1"use strict";(self.webpackChunkcilium_io=self.webpackChunkcilium_io||[]).push([[3542],{9107:function(e,a,n){n.r(a),n.d(a,{Head:function(){return u},default:function(){return g}});var t=n(8453),s=n(6540);function l(e){const a=Object.assign({span:"span",p:"p",a:"a",h2:"h2",ul:"ul",li:"li",strong:"strong",h3:"h3"},(0,t.RP)(),e.components);return s.createElement(s.Fragment,null,s.createElement(a.span,{dangerouslySetInnerHTML:{__html:'<span\n class="gatsby-resp-image-wrapper"\n style="position: relative; display: block; margin-left: auto; margin-right: auto; max-width: 835px; "\n >\n <a\n class="gatsby-resp-image-link"\n href="/static/968721a36004d69f845608026cf63ea9/c33a0/ogimage.jpg"\n style="display: block"\n target="_blank"\n rel="noopener"\n >\n <span\n class="gatsby-resp-image-background-image"\n style="padding-bottom: 19.047619047619047%; position: relative; bottom: 0; left: 0; background-image: url(\'data:image/jpeg;base64,/9j/2wBDAAUDBAQEAwUEBAQFBQUGBwwIBwcHBw8LCwkMEQ8SEhEPERETFhwXExQaFRERGCEYGh0dHx8fExciJCIeJBweHx7/2wBDAQUFBQcGBw4ICA4eFBEUHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh7/wgARCAAEABQDASIAAhEBAxEB/8QAFgABAQEAAAAAAAAAAAAAAAAAAAMH/8QAFQEBAQAAAAAAAAAAAAAAAAAAAwT/2gAMAwEAAhADEAAAAdTsSJcVl//EABgQAQEAAwAAAAAAAAAAAAAAAAIDERIT/9oACAEBAAEFAoSXKgy5jQ//xAAWEQADAAAAAAAAAAAAAAAAAAADEDL/2gAIAQMBAT8BHS//xAAXEQADAQAAAAAAAAAAAAAAAAAEEDOR/9oACAECAQE/AS54v//EAB4QAAEDBAMAAAAAAAAAAAAAAAIAAREDEiIjYXKR/9oACAEBAAY/Ah31X5lDkXqi4i7Ov//EABoQAAIDAQEAAAAAAAAAAAAAAAERACFxMVH/2gAIAQEAAT8hQidYYGbych5Hte2wz//aAAwDAQACAAMAAAAQD9//xAAYEQACAwAAAAAAAAAAAAAAAAAAATFxsf/aAAgBAwEBPxCangj/xAAXEQEAAwAAAAAAAAAAAAAAAAABEKGx/9oACAECAQE/EBfRH//EABoQAQEAAwEBAAAAAAAAAAAAAAERACExUWH/2gAIAQEAAT8Qaaoi9H32SGTdrSw6m8sbRaS+WGs//9k=\'); background-size: cover; display: block;"\n ></span>\n <picture>\n <source\n srcset="/static/968721a36004d69f845608026cf63ea9/2ff5b/ogimage.webp 252w,\n/static/968721a36004d69f845608026cf63ea9/4d583/ogimage.webp 504w,\n/static/968721a36004d69f845608026cf63ea9/259dd/ogimage.webp 835w"\n sizes="(max-width: 835px) 100vw, 835px"\n type="image/webp"\n />\n <source\n srcset="/static/968721a36004d69f845608026cf63ea9/88c24/ogimage.jpg 252w,\n/static/968721a36004d69f845608026cf63ea9/cc5bf/ogimage.jpg 504w,\n/static/968721a36004d69f845608026cf63ea9/c33a0/ogimage.jpg 835w"\n sizes="(max-width: 835px) 100vw, 835px"\n type="image/jpeg"\n />\n <img\n class="gatsby-resp-image-image"\n src="/static/968721a36004d69f845608026cf63ea9/c33a0/ogimage.jpg"\n alt="Introduction"\n title=""\n loading="lazy"\n decoding="async"\n style="width:100%;height:100%;margin:0;vertical-align:middle;position:absolute;top:0;left:0;"\n />\n </picture>\n </a>\n </span>'}}),"\n",s.createElement(a.p,null,"Like many of you, we have been feeling the pains of working remotely from home.\nWe are living in a difficult time where many of us have limited access to\nresources. Still, the need to design, build and maintain moves on!\nFor many of us, it is what keeps us mentally strong on a daily basis right now.\nThis means we still need to test and optimize our applications. But how can we\nreliably test a complex application and ensure the network policies are properly\nenforced across the entire communications path?"),"\n",s.createElement(a.p,null,"Thanks to our friends at ",s.createElement(a.a,{href:"https://rancher.io"},"Rancher Labs")," and their amazing\nsolution for kubernetes on edge and IoT devices ",s.createElement(a.a,{href:"https://k3s.io"},"K3s")," it is\nnot only possible, but easy to do. With Cilium and K3s you can build a\nmulti-node Kubernetes cluster with just 8GB of memory and a modern CPU in just\nminutes. A multi-node cluster can help with testing of complex application\narchitectures and is especially useful when diagnosing or troubleshooting\nnetwork policies. Whether you just want to take Cilium for a test drive or you\nwant to start designing tight network controls into your application, this\npost is for you!"),"\n",s.createElement(a.p,null,"In this guide, we will walk through the steps required to build a multi-node\nKubernetes cluster on your local workstation or laptop using K3s and Cilium.\nThen we'll show you how you can use Hubble to inspect traffic in the cluster\n
