strong,null,"Fully distributed:")," Go extensions run fully distributed inside of Envoy on\neach node or inside each pod and do not require a centralized control plane\nfor data processing. The go extensions themselves can, of course, call out to\narbitrary control plane components to report telemetry or validate\nrequests."),"\n"),"\n",s.createElement(e.li,null,"\n",s.createElement(e.p,null,s.createElement(e.strong,null,"Dynamic extensions mapping:")," Go extensions are made available to Envoy as\na shared library. Cilium configures Envoy to automatically load the\nrespective Go extension based on the configured redirects and invoke it when\ndata for such a connection. Future releases will offer support to update and\nre-load extensions at runtime without restarting Envoy and without losing\nconnection state."),"\n"),"\n",s.createElement(e.li,null,"\n",s.createElement(e.p,null,s.createElement(e.strong,null,"Extension configuration via CRD:")," Go extensions are configured using\ngeneric key-value pairs via either the CRD or a REST API. This allows passing\nconfiguration such as security policies, security tokens or other\nconfiguration without requiring to make Envoy itself aware of it."),"\n"),"\n",s.createElement(e.li,null,"\n",s.createElement(e.p,null,s.createElement(e.strong,null,"Generic access logging:")," Similar to the configuration, extensions are able\nto return generic key-value pairs which will make its way
1into the access log\nto allow passing extracted visibility into the access log layer."),"\n"),"\n",s.createElement(e.li,null,"\n",s.createElement(e.p,null,s.createElement(e.strong,null,"Sandboxed")," A sandbox ensures that any parser instability\ncannot destabilize the mature core of Envoy. Inspired by Matt Klein's post\n",s.createElement(e.a,{href:"https://medium.com/@mattklein123/exceptional-go-1dd1488a6a47"},"Exceptional Go"),",\nparsers are allowed to panic to raise exceptions. When a panic occurs,\ninformation is logged to the access log and the TCP connection associated\nwith the request is closed."),"\n"),"\n"),"\n",s.createElement(e.h2,null,"What is Cilium?"),"\n",s.createElement(e.p,null,"Cilium is open source software for transparently providing and securing the\nnetwork and API connectivity between application services deployed using Linux\ncontainer management platforms like Kubernetes, Docker, and Mesos."),"\n",s.createElement(e.p,null,"At the foundation of Cilium is a new Linux kernel technology called BPF, which\nenables the dynamic insertion of powerful security, visibility, and networking\ncontrol logic within Linux itself. Besides providing traditional network level\nsecurity, the flexibility of BPF enables security on API and process level to\nsecure communication within a container or pod. Because BPF runs inside the\nLinux kernel, Cilium security policies can be applied and updated without any\nchanges to the application code or container configuration."),"\n",s.createElement(e.p,null,"See the section ",s.createElement(e.strong,null,s.createElement(e.a,{href:"https://cilium.readthedocs.io/en/v1.3/intro/"},"Introduction to\nCilium"))," for a more detailed general\nintroduction to Cilium."),"\n",s.createElement("a",{id:"what-is-envoy"}),"\n",s.createElement(e.h2,null,"What is Envoy?"),"\n",s.createElement(e.p,null,"Envoy is an L7 proxy and communication bus designed for large modern\nservice-oriented architectures. The project was born out of the belief that:"),"\n",s.createElement(e.blockquote,null,"\n",s.createElement(e.p,null,"The network should be transparent to applications. When network and\napplication problems do occur it should be easy to determine the source of\nthe problem."),"\n"),"\n",s.createElement(e.p,null,"You can learn more about Envoy in the section ",s.createElement(e.a,{href:"https://www.envoyproxy.io/docs/envoy/latest/intro/what_is_envoy"},"What is\nEnvoy")," of the\nEnvoy documentation."),"\n",s.createElement("a",{id:"how-to-write-an-envoy-go-extension"}),"\n",s.createElement(e.h1,null,"How to write an Envoy Go extension"),"\n",s.createElement(e.p,null,'Writing extensions for Envoy is simple. To illustrate this, we will implement a\nbasic protocol parser for the R2-D2 control protocol and implement filtering\nlogic to exclude any control request that contains the string "C-3PO".'),"\n",s.createElement(e.span,{dangerouslySetInnerHTML:{__html:'<span\n class="gatsby-resp-image-wrapper"\n style="position: relative; display: block; margin-left: auto; margin-right: auto; max-width: 736px; "\n >
1\n <span\n class="gatsby-resp-image-background-image"\n style="padding-bottom: 48.41269841269841%; position: relative; bottom: 0; left: 0; background-image: url(\'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAKCAYAAAC0VX7mAAAACXBIWXMAAAsTAAALEwEAmpwYAAACT0lEQVR42pWS2U5TURhGz4Vv4RN471P4DN4ajU9gUKNcYoIJoEElxigSIQpGQiCVobQFOgh2nqfT+ZyW0tPWM7SndLlBE8Olf7KyL3ay9v6/fBL/MeO/p25BsXJGv/8LewSGaaMbNrY9RmpqQ5R2F1Vw1jPpicv+JaMr9AS6NboUdtQUB9/fEPS8pxBZw1R2GKgORv0M0uZJj21vkp2jOIlSl6oG+eZAYF0hp1qU2gPOL4yaG9k7Qdw5QTc5BfWXUJmGrgcprTTxZ8L8kAO4ky7cKSeJRpl8yyDX7Ap6f+lSViucj/royh6xvUfo8jy03wnhAlRfCKEXKV5v4Ir62PCtsLj5iiXHPEeJADlFI6te0P2D0kEWQn1oMtYOhfAhpeMptPQMo8rrf8JMvsfPjzGiqznyTpXDlQjxrTKKXydb7FEQaxZaFoWmQbV1imHb0PehpabIHU6SO3iKIc9BY1Y8JFbOFmqEvyxScq6T23eQ2l7Fv7ZA2bWOXG1R6ojsTg2Rn06t3RI/HGIaWVKRD6SiSyilNeT0MnX5M5aeQioXN/C9vY7uvYmanKEfvEXxm8TYc41yfotQUSNWrBHMlMjWWpi2TsuoE5JPOIi48MY9nOQDpJtxzsxTJM/uHP45CdVxg3pwksTuPSI79zFCt3F5Vnm8qPH8U4y7T5b56sxc1qbVr5JXo/iiTvyxfbL1MLVeho6hIoUjbqKOO1QDD9ALszRjz2gnpzHlWSoNmVBpQKTY5jitIoscL2Y4GmBYOubAwBqYmJYhyq2LYg/5DYenxtM/JTNSAAAAAElFTkSuQmCC\'); background-size: cover; display: block;"\n ></span>\n <picture>\n <source\n srcset="/static/4e6a76dec0afb23a09dd57bbe7f08975/2ff5b/envoy_go.webp 252w,\n/static/4e6a76dec0afb23a09dd57bbe7f08975/4d583/envoy_go.webp 504w,\n/static/4e6a76dec0afb23a09dd57bbe7f08975/3dfec/envoy_go.webp 736w"\n sizes="(max-width: 736px) 100vw, 736px"\n type="image/webp"\n />\n <source\n srcset="/static/4e6a76dec0afb23a09dd57bbe7f08975/019e0/envoy_go.png 252w,\n/static/4e6a76dec0afb23a09dd57bbe7f08975/0dcb2/envoy_go.png 504w,\n/static/4e6a76dec0afb23a09dd57bbe7f08975/473d6/envoy_go.png 736w"\n sizes="(max-width: 736px) 100vw, 736px"\n type="image/png"\n />\n <img\n class="gatsby-resp-image-image"\n src="/static/4e6a76dec0afb23a09dd57bbe7f08975/473d6/envoy_go.png"\n alt="Envoy Golang Extension Architecture"\n title=""\n loading="lazy"\n decoding="async"\n style="width:100%;height:100%;margin:0;vertical-align:middle;position:absolute;top:0;left:0;"\n />\n </picture>\n </span>'}}),"\n",s.createElement(e.p,null,"The primary API for an extension to implement is the ",s.createElement(e.span,{dangerouslySetInnerHTML:{__html:'<code class="language-text">OnData()</code>'}})," function\nwhich is invoked whenever Envoy is receiving data on a connection that has been\nmapped to an extension via the ",s.createElement(e.span,{dangerouslySetInnerHTML:{__html:'<code class="language-text">CiliumNetworkPolicy</code>'}}),". The function must parse\nthe data and return one of the following verdicts:"),"\n",s.createElement(e.ul,null,"\n",s.createElement(e.li,null,s.createElement(e.strong,null,"MORE:")," Parser needs more ",s.createElement(e.em,null,"n")," more bytes to continue parsing."),"\n",s.createElement(e.li,null,s.createElement(e.strong,null,"PASS:")," Pass along ",s.createElement(e.em,null,"n")," bytes of the data stream."),"\n",s.createElement(e.li,null,s.createElement(e.strong,null,"DROP:")," Drop ",s.createElement(e.em,null,"n")," bytes of the data stream."),"\n",s.createElement(e.li,null,s.createElement(e.strong,null,"INJECT:")," Inject ",s.createElement(e.em,null,"n")," bytes of data in the specified direction."),"\n",s.createElement(e.li,null,s.createElement(e.strong,null,"ERROR:")," A parsing error has occurred, the connection must be closed."),"\n",s.createElement(e.li,null,s.createElement(e.strong,null,"NOP:")," Do nothing."),"\n"),"\n",s.createElement(e.p,null,"In order to register the extension, a parser factory is created which must\nimplement a ",s.createElement(e.span,{dangerouslySetInnerHTML:{__html:'<code class="language-text">Create()</code>'}})," function. The function is called whenever Envoy\nhas established a new connection for which the parser should be used."),"\n",s.createElement(e.span,{dangerouslySetInnerHTML:{__html:'<div class="gatsby-highlight" data-language="go"><pre class="language-go"><code class="language-go"><span class="token keyword">
1import</span> <span class="token punctuation">(</span>\n <span class="token string">"github.com/cilium/cilium/proxylib/proxylib"</span>\n<span class="token punctuation">)</span>\n\n<span class="token keyword">type</span> parser <span class="token keyword">struct</span><span class="token punctuation">{</span>\n connection <span class="token operator">*</span>proxylib<span class="token punctuation">.</span>Connection\n<span class="token punctuation">}</span>\n\n<span class="token keyword">func</span> <span class="token punctuation">(</span>p <span class="token operator">*</span>parser<span class="token punctuation">)</span> <span class="token function">OnData</span><span class="token punctuation">(</span>reply<span class="token punctuation">,</span> endStream <span class="token builtin">bool</span><span class="token punctuation">,</span> dataArray <span class="token punctuation">[</span><span class="token punctuation">]</span><span class="token punctuation">[</span><span class="token punctuation">]</span><span class="token builtin">byte</span><span class="token punctuation">)</span> <span class="token punctuation">(</span>proxylib<span class="token punctuation">.</span>OpType<span class="token punctuation">,</span> <span class="token builtin">int</span><span class="token punctuation">)</span> <span class="token punctuation">{</span>\n data <span class="token operator">:=</span> <span class="token function">string</span><span class="token punctuation">(</span>bytes<span class="token punctuation">.</span><span class="token function">Join</span><span class="token punctuation">(</span>dataArray<span class="token punctuation">,</span> <span class="token punctuation">[</span><span class="token punctuation">]</span><span class="token builtin">byte</span><span class="token punctuation">{</span><span class="token punctuation">}</span><span class="token punctuation">)</span><span class="token punctuation">)</span>\n msgLen <span class="token operator">:=</span> strings<span class="token punctuation">.</span><span class="token function">Index</span><span class="token punctuation">(</span>data<span class="token punctuation">,</span> <span class="token string">"\\r\\n"</span><span class="token punctuation">)</span>\n <span class="token keyword">if</span> msgLen <span class="token operator"><</span> <span class="token number">0</span> <span class="token punctuation">{</span>\n <span class="token keyword">return</span> proxylib<span class="token punctuation">.