1and visualize data which is exposed by the superpowers of eBPF and Cilium. We\nwill also show you how to restrict the flow of traffic between applications.\nFinally, we will see how Cilium and Hubble can provide you detailed information\nwhich can help solve problems related to compliance and regulatory concerns."),"\n",s.createElement(a.h2,null,"Pre-Requisites"),"\n",s.createElement(a.ul,null,"\n",s.createElement(a.li,null,s.createElement(a.strong,null,"Vagrant:")," HashiCorp ",s.createElement(a.a,{href:"https://www.vagrantup.com/downloads.html"},"Vagrant")," is\nuseful for building local development environments. It's free to install and\nuse. This guide will use it with VirtualBox, but vagrant can also be used with\na number of other ",s.createElement(a.a,{href:"https://www.vagrantup.com/intro/getting-started/providers.html"},"providers"),"."),"\n",s.createElement(a.li,null,s.createElement(a.strong,null,"VirtualBox:")," ",s.createElement(a.a,{href:"https://www.virtualbox.org"},"VirtualBox")," is a virtualization\nplatform freely distributed for personal use. In order to run\nthe virtual machines in this post VirtualBox 6.1. or higher is required. To\ncheck if you have the correct version of VirtualBox, run the following at a\nterminal prompt: ",s.createElement(a.span,{dangerouslySetInnerHTML:{__html:'<code class="language-text">vboxmanage --version</code>'}})),"\n",s.createElement(a.li,null,s.createElement(a.strong,null,"Helm:")," ",s.createElement(a.a,{href:"https://helm.sh"},"Helm")," version 3 is required to install Cilium and\nHubble. To determine if you have Helm version 3 you can run the following\ncommand at a terminal prompt: ",s.createElement(a.span,{dangerouslySetInnerHTML:{__html:'<code class="language-text">helm version</code>'}})),"\n",s.createElement(a.li,null,s.createElement(a.strong,null,"Git:")," Code examples are available via ",s.createElement(a.a,{href:"https://github.com/seanmwinn/cilium-k3s-demo"},"GitHub"),"\nâand may be downloaded using ",s.createElement(a.a,{href:"https://git-scm.com"},"Git"),"âbut are not required.\nI have provided all of the necessary code bits here in the post to follow\nalong, but if you want to customize your environment beyond this post I\nrecommend cloning the repository."),"\n",s.createElement(a.li,null,s.createElement(a.strong,null,"kubectl")," - ",s.createElement(a.a,{href:"https://kubernetes.io/docs/tasks/tools/install-kubectl/"},"Kubernetes CLI"),"\nused for interacting with the kubernetes api. We will be installing version\n1.17.4 of kubernetes, so we should install the same version or newer.\nTo check the version installed type ",s.createElement(a.span,{dangerouslySetInnerHTML:{__html:'<code class="language-text">kubectl version</code>'}}),". Your system should\nreport the version installed for both Client and Server. If your connection\nto the server fails, this is expected without a server running."),"\n"),"\n",s.createElement(a.h2,null,"Starting Your Environment"),"\n",s.createElement(a.p,null,"Clone the repository:"),"\n",s.createElement(a.span,{dangerouslySetInnerHTML:{__html:'<div class="gatsby-highlight" data-language="shell-session"><pre class="language-shell-session"><code class="language-shell-session"><span class="token output">git clone https://github.com/seanmwinn/cilium-k3s-demo.git\ncd cilium-k3s-demo</span></code></pre></div>'}}),"\n",s.createElement(a.p,null,"The guest machines will require the Virtualbox Guest Additions installed. In\norder to allow vagrant to automatically install the guest additions on boxes\nwhich do not implement it, install the ",s.createElement(a.span,{dangerouslySetInnerHTML:{__html:'<code class="language-text">vagrant-vbguest</code>'}})," plugin:"),"\n",s.createElement(a.span,{dangerouslySetInnerHTML:{__html:'<div class="gatsby-highlight" data-language="shell-session"><pre class="language-shell-session"><code class="language-shell-session"><span class="token output">vagrant plugin install vagrant-vbguest</span></code></pre></div>'}}),"\n",s.createElement(a.p,null,"By default, the included ",s.createElement(a.span,{dangerouslySetInnerHTML:{__html:'<code class="language-text">Vagrantfile</code>'}})," will start a cluster with one K3S master node\nand one K3S agent node by default. You can change the number of agent nodes by\nconfiguring an environment variable for ",s.createElement(a.span,{dangerouslySetInnerHTML:{__html:'<code class="language-text">K3S_AGENTS</code>'}})," or passing it with the\ncommand as a prefix:"),"\n",s.createElement(a.span,{dangerouslySetInnerHTML:{__html:'<div class="gatsby-highlight" data-language="shell-session"><pre class="language-shell-session"><code class="language-shell-session"><span class="token output">vagrant up</span></code></pre></div>'}}),"\n",s.createElement(a.p,null,"After about 5-10 minutes depending on your download spped, the machines should\nbe started and K3s should be installed and running. The provisioning script\nwill copy a ",s.createElement(a.span,{dangerouslySetInnerHTML:{__html:'<code class="language-text">k3s.yaml</code>'}})," file to your working directory. Verify that ",s.createElement(a.span,{dangerouslySetInnerHTML:{__html:'<code class="language-text">kubectl</code>'}})," can\ncommunicate with the kubernetes master. It is expected to see pods in a\n",s.createElement(a.span,{dangerouslySetInnerHTML:{__html:'<code class="language-text">Pending</code>'}})," state:"),"\n",s.createElement(a.span,{dangerouslySetInnerHTML:{__html:'<div class="gatsby-highlight" data-language="shell-session"><pre class="language-shell-session"><code class="language-shell-session"><span class="token output">export KUBECONFIG=$PWD/k3s.yaml\nkubectl get pods -n kube-system -o wide</span></code></pre></div>'}}),"\n",s.createElement(a.span,{dangerouslySetInnerHTML:{__html:'<span\n class="gatsby-resp-image-wrapper"\n style="position: relative; display: block; margin-left: auto; margin-right: auto; max-width: 1008px; "\n >\n <a\n class="gatsby-resp-image-link"\n href="/static/08960888533ab494c6c55d2e5966419b/7416a/pods-notready.png"\n style="display: block"\n target="_blank"\n rel="noopener"\n >\n <span\n class="gatsby-resp-image-background-image"\n style="padding-bottom: 11.11111111111111%; position: relative; bottom: 0; left: 0; background-image: url(\'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAACCAYAAABYBvyLAAAACXBIWXMAAAsTAAALEwEAmpwYAAAAcUlEQVR42h2LSwrAIAxEBaG404WiCFXqH61L73+0Kc0iJPNehp1zsPfGGAOtNay1aP+s945SCuWcM00IgVitFe/7EptzUv937HkepJTo4ZfGGAghIKWE1hoxRsrXdcF7T95aC+cclFJgjOG+b3DO6f4Aqss1jEY4iPcAAAAASUVORK5CYII=\'); background-size: cover; display: block;"\n ></span>\n <picture>\n <source\n srcset="/static/08960888533ab494c6c55d2e5966419b/2ff5b/pods-notready.webp 252w,\n/static/08960888533ab494c6c55d2e5966419b/4d583/pods-notready.webp 