</span>MORE<span class="token punctuation">,</span> <span class="token number">1</span> <span class="token comment">// No delimiter, request more data</span>\n <span class="token punctuation">}</span>\n\n msgStr <span class="token operator">:=</span> data<span class="token punctuation">[</span><span class="token punctuation">:</span>msgLen<span class="token punctuation">]</span>\n msgLen <span class="token operator">+=</span> <span class="token number">2</span> <span class="token comment">// Inlcude the "\\r\\n" in the request</span>\n\n <span class="token keyword">if</span> reply <span class="token punctuation">{</span>\n <span class="token keyword">return</span> proxylib<span class="token punctuation">.</span>PASS<span class="token punctuation">,</span> msgLen <span class="token comment">// Pass responses without additional parsing</span>\n <span class="token punctuation">}</span>\n\n <span class="token keyword">if</span> strings<span class="token punctuation">.</span><span class="token function">Contains</span><span class="token punctuation">(</span>msgStr<span class="token punctuation">,</span> <span class="token string">"C-3PO"</span><span class="token punctuation">)</span> <span class="token punctuation">{</span>\n <span class="token keyword">return</span> proxylib<span class="token punctuation">.</span>DROP<span class="token punctuation">,</span> msgLen\n <span class="token punctuation">}</span>\n\n <span class="token keyword">return</span> proxylib<span class="token punctuation">.</span>PASS<span class="token punctuation">,</span> msgLen\n<span class="token punctuation">}</span>\n\n<span class="token keyword">type</span> factory <span class="token keyword">
1struct</span><span class="token punctuation">{</span><span class="token punctuation">}</span>\n\n<span class="token keyword">func</span> <span class="token punctuation">(</span>f <span class="token operator">*</span>factory<span class="token punctuation">)</span> <span class="token function">Create</span><span class="token punctuation">(</span>connection <span class="token operator">*</span>proxylib<span class="token punctuation">.</span>Connection<span class="token punctuation">)</span> proxylib<span class="token punctuation">.</span>Parser <span class="token punctuation">{</span>\n <span class="token keyword">return</span> <span class="token operator">&</span>parser<span class="token punctuation">{</span>connection<span class="token punctuation">:</span> connection<span class="token punctuation">}</span>\n<span class="token punctuation">}</span>\n\n<span class="token keyword">func</span> <span class="token function">init</span><span class="token punctuation">(</span><span class="token punctuation">)</span> <span class="token punctuation">{</span>\n proxylib<span class="token punctuation">.</span><span class="token function">RegisterParserFactory</span><span class="token punctuation">(</span><span class="token string">"r2d2"</span><span class="token punctuation">,</span> <span class="token operator">&</span>factory<span class="token punctuation">{</span><span class="token punctuation">}</span><span class="token punctuation">)</span>\n<span class="token punctuation">}</span></code></pre></div>'}}),"\n",s.createElement(e.p,null,"Finally, hook the new parser into the proxylib by importing the new parser\npackage into the proxylib package. This will include the parser in the\n",s.createElement(e.span,{dangerouslySetInnerHTML:{__html:'<code class="language-text">libcilium.so</code>'}})," that is loaded by Envoy. Edit ",s.createElement(e.span,{dangerouslySetInnerHTML:{__html:'<code class="language-text">proxylib/proxylib.go</code>'}}),":"),"\n",s.createElement(e.span,{dangerouslySetInnerHTML:{__html:'<div class="gatsby-highlight" data-language="go"><pre class="language-go"><code class="language-go"><span class="token keyword">import</span> <span class="token punctuation">(</span>\n <span class="token punctuation">[</span><span class="token operator">...</span><span class="token punctuation">]</span>\n <span class="token boolean">_</span> <span class="token string">"github.com/cilium/cilium/proxylib/r2d2"</span>\n<span class="token punctuation">)</span></code></pre></div>'}}),"\n",s.createElement(e.p,null,"The above example leaves out the configuration of the extension, integration\ninto the policy repository and all aspects of access logging. See the guide\n",s.createElement(e.a,{href:"https://cilium.readthedocs.io/en/v1.3/envoy/extensions/"},"Envoy Go Extensions"),"\nfor a step by step guide on how to write a Go extension."),"\n",s.createElement("br"),"\n",s.createElement("br"),"\n",s.createElement(e.h1,null,"Cassandra Support (Beta)"),"\n",s.createElement(e.span,{dangerouslySetInnerHTML:{__html:'<span\n class="gatsby-resp-image-wrapper"\n style="position: relative; display: block; margin-left: auto; margin-right: auto; max-width: 672px; "\n >