504w,\n/static/08960888533ab494c6c55d2e5966419b/905a7/pods-notready.webp 1008w,\n/static/08960888533ab494c6c55d2e5966419b/7cfba/pods-notready.webp 1320w"\n sizes="(max-width: 1008px) 100vw, 1008px"\n type="image/webp"\n />\n <source\n srcset="/static/08960888533ab494c6c55d2e5966419b/019e0/pods-notready.png 252w,\n/static/08960888533ab494c6c55d2e5966419b/0dcb2/pods-notready.png 504w,\n/static/08960888533ab494c6c55d2e5966419b/832a9/pods-notready.png 1008w,\n/static/08960888533ab494c6c55d2e5966419b/7416a/pods-notready.png 1320w"\n sizes="(max-width: 1008px) 100vw, 1008px"\n type="image/png"\n />\n <img\n class="gatsby-resp-image-image"\n src="/static/08960888533ab494c6c55d2e5966419b/832a9/pods-notready.png"\n alt="NodesNotReady"\n title=""\n loading="lazy"\n decoding="async"\n style="width:100%;height:100%;margin:0;vertical-align:middle;position:absolute;top:0;left:0;"\n />\n </picture>\n </a>\n </span>'}}),"\n",s.createElement(a.h2,null,"Installing Cilium"),"\n",s.createElement(a.p,null,"Cilium is installed using Helm version 3. First, add the Cilium repository to\nyour helm configuration:"),"\n",s.createElement(a.span,{dangerouslySetInnerHTML:{__html:'<div class="gatsby-highlight" data-language="shell-session"><pre class="language-shell-session"><code class="language-shell-session"><span class="token output">
1helm repo add cilium https://helm.cilium.io/</span></code></pre></div>'}}),"\n",s.createElement(a.p,null,"Then install Cilium using Helm:"),"\n",s.createElement(a.span,{dangerouslySetInnerHTML:{__html:'<div class="gatsby-highlight" data-language="shell-session"><pre class="language-shell-session"><code class="language-shell-session"><span class="token command"><span class="token shell-symbol important">$</span> <span class="token bash language-bash">helm <span class="token function">install</span> cilium cilium/cilium <span class="token parameter variable">--version</span><span class="token operator">=</span><span class="token number">1.7</span>.2 <span class="token punctuation">\\</span>\n <span class="token parameter variable">--set</span> <span class="token assign-left variable">global.tag</span><span class="token operator">=</span><span class="token string">"v1.7.2"</span> <span class="token parameter variable">--set</span> <span class="token assign-left variable">global.containerRuntime.integration</span><span class="token operator">=</span><span class="token string">"containerd"</span> <span class="token punctuation">\\</span>\n <span class="token parameter variable">--set</span> <span class="token assign-left variable">global.containerRuntime.socketPath</span><span class="token operator">=</span><span class="token string">"/var/run/k3s/containerd/containerd.sock"</span> <span class="token punctuation">\\</span>\n <span class="token parameter variable">--set</span> <span class="token assign-left variable">global.kubeProxyReplacement</span><span class="token operator">=</span><span class="token string">"strict"</span> <span class="token parameter variable">--namespace</span> kube-system</span></span></code></pre></div>'}}),"\n",s.createElement(a.p,null,"This Helm command executes the following four actions:"),"\n",s.createElement(a.ul,null,"\n",s.createElement(a.li,null,"Selecting the v1.7.2 release."),"\n",s.createElement(a.li,null,"Configuring Cilium to be able to read information from the containerd\nruntime along with a custom path for the domain socket implemented by k3s."),"\n",s.createElement(a.li,null,"Disabling kube-proxy and using Cilium for address translation"),"\n"),"\n",s.createElement(a.p,null,"It will take a few minutes for the Cilium agent and operator to become available.\nOnce we have Cilium up and running, the other pods in the cluster should also\nstart to transition into the ",s.createElement(a.span,{dangerouslySetInnerHTML:{__html:'<code class="language-text">Running</code>'}})," state. You should see one Cilium\npod on each node as well as the cilium-operator."),"\n",s.createElement(a.span,{dangerouslySetInnerHTML:{__html:'<span\n class="gatsby-resp-image-wrapper"\n style="position: relative; display: block; margin-left: auto; margin-right: auto; max-width: 1008px; "\n >\n <a\n class="gatsby-resp-image-link"\n href="/static/c3fabbdc45e6ee6b1db6b42ecb10f23b/e45c9/cilium-installed.png"\n style="display: block"\n target="_blank"\n rel="noopener"\n >\n <span\n class="gatsby-resp-image-background-image"\n style="padding-bottom: 18.650793650793652%; position: relative; bottom: 0; left: 0; background-image: url(\'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAECAYAAACOXx+WAAAACXBIWXMAAAsTAAALEwEAmpwYAAAAv0lEQVR42l2PSw9EQBCER4R4J8QjCAY7DgwO/v9vq1Wd7GUPk3RV91R/rc7zxHEc2LYNxhjs+w5r7etZTNOEdV2xLAv0Ww/DIE9rLT365mMwzzPu68bzPFBFUaDrOhlo2xau6yJJEpRlKTqOY6RpiizLxIuiCPzDuu97BEGAuq7RNA1834ciHcV/AD3ScoiaS3+XjOMolKRVSklwnudSKzYowjCE4zhicis9fvQ8T3qkomZwVVWykGScJwwvYOAXNDhlgGzAWh8AAAAASUVORK5CYII=\'); background-size: cover; display: block;"\n ></span>\n <picture>\n <source\n srcset="/static/c3fabbdc45e6ee6b1db6b42ecb10f23b/2ff5b/cilium-installed.webp 252w,\n/static/c3fabbdc45e6ee6b1db6b42ecb10f23b/4d583/cilium-installed.webp 504w,\n/static/c3fabbdc45e6ee6b1db6b42ecb10f23b/905a7/cilium-installed.webp 1008w,\n/static/c3fabbdc45e6ee6b1db6b42ecb10f23b/eff13/cilium-installed.webp 1448w"\n sizes="(max-width: 1008px) 100vw, 1008px"\n type="image/webp"\n />\n <source\n srcset="/static/c3fabbdc45e6ee6b1db6b42ecb10f23b/019e0/cilium-installed.png 252w,\n/static/c3fabbdc45e6ee6b1db6b42ecb10f23b/0dcb2/cilium-installed.png 504w,\n/static/c3fabbdc45e6ee6b1db6b42ecb10f23b/832a9/cilium-installed.png 1008w,\n/static/c3fabbdc45e6ee6b1db6b42ecb10f23b/e45c9/cilium-installed.png 1448w"\n sizes="(max-width: 1008px) 100vw, 1008px"\n type="image/png"\n />\n <img\n class="gatsby-resp-image-image"\n src="/static/c3fabbdc45e6ee6b1db6b42ecb10f23b/832a9/cilium-installed.png"\n alt="CiliumRunning"\n title=""\n loading="lazy"\n decoding="async"\n style="width:100%;height:100%;margin:0;vertical-align:middle;position:absolute;top:0;left:0;"\n />\n </picture>\n </a>\n </span>'}}),"\n",s.createElement(a.h2,null,"Installing Hubble"),"\n",s.createElement(a.p,null,"Next we will install Hubble, an observability tool which provides deep\nvisibility into network connections, processes and much more thanks to Cilium\nand eBPF. In order to install Hubble using helm, it's necessary to clone the\nsource repository:"),"\n",s.createElement(a.span,{dangerouslySetInnerHTML:{__html:'<div class="gatsby-highlight" data-language="shell-session"><pre class="language-shell-session"><code class="language-shell-session"><span class="token command"><span class="token shell-symbol important">$</span> <span class="token bash language-bash"><span class="token builtin class-name">cd</span> <span class="token punctuation">..</span></span></span>\n<span class="token command"><span class="token shell-symbol important">$</span> <span class="token bash language-bash"><span class="token function">git</span> clone https://github.com/cilium/hubble <span class="token parameter variable">--branch</span> v0.5</span></span>\n<span class="token command"><span class="token shell-symbol important">$</span> <span class="token bash language-bash"><span class="token builtin class-name">cd</span> hubble/install/kubernetes/hubble</span></span>\n\n<span class="token command"><span class="token shell-symbol important">$</span> <span class="token bash language-bash">helm <span class="token function">install</span> hubble <span class="token builtin class-name">.