1\n <span\n class="gatsby-resp-image-background-image"\n style="padding-bottom: 39.682539682539684%; position: relative; bottom: 0; left: 0; background-image: url(\'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAICAYAAAD5nd/tAAAACXBIWXMAAAsTAAALEwEAmpwYAAABvElEQVR42nWS228SURCH+/ca34yJDz6YaPpsLEittoZYS9BdwKQBsYtpFLkUuVUQ2oJcVthilhJYKBS2fJ5F2LQPTnKSk5kz38xv5qyxNNM0mU6n9AcDEqkUv+p1ZpZvNlvE5/P56imTyxGt3yq61uZyaCxyV/G11aVQLuF4vcN+6gg5myaQSeOWJb4mEzbQEMXCySz3tyXubri583SHV3sSTqcTXddvA88qFZHQJ/+zSERVOTo7ZTQaEYvHFp0OjQHHJxXcRZ1HhyUOW31cpR6uUJzNF1v/ilrAlYxysUhnOsPr9/Nw/THBg/DCrygK4/EYwzAolU+QP33BFTjggTuA462M970kihm2CrvDRDbDbi7PbrXGxsvnvIvFiJTKxAs/mF5d2QnXotuW2kRTG/w5bwsVQ26aDUxXq0iZJC6/l+96l/1vCtu+NyiFgrUxNE3jcySC3+cjGo0SCoUIBoN4PHt8CATo9Xq3gYnTCo7NdZ49uUc4k8cni4F7tviYy2GK7VvzbDab1Go16tYRv6DRaNBut1HFzCeTyRK4bLXR6ZAXUurdC9SLLrp5TW08odI5XwD/Zze/kwX8C0qyPvKRkcIGAAAAAElFTkSuQmCC\'); background-size: cover; display: block;"\n ></span>\n <picture>\n <source\n srcset="/static/04756b327d0e0b7bd9c44efa00e2839a/2ff5b/cassandra_go2.webp 252w,\n/static/04756b327d0e0b7bd9c44efa00e2839a/4d583/cassandra_go2.webp 504w,\n/static/04756b327d0e0b7bd9c44efa00e2839a/f275c/cassandra_go2.webp 672w"\n sizes="(max-width: 672px) 100vw, 672px"\n type="image/webp"\n />\n <source\n srcset="/static/04756b327d0e0b7bd9c44efa00e2839a/019e0/cassandra_go2.png 252w,\n/static/04756b327d0e0b7bd9c44efa00e2839a/0dcb2/cassandra_go2.png 504w,\n/static/04756b327d0e0b7bd9c44efa00e2839a/90342/cassandra_go2.png 672w"\n sizes="(max-width: 672px) 100vw, 672px"\n type="image/png"\n />\n <img\n class="gatsby-resp-image-image"\n src="/static/04756b327d0e0b7bd9c44efa00e2839a/90342/cassandra_go2.png"\n alt="Cassandra Logo"\n title=""\n loading="lazy"\n decoding="async"\n style="width:100%;height:100%;margin:0;vertical-align:middle;position:absolute;top:0;left:0;"\n />\n </picture>\n </span>'}}),"\n",s.createElement(e.p,null,s.createElement(e.a,{href:"https://github.com/apache/cassandra"},"Cassandra")," is a popular NoSQL database management system. It is often operated\nat large scale and accessed by many services and often shared between teams.\nCilium 1.3 introduces protocol support for the Apache ",s.createElement(e.a,{href:"https://github.com/apache/cassandra"},"Cassandra")," protocol\nprovide visibility and policy enforcement."),"\n",s.createElement(e.p,null,"The Cassandra Go extension is capable to provide visibility and enforcement on\nthe following protocol fields:"),"\n",s.createElement(e.ul,null,"\n",s.createElement(e.li,null,s.createElement(e.strong,null,"query_action:")," The action performed on the database ",s.createElement(e.span,{dangerouslySetInnerHTML:{__html:'<code class="language-text">SELECT</code>'}}),",\n",s.createElement(e.span,{dangerouslySetInnerHTML:{__html:'<code class="language-text">INSERT</code>'}}),", ",s.createElement(e.span,{dangerouslySetInnerHTML:{__html:'<code class="language-text">UPDATE</code>'}}),", ... The field is always matched as an exact match."),"\n",s.createElement(e.li,null,s.createElement(e.strong,null,"query_table:")," The table on which the query is executed on. Matching is\npossible with a regular expression."),"\n"),"\n",s.createElement(e.h3,null,"Example: How the Empire restricts Cassandra access by table"),"\n",s.createElement(e.p,null,"The following example shows how the Empire is exposing limited access to the\nEmpire's Cassandra cluster running on port 9042 to outposts. Outposts are\nidentified by the label ",s.createElement(e.span,{dangerouslySetInnerHTML:{__html:'<code class="language-text">app=empire-outpost</code>'}})," and have the following\nprivileges:"),"\n",s.createElement(e.ul,null,"\n",s.createElement(e.li,null,s.createElement(e.span,{dangerouslySetInnerHTML:{__html:'<code class="language-text">SELECT</code>'}}),' access on the tables "system.',s.createElement(e.em,null,'` and "system_schema.'),'"'),"\n",s.createElement(e.li,null,s.createElement(e.span,{dangerouslySetInnerHTML:{__html:'<code class="language-text">INSERT</code>'}})," on the table \"attendance.daily_records\". Note that the outposts\ncan't read from the tables and thus can't read the daily records from other\noutposts."),"\n"),"\n",s.createElement(e.span,{dangerouslySetInnerHTML:{__html:'<div class="gatsby-highlight" data-language="yaml"><pre class="language-yaml"><code class="language-yaml"><span class="token key atrule">apiVersion</span><span class="token punctuation">:</span> <span class="token string">\'cilium.io/v2\'</span>\n<span class="token key atrule">kind</span><span class="token punctuation">:</span> CiliumNetworkPolicy\n<span class="token key atrule">description</span><span class="token punctuation">:</span> <span class="token string">\'Allow only permitted requests to empire Cassandra server\'</span>\n<span class="token key atrule">metadata</span><span class="token punctuation">:</span>\n<span class="token key atrule">name</span><span class="token punctuation">:</span> <span class="token string">\'secure-empire-cassandra\'</span>\n<span class="token key atrule">specs</span><span class="token punctuation">:</span>\n <span class="token punctuation">-</span> <span class="token key atrule">endpointSelector</span><span class="token punctuation">:</span>\n <span class="token key atrule">matchLabels</span><span class="token punctuation">:</span>
1\n <span class="token key atrule">app</span><span class="token punctuation">:</span> cass<span class="token punctuation">-</span>server\n<span class="token key atrule">ingress</span><span class="token punctuation">:</span>\n <span class="token punctuation">-</span> <span class="token key atrule">fromEndpoints</span><span class="token punctuation">:</span>\n <span class="token punctuation">-</span> <span class="token key atrule">matchLabels</span><span class="token punctuation">:</span>\n <span class="token key atrule">app</span><span class="token punctuation">:</span> empire<span class="token punctuation">-</span>outpost\n <span class="token key atrule">toPorts</span><span class="token punctuation">:</span>\n <span class="token punctuation">-</span> <span class="token key atrule">ports</span><span class="token punctuation">:</span>\n <span class="token punctuation">-</span> <span class="token key atrule">port</span><span class="token punctuation">:</span> <span class="token string">\'9042\'</span>\n <span class="token key atrule">protocol</span><span class="token punctuation">:</span> TCP\n <span class="token key atrule">rules</span><span class="token punctuation">:</span>\n <span class="token key atrule">l7proto</span><span class="token punctuation">:</span> cassandra\n <span class="token key atrule">l7</span><span class="token punctuation">:</span>\n <span class="token punctuation">-</span> <span class="token key atrule">query_action</span><span class="token punctuation">:</span> <span class="token string">\'select\'</span>\n <span class="token key atrule">query_table</span><span class="token punctuation">:</span> <span class="token string">"system\\\\..