</span> <span class="token parameter variable">--namespace</span> kube-system <span class="token punctuation">\\</span>\n <span class="token parameter variable">--set</span> <span class="token assign-left variable">metrics.enabled</span><span class="token operator">=</span><span class="token string">"{dns:query;ignoreAAAA;destinationContext=pod-short,drop:sourceContext=pod;destinationContext=pod,tcp,flow,port-distribution,icmp,http}"</span> <span class="token punctuation">\\</span>\n <span class="token parameter variable">--set</span> <span class="token assign-left variable">ui.enabled</span><span class="token operator">=</span>true <span class="token parameter variable">--set</span> <span class="token assign-left variable">image.tag</span><span class="token operator">=</span><span class="token string">"v0.5.1"</span></span></span></code></pre></div>'}}),"\n",s.createElement(a.p,null,"Here we are setting custom values to:"),"\n",s.createElement(a.ul,null,"\n",s.createElement(a.li,null,"enable the Hubble UI;"),"\n",s.createElement(a.li,null,"define the ",s.createElement(a.a,{href:"https://github.com/cilium/hubble/blob/v0.5/Documentation/metrics.md"},"metrics"),"\nHubble will collect;"),"\n",s.createElement(a.li,null,"select to deploy release v0.5.1.gma"),"\n"),"\n",s.createElement(a.p,null,"The Hubble daemonset should start a pod on each node, as well as a single pod\nrunning the Hubble UI. This process should take a few minutes as the containers\nare downloaded and started."),"\n",s.createElement(a.span,{dangerouslySetInnerHTML:{__html:'<span\n class="gatsby-resp-image-wrapper"\n style="position: relative; display: block; margin-left: auto; margin-right: auto; max-width: 1008px; "\n >\n <a\n class="gatsby-resp-image-link"\n href="/static/01a6dccb2fd9e9855914ef57d0cb52f8/80bed/hubble-installed.png"\n style="display: block"\n target="_blank"\n rel="noopener"\n >\n <span\n class="gatsby-resp-image-background-image"\n style="padding-bottom: 28.174603174603174%; position: relative; bottom: 0; left: 0; background-image: url(\'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAGCAYAAADDl76dAAAACXBIWXMAAAsTAAALEwEAmpwYAAAA/ElEQVR42jVQx66EQAwbimhauui9LCyL0F74/1/Le7bEIZp4EjtO1O/3k/M8Zd93+Xw+cl0XA3/TNMn7/ZZ1WZkPwyBDP8g8z8Trusq2bcTg3PctKooiqapK+r6XOI5F13UJw1CyLJM8z+X1ejGSJGF4nidpmjLquhbHcZgXRcFcwQHITdNQ2HVd8X2fzahZlkXcdZ18jy+dIR/Hka9SSsqypAZytSwLJ8AFP/4DAmgCGYKoYSDOgk0wuG1bDkU/xKBBPvYHwOqapvEzCAIKwKFt21wTIsdxsA81OIQ4+lHDeSiI5sfZE6Zp8h5whpsahkFh4KcG3sMFRh38PwQgk/HJ4+4WAAAAAElFTkSuQmCC\'); background-size: cover; display: block;"\n ></span>\n <picture>\n <source\n srcset="/static/01a6dccb2fd9e9855914ef57d0cb52f8/2ff5b/hubble-installed.webp 252w,\n/static/01a6dccb2fd9e9855914ef57d0cb52f8/4d583/hubble-installed.webp 504w,\n/static/01a6dccb2fd9e9855914ef57d0cb52f8/905a7/hubble-installed.webp 1008w,\n/static/01a6dccb2fd9e9855914ef57d0cb52f8/c408c/hubble-installed.webp 1393w"\n sizes="(max-width: 1008px) 100vw, 1008px"\n type="image/webp"\n />\n <source\n srcset="/static/01a6dccb2fd9e9855914ef57d0cb52f8/019e