*"</span>\n <span class="token punctuation">-</span> <span class="token key atrule">query_action</span><span class="token punctuation">:</span> <span class="token string">\'select\'</span>\n <span class="token key atrule">query_table</span><span class="token punctuation">:</span> <span class="token string">"system_schema\\\\..*"</span>\n <span class="token punctuation">-</span> <span class="token key atrule">query_action</span><span class="token punctuation">:</span> <span class="token string">\'insert\'</span>\n <span class="token key atrule">query_table</span><span class="token punctuation">:</span> <span class="token string">\'attendance.daily_records\'</span></code></pre></div>'}}),"\n",s.createElement(e.p,null,"This is a simple example, see the ",s.createElement(e.a,{href:"https://cilium.readthedocs.io/en/v1.3/gettingstarted/cassandra/"},"Cassandra getting started guide"),"\nfor more complex examples."),"\n",s.createElement("br"),"\n",s.createElement("br"),"\n",s.createElement(e.h1,null,"Memcached Support (Beta)"),"\n",s.createElement(e.span,{dangerouslySetInnerHTML:{__html:'<span\n class="gatsby-resp-image-wrapper"\n style="position: relative; display: block; margin-left: auto; margin-right: auto; max-width: 582px; "\n >
1\n <span\n class="gatsby-resp-image-background-image"\n style="padding-bottom: 46.03174603174603%; position: relative; bottom: 0; left: 0; background-image: url(\'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAJCAYAAAAywQxIAAAACXBIWXMAAAsTAAALEwEAmpwYAAAB6ElEQVR42nWS/UtTYRTH/dOkd4t+TSmiIIh+0P3QIAypQUSKrYjmVsFWSDhb0cRc5mbCwpmYEZTVarP5Mlze3ea8d3cv93q3T8+utkbaF57nfJ/znPPlPM85LfwDs1qlVqtRFbbOLYizhVKJSmyanNeLdLOfrGeA0psoFIuNuBb2QG1nNZ/rSLlcvDt0gKUjB0nt289yayuf2w4Td1ylKstWTEtzgmGaeGanScgSkWScsa8Llt+qM53m7elTvH7kI/Z4gHnnZb7Zu1iwdTF6/BiFQKBJcOdJGXWTow89nBjy0Sbs+aC/IVhVVZbOnkGKx1ErZYKD1wlNPCf7Pcn6yQ6UcHi34I+cTE/4Bb3RSa5NvaJz9OnfCjcVPto6WUkukkp8wXauHZ/7Fj/XJTJ2O8WZmd2CslbgyuRLTE0h9Ok9DsGtRtU3rci8z8X4Mzfe/m4e9F4i4ncyPnyH2I1uzJXVbUFdr6AoeTRNpVBQ2BC8LGw+/wu1WLB8pZJGxTD4EAszcc9Oe99tLgwGmR3uY8R9kcjQXdCNbUFTNKIuWhH/Yhg6huDGlmHxLWF1vYwu7kzx7rloiIi3h477fhwjEVbnxph64iQccP9/bPYalz9zmMuukU0nkKUMqpxG25DIrS2SWU40cn4DKSF7a1gL5YUAAAAASUVORK5CYII=\'); background-size: cover; display: block;"\n ></span>\n <picture>\n <source\n srcset="/static/d375d3fed73aa5efdb8e317b9337d1e8/2ff5b/memcached.webp 252w,\n/static/d375d3fed73aa5efdb8e317b9337d1e8/4d583/memcached.webp 504w,\n/static/d375d3fed73aa5efdb8e317b9337d1e8/9ecc9/memcached.webp 582w"\n sizes="(max-width: 582px) 100vw, 582px"\n type="image/webp"\n />\n <source\n srcset="/static/d375d3fed73aa5efdb8e317b9337d1e8/019e0/memcached.png 252w,\n/static/d375d3fed73aa5efdb8e317b9337d1e8/0dcb2/memcached.png 504w,\n/static/d375d3fed73aa5efdb8e317b9337d1e8/87b80/memcached.png 582w"\n sizes="(max-width: 582px) 100vw, 582px"\n type="image/png"\n />\n <img\n class="gatsby-resp-image-image"\n src="/static/d375d3fed73aa5efdb8e317b9337d1e8/87b80/memcached.png"\n alt="Memcached Logo"\n title=""\n loading="lazy"\n decoding="async"\n style="width:100%;height:100%;margin:0;vertical-align:middle;position:absolute;top:0;left:0;"\n />\n </picture>\n </span>'}}),"\n",s.createElement(e.p,null,"Memcached is a popular distributed in-memory key-value store that is often used\nfor caching purposes or to share small chunks of arbitrary data between\nservices. With the addition of a memcached parser golang extension to Envoy,\nCilium can now enforce security rules to restrict memcached clients to certain\ncommands such as read or write but also to certain key prefixes."),"\n",s.createElement(e.h2,null,"Example: How the Rebels secure a shared memcached service"),"\n",s.createElement(e.p,null,"In the following example, the Rebels have started running a memcached service\nidentified by the label ",s.createElement(e.span,{dangerouslySetInnerHTML:{__html:'<code class="language-text">app=memcached</code>'}}),". Several services are interacting\nwith the memcached services and different rules are being applied:"),"\n",s.createElement(e.ul,null,"\n",s.createElement(e.li,null,"\n",s.createElement(e.p,null,"The fleet maintenance service identified by ",s.createElement(e.span,{dangerouslySetInnerHTML:{__html:'<code class="language-text">function=fleet-maintenance</code>'}})," is\ngranted read and write access to all keys with the prefix\n",s.createElement(e.span,{dangerouslySetInnerHTML:{__html:'<code class="language-text">alliance/fleet</code>'}}),". Access to any other key is prohibited."),"\n"),"\n",s.createElement(e.li,null,"\n",s.createElement(e.p,null,"The fleet monitoring service identified by ",s.createElement(e.span,{dangerouslySetInnerHTML:{__html:'<code class="language-text">function=fleet-monitoring</code>'}})," is\nonly granted read access on keys with the prefix ",s.createElement(e.span,{dangerouslySetInnerHTML:{__html:'<code class="language-text">alliance/fleet</code>'}}),".