10/hubble-installed.png 252w,\n/static/01a6dccb2fd9e9855914ef57d0cb52f8/0dcb2/hubble-installed.png 504w,\n/static/01a6dccb2fd9e9855914ef57d0cb52f8/832a9/hubble-installed.png 1008w,\n/static/01a6dccb2fd9e9855914ef57d0cb52f8/80bed/hubble-installed.png 1393w"\n sizes="(max-width: 1008px) 100vw, 1008px"\n type="image/png"\n />\n <img\n class="gatsby-resp-image-image"\n src="/static/01a6dccb2fd9e9855914ef57d0cb52f8/832a9/hubble-installed.png"\n alt="HubbleInstalled"\n title=""\n loading="lazy"\n decoding="async"\n style="width:100%;height:100%;margin:0;vertical-align:middle;position:absolute;top:0;left:0;"\n />\n </picture>\n </a>\n </span>'}}),"\n",s.createElement(a.h2,null,"Installing MetalLB"),"\n",s.createElement(a.p,null,s.createElement(a.a,{href:"https://metallb.universe.tf/"},"MetalLB")," is a software load balancer which can\nexpose Kubernetes services to external hosts thanks to a ",s.createElement(a.span,{dangerouslySetInnerHTML:{__html:'<code class="language-text">LoadBalancer</code>'}}),"\nservice object. We are using MetalLB to work around ",s.createElement(a.a,{href:"https://github.com/rancher/k3s/issues/1216"},"an existing bug"),"\nwith multi-node clusters in the K3s service load balancer."),"\n",s.createElement(a.p,null,"Create the metallb-system namespace:"),"\n",s.createElement(a.span,{dangerouslySetInnerHTML:{__html:'<div class="gatsby-highlight" data-language="shell-session"><pre class="language-shell-session"><code class="language-shell-session"><span class="token output">kubectl create ns metallb-system</span></code></pre></div>'}}),"\n",s.createElement(a.p,null,"The Helm charts for MetalLB are hosted in the official stable repository. You\ncan see the list of configured repos with ",s.createElement(a.span,{dangerouslySetInnerHTML:{__html:'<code class="language-text">helm repo list</code>'}}),". If you do not have\nthe stable repository configured, add it:"),"\n",s.createElement(a.span,{dangerouslySetInnerHTML:{__html:'<div class="gatsby-highlight" data-language="shell-session"><pre class="language-shell-session"><code class="language-shell-session"><span class="token output">helm repo add stable https://kubernetes-charts.storage.googleapis.com/</span></code></pre></div>'}}),"\n",s.createElement(a.p,null,"Next, install MetalLB using Helm:"),"\n",s.createElement(a.span,{dangerouslySetInnerHTML:{__html:'<div class="gatsby-highlight" data-language="shell-session"><pre class="language-shell-session"><code class="language-shell-session"><span class="token command"><span class="token shell-symbol important">$</span> <span class="token bash language-bash">helm <span class="token function">install</span> <span class="token parameter variable">-f</span> https://raw.githubusercontent.com/seanmwinn/cilium-k3s-demo/master/configmap.yaml <span class="token punctuation">\\</span>\n <span class="token parameter variable">--namespace</span> metallb-system metallb stable/metallb</span></span></code></pre></div>'}}),"\n",s.createElement(a.p,null,"We are passing a configmap to the MetalLB which includes the following inline\nconfiguration:"),"\n",s.createElement(a.span,{dangerouslySetInnerHTML:{__html:'<div class="gatsby-highlight" data-language="yaml"><pre class="language-yaml"><code class="language-yaml"><span class="token key atrule">configInline</span><span class="token punctuation">:</span>\n <span class="token key atrule">peers</span><span class="token punctuation">:</span>\n <span class="token key atrule">address-pools</span><span class="token punctuation">:</span>\n <span class="token punctuation">-</span> <span class="token key atrule">name</span><span class="token punctuation">:</span> default\n <span class="token key atrule">protocol</span><span class="token punctuation">:</span> layer2\n <span class="token key atrule">addresses</span><span class="token punctuation">:</span>\n <span class="token punctuation">-</span> 192.168.80.101<span class="token punctuation">-</span>192.168.80.150</code></pre></div>'}}),"\n",s.createElement(a.p,null,"This MetalLB configuration will establish an IP address range which will be\na