\nWrite access to keys in the prefix or access to any key outside of the prefix\nis prohibited."),"\n"),"\n",s.createElement(e.li,null,"\n",s.createElement(e.p,null,"All Jedis identified by the label ",s.createElement(e.span,{dangerouslySetInnerHTML:{__html:'<code class="language-text">role=jedi</code>'}})," have full to the entire\nMemcached service and can access all keys."),"\n"),"\n"),"\n",s.createElement(e.span,{dangerouslySetInnerHTML:{__html:'<div class="gatsby-highlight" data-language="yaml"><pre class="language-yaml"><code class="language-yaml"><span class="token key atrule">apiVersion</span><span class="token punctuation">:</span> <span class="token string">\'cilium.io/v2\'</span>\n<span class="token key atrule">kind</span><span class="token punctuation">:</span> CiliumNetworkPolicy\n<span class="token key atrule">description</span><span class="token punctuation">:</span> <span class="token string">\'Secure the Rebel memcached service\'</span>\n<span class="token key atrule">metadata</span><span class="token punctuation">:</span>\n <span class="token key atrule">name</span><span class="token punctuation">:</span> <span class="token string">\'secure-rebel-alliance-memcache\'</span>\n<span class="token key atrule">specs</span><span class="token punctuation">:</span>\n <span class="token punctuation">-</span> <span class="token key atrule">endpointSelector</span><span class="token punctuation">:</span>
1\n <span class="token key atrule">matchLabels</span><span class="token punctuation">:</span>\n <span class="token key atrule">app</span><span class="token punctuation">:</span> memcached\n <span class="token key atrule">ingress</span><span class="token punctuation">:</span>\n <span class="token punctuation">-</span> <span class="token key atrule">fromEndpoints</span><span class="token punctuation">:</span>\n <span class="token punctuation">-</span> <span class="token key atrule">matchLabels</span><span class="token punctuation">:</span>\n <span class="token key atrule">function</span><span class="token punctuation">:</span> fleet<span class="token punctuation">-</span>maintanence\n <span class="token key atrule">toPorts</span><span class="token punctuation">:</span>\n <span class="token punctuation">-</span> <span class="token key atrule">ports</span><span class="token punctuation">:</span>\n <span class="token punctuation">-</span> <span class="token key atrule">port</span><span class="token punctuation">:</span> <span class="token string">\'11211\'</span>\n <span class="token key atrule">protocol</span><span class="token punctuation">:</span> TCP\n <span class="token key atrule">rules</span><span class="token punctuation">:</span>\n <span class="token key atrule">l7proto</span><span class="token punctuation">:</span> memcache\n <span class="token key atrule">l7</span><span class="token punctuation">:</span>\n <span class="token punctuation">-</span> <span class="token key atrule">command</span><span class="token punctuation">:</span> <span class="token string">\'writeGroup\'</span>\n <span class="token key atrule">keyPrefix</span><span class="token punctuation">:</span> <span class="token string">\'alliance/fleet/\'</span>\n <span class="token punctuation">-</span> <span class="token key atrule">command</span><span class="token punctuation">:</span> <span class="token string">\'get\'</span>\n <span class="token key atrule">keyPrefix</span><span class="token punctuation">:</span> <span class="token string">\'alliance/fleet/\'</span>\n <span class="token punctuation">-</span> <span class="token key atrule">fromEndpoints</span><span class="token punctuation">:</span>\n <span class="token punctuation">-</span> <span class="token key atrule">matchLabels</span><span class="token punctuation">:</span>\n <span class="token key atrule">function</span><span class="token punctuation">:</span> fleet<span class="token punctuation">-</span>monitoring\n <span class="token key atrule">toPorts</span><span class="token punctuation">:</span>\n <span class="token punctuation">-</span> <span class="token key atrule">ports</span><span class="token punctuation">:</span>\n <span class="token punctuation">-</span> <span class="token key atrule">port</span><span class="token punctuation">:</span> <span class="token string">\'11211\'</span>\n <span class="token key atrule">protocol</span><span class="token punctuation">:</span> TCP\n <span class="token key atrule">rules</span><span class="token punctuation">:</span>\n <span class="token key atrule">l7proto</span><span class="token punctuation">:</span> memcache\n <span class="token key atrule">l7</span><span class="token punctuation">:</span>\n <span class="token punctuation">-</span> <span class="token key atrule">command</span><span class="token punctuation">:</span> <span class="token string">\'get\'</span>\n <span class="token key atrule">keyPrefix</span><span class="token punctuation">:</span> <span class="token string">\'alliance/fleet/\'</span>\n <span class="token punctuation">-</span> <span class="token key atrule">fromEndpoints</span><span class="token punctuation">:</span>\n <span class="token punctuation">-</span> <span class="token key atrule">matchLabels</span><span class="token punctuation">:</span>
1\n <span class="token key atrule">role</span><span class="token punctuation">:</span> jedi\n <span class="token key atrule">toPorts</span><span class="token punctuation">:</span>\n <span class="token punctuation">-</span> <span class="token key atrule">ports</span><span class="token punctuation">:</span>\n <span class="token punctuation">-</span> <span class="token key atrule">port</span><span class="token punctuation">:</span> <span class="token string">\'11211\'</span>\n <span class="token key atrule">protocol</span><span class="token punctuation">:</span> TCP\n <span class="token key atrule">rules</span><span class="token punctuation">:</span>\n <span class="token key atrule">l7proto</span><span class="token punctuation">:</span> memcache\n <span class="token key atrule">l7</span><span class="token punctuation">:</span>\n <span class="token punctuation">-</span> command<span class="token punctuation">:</span></code></pre></div>'}}),"\n",s.createElement(e.p,null,"For a full example using Memcached, see the ",s.createElement(e.a,{href:"https://cilium.readthedocs.io/en/v1.3/gettingstarted/memcached/"},"Memcached getting started guide"),"."),"\n",s.createElement("br"),"\n",s.createElement("br"),"\n",s.createElement(e.h1,null,"Community"),"\n",s.createElement("a",{id:"linux-foundation-core-infrastructure-initiative-best-practices"}),"\n",s.createElement(e.h2,null,"Linux Foundation Core Infrastructure Initiative Best Practices"),"\n",s.createElement(e.a,{href:"https://bestpractices.coreinfrastructure.org/projects/1269"},s.createElement(e.img,{src:"https://bestpractices.coreinfrastructure.org/projects/1269/badge",alt:"CII Best Practices"})),"\n",s.createElement(e.p,null,"We are committed to developing Cilium in the open and with best open source\nbest practices. This includes a strong commitment to security. We are happy to\nannounce that we have completed all work to meet the ",s.createElement(e.a,{href:"https://bestpractices.coreinfrastructure.org/en"},"CII Best\nPractices")," of the Linux\nFoundation ",s.createElement(e.a,{href:"https://www.coreinfrastructure.org/"},"Core Infrastructure\nInitiative"),". You can learn\nmore about the badge program ",s.createElement(e.a,{href:"https://www.coreinfrastructure.org/programs/badge-program/"},"here"),"."),"\n",s.createElement("a",{id:"introduction-of-special-interest-groups-sigs"}),"\n",s.createElement(e.h2,null,"Introduction of Special Interest Groups (SIGs)"),"\n",s.createElement(e.p,null,"The community is growing and getting more diverse in interest. In order to\nensure the scalability of the project, we are officially introducing special\ninterest groups (SIGs) to help provide some structure. The following SIGs have\nbeen created already:"),"\n",s.createElement(e.ul,null,"\n",s.createElement(e.li,null,s.createElement(e.strong,null,"Datapath:")," (#sig-datapath) Owner of all BPF and Linux kernel related datapath code."),"\n",s.createElement(e.li,null,s.createElement(e.strong,null,"Documentation:")," (#sig-docs) All documentation related discussions"),"\n",s.createElement(e.li,null,s.createElement(e.strong,null,"Envoy:")," (#sig-envoy) Envoy, Istio and maintenance of all L7 protocol parsers."),"\n",s.createElement(e.li,null,s.createElement(e.strong,null,"Policy:")," (#sig-policy) All topics related to policy. The SIG is responsible for all security relevant APIs and the enforcement logic."),"\n",s.createElement(e.li,null,s.createElement(e.strong,null,"Release Management:")," (#launchpad) Responsible for the release management and backport process."),"\n"),"\n",s.createElement(e.p,null,"Anyone can propose additional SIGs. The process is simple and documented ",s.createElement(e.a,{href:"https://cilium.readthedocs.io/en/v1.3/community/#how-to-create-a-sig"},"here")),"\n",s.createElement("br"),"\n",s.createElement(e.h1,null,"1.3 Release Highlights"),"\n",s.createElement(e.ul,null,"\n",s.createElement(e.li,null,s.createElement(e.strong,null,"Go extensions for Envoy"),"\n",s.createElement(e.ul,null,"\n",s.createElement(e.li,null,"Exciting new extension API for Envoy using Go including a generic configuration\nand access logging API. (Beta)"),"\n"),"\n"),"\n",s.createElement(e.li,null,s.createElement(e.strong,null,"Cassandra & Memcached protocol support"),"\n",s.createElement(e.ul,null,"\n",s.createElement(e.li,null,"New protocol parsers for Cassandra and Memcached implemented using the new\nEnvoy Go extensions. Both parsers provide visibility and security policy\nenforcement on operation type and key/table names using exact matches,\nprefix matches, and regular expressions. (Beta)"),"\n"),"\n"),"\n",s.createElement(e.li,null,s.createElement(e.strong,null,"Security"),"\n",s.createElement(e.ul,null,"\n",s.createElement(e.li,null,"TTLs support for DNS/FQDN policy rules"),"\n",s.createElement(e.li,null,"Introduction of well-known identities for kube-dns, coredns, and\netcd-operator."),"\n",s.createElement(e.li,null,'New security identity "unmanaged" to represent pods which are not managed\nby Cilium.'),"\n",s.createElement(e.li,null,'Improved security entity "cluster" which allows defining policies for all\npods in a cluster (managed, unmanaged and host networking).'),"\n"),"\n"),"\n",s.createElement(e.li,null,s.createElement(e.strong,null,"Additional Metrics & Monitoring"),"\n",s.createElement(e.ul,null,"\n",s.createElement(e.li,null,'New "cilium metrics list" command to list metrics via CLI.'),"\n",s.createElement(e.li,null,"Lots of additional metrics: connection tracking garbage collection, Kubernetes\nresource events, IPAM, endpoint regenerations, services, and\nerror and warning counters."),"\n",s.createElement(e.li,null,"New monitoring API with more efficient encoding/decoding protocol. Used\nby default with fallback for older clients."),"\n"),"\n"),"\n",s.createElement(e.li,null,s.createElement(e.strong,null,"Networking Improvements"),"\n",s.createElement(e.ul,null,"\n",s.createElement(e.li,null,"Split of connection tracking tables into TCP and non-TCP to better\nhandle the mix of long and short-lived nature of each protocol."),"\n",s.createElement(e.li,null,"Ability to specify the size of the connection tracking tables via\nConfigMap."),"\n",s.createElement(e.li,null,"Better masquerading behavior for traffic via NodePort and HostPort to allow\npods to see the original source IP if possible."),"\n"),"\n"),"\n",s.createElement(e.li,null,s.createElement(e.strong,null,"Full Key-value store Resiliency"),"\n",s.createElement(e.ul,null,"\n",s.createElement(e.li,null,"Introduced ability to re-construct the kvstore contents immediately after\nloss of any state. Allows to restore etcd from backup or to completely wipe\nit for a running cluster with minimal impact. (Beta)"),"\n"),"\n"),"\n",s.createElement(e.li,null,s.createElement(e.strong,null,"Efficiency & Scale"),"\n",s.createElement(e.ul,null,"\n",s.createElement(e.li,null,"Significant improvements in the cost of calculating policy of individual\nendpoints. Work continues on this subject."),"\n",s.createElement(e.li,null,"New grace peri
1od when workloads change identity to minimize connectivity\nimpact throughout identity change."),"\n",s.createElement(e.li,null,"More efficient security identity allocation algorithm."),"\n",s.createElement(e.li,null,"New generic framework to detect and ignore Kubernetes event notifications\nfor which Cilium does not need to take action."),"\n",s.createElement(e.li,null,"Improvements in avoiding unnecessary BPF compilations to reduce\nthe CPU overhead caused by it. Initial work to scope BPF templating to\navoid compilation altogether."),"\n"),"\n"),"\n",s.createElement(e.li,null,s.createElement(e.strong,null,"Kubernetes"),"\n",s.createElement(e.ul,null,"\n",s.createElement(e.li,null,"Added support for Kubernetes 1.12"),"\n",s.createElement(e.li,null,"Custom columns for the CiliumEndpoints CRD (Requires Kubernetes 1.11)"),"\n",s.createElement(e.li,null,"Removed cgo dependency from cilium-cni for compatibility with ulibc"),"\n",s.createElement(e.li,null,"Removed support for Kubernetes 1.7"),"\n"),"\n"),"\n",s.createElement(e.li,null,s.createElement(e.strong,null,"Documentation"),"\n",s.createElement(e.ul,null,"\n",s.createElement(e.li,null,"New Ubuntu 18.04 guide"),"\n",s.createElement(e.li,null,"Coverage of latest BPF runtime features such as BTF (BPF Type Format)."),"\n",s.createElement(e.li,null,"Documentation for VM/host firewall requirements to run multi-host networking."),"\n"),"\n"),"\n",s.createElement(e.li,null,s.createElement(e.strong,null,"Long Term Stable (LTS) Release"),"\n",s.createElement(e.ul,null,"\n",s.createElement(e.li,null,"1.3 has been declared an LTS release and will be supported for the next 6\nmonths with backports."),"\n"),"\n"),"\n"),"\n",s.createElement(e.h2,null,"Upgrade Instructions"),"\n",s.createElement(e.p,null,"As usual, follow the ",s.createElement(e.a,{href:"https://cilium.readthedocs.io/en/v1.3/install/upgrade/#upgrading-minor-versions"},"upgrade\nguide"),"\nto upgrade your Cilium deployment. Feel free to ping us on\n",s.createElement(e.a,{href:"https://slack.cilium.io/"},"Slack"),"."),"\n",s.createElement(e.h2,null,"Release"),"\n",s.createElement(e.ul,null,"\n",s.createElement(e.li,null,"Release Notes & Binaries: ",s.createElement(e.a,{href:"https://github.com/cilium/cilium/releases/tag/1.3.0"},"1.3.0")),"\n",s.createElement(e.li,null,"Container image: ",s.createElement(e.span,{dangerouslySetInnerHTML:{__html:'<code class="language-text">docker.io/cilium/cilium:v1.3.0</code>'}})),"\n"))}var l=function(n){void 0===n&&(n={});const{wrapper:e}=Object.assign({},(0,t.RP)(),n.components);return e?s.createElement(e,n,s.createElement(o,n)):o(n)},c=a(8125),i=a(5805),p=a(8838),r=a(2744);const u=n=>{const{data:{mdx:e},children:a}=n,{frontmatter:{path:t,title:o,date:l,tags:p,ogSummary:u}}=e;return s.createElement(r.A,{headerWithSearch:!0},s.createElement(c.A,{path:t,content:a,date:l,title:o,tags:p,summary:u}),s.createElement(i.A,{className:"my-10 md:my-20 lg:my-28"}))},d=n=>{var e,a;let{data:{mdx:t,site:o},location:{pathname:l}}=n;const{frontmatter:{title:c,ogImage:i,ogSummary:r,dateIso:u,tags:d,author:m}}=t,{siteUrl:g}=o.siteMetadata,h=`${r.slice(0,133)}...`,k=`${g}${l}`,y=null!=i&&null!==(e=i.childImageSharp)&&void 0!==e&&null!==(a=e.resize)&&void 0!==a&&a.src?`${g}${i.childImageSharp.resize.src}`:null,b={title:c,description:h,image:i||null,slug:l},f={"@context":"https://schema.org","@type":"BlogPosting",headline:c,description:h,url:k,datePublished:u,dateModified:u,author:m?{"@type":"Person",name:m}:{"@type":"Organization",name:"Cilium",url:g},publisher:{"@type":"Organization",name:"Cilium",url:g,logo:{"@type":"ImageObject",url:`${g}/images/social-preview.jpg`}},...y&&{image:{"@type":"ImageObject",url:y,width:1200,height:630}},...(null==d?void 0:d.length)>0&&{keywords:d.join(", ")}};return s.createElement(p.A,{data:b,type:"article",datePublished:u,jsonLd:f})};function m(n){return s.createElement(u,n,s.createElement(l,n))}}}]); 2//# sourceMappingURL=component---src-templates-blog-post-jsx-content-file-path-src-posts-2018-10-23-envoy-golang-index-md-3668d73b26ea629b77d7.js.map
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.