1dvertised using Layer2 protocols."),"\n",s.createElement(a.p,null,"You can check that MetalLB has started up by running:"),"\n",s.createElement(a.span,{dangerouslySetInnerHTML:{__html:'<div class="gatsby-highlight" data-language="shell-session"><pre class="language-shell-session"><code class="language-shell-session"><span class="token output">kubectl get pods -o wide -n metallb-system</span></code></pre></div>'}}),"\n",s.createElement(a.p,null,"You should see a single controller pod and one speaker pod for each node in the\ncluster. If you used the default configuration, you should see a total of 3 pods."),"\n",s.createElement(a.span,{dangerouslySetInnerHTML:{__html:'<span\n class="gatsby-resp-image-wrapper"\n style="position: relative; display: block; margin-left: auto; margin-right: auto; max-width: 1008px; "\n >\n <a\n class="gatsby-resp-image-link"\n href="/static/89d6e821dea570a7cfab1e923d348861/aa928/metallb-running.png"\n style="display: block"\n target="_blank"\n rel="noopener"\n >\n <span\n class="gatsby-resp-image-background-image"\n style="padding-bottom: 15.476190476190476%; position: relative; bottom: 0; left: 0; background-image: url(\'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAADCAYAAACTWi8uAAAACXBIWXMAAAsTAAALEwEAmpwYAAAAmklEQVR42jWO2wqFIBBFJbKLFSWZdqVjYlj//3/7MAM9LBjdrj2K931xXRdznieO40AIATFG+J/Hvu9YlgXWWsYYA+ccs64rtm3DPM+44430JIiUEgskNk0DIQSUUhjHEd57aK3RdR2LVEgLvzLKyZnMxHme5xD0iCRiGAamrmtIKdH3PYqiQJZlXNq2LedVVfH5+0BZlnxH8x9rUkoehLd7NAAAAABJRU5ErkJggg==\'); background-size: cover; display: block;"\n ></span>\n <picture>\n <source\n srcset="/static/89d6e821dea570a7cfab1e923d348861/2ff5b/metallb-running.webp 252w,\n/static/89d6e821dea570a7cfab1e923d348861/4d583/metallb-running.webp 504w,\n/static/89d6e821dea570a7cfab1e923d348861/905a7/metallb-running.webp 1008w,\n/static/89d6e821dea570a7cfab1e923d348861/7472c/metallb-running.webp 1490w"\n sizes="(max-width: 1008px) 100vw, 1008px"\n type="image/webp"\n />\n <source\n srcset="/static/89d6e821dea570a7cfab1e923d348861/019e0/metallb-running.png 252w,\n/static/89d6e821dea570a7cfab1e923d348861/0dcb2/metallb-running.png 504w,\n/static/89d6e821dea570a7cfab1e923d348861/832a9/metallb-running.png 1008w,\n/static/89d6e821dea570a7cfab1e923d348861/aa928/metallb-running.png 1490w"\n sizes="(max-width: 1008px) 100vw, 1008px"\n type="image/png"\n />\n <img\n class="gatsby-resp-image-image"\n src="/static/89d6e821dea570a7cfab1e923d348861/832a9/metallb-running.png"\n alt="MetalLBRunning"\n title=""\n loading="lazy"\n decoding="async"\n style="width:100%;height:100%;margin:0;vertical-align:middle;position:absolute;top:0;left:0;"\n />\n </picture>\n </a>\n </span>'}}),"\n",s.createElement(a.h2,null,"Observing Traffic with Hubble"),"\n",s.createElement(a.p,null,"Now that we have a fully working multi-node environment, let's deploy some demo\napplications which will allow us to observe the powers of eBPF and Cilium using\nHubble."),"\n",s.createElement(a.p,null,"In our scenario, the Alliance is mounting their attack against an Empire base.\nA fleet of x-wing fighters will infiltrate the security systems and breach the\ndocking area. Teams will then infiltrate the base and activate the internal\nself-destruct mechanisms to destroy the base using one of the terminals from the\ncontrol room. This will ensure victory for the Alliance and restore order to the\ngalaxy."),"\n",s.createElement(a.p,null,"Start off by deploying the applications:"),"\n",s.createElement(a.h3,null,"Empire"),"\n",s.createElement(a.span,{dangerouslySetInnerHTML:{__html:'<div class="gatsby-highlight" data-language="shell-session"><pre class="language-shell-session"><code class="language-shell-session"><span class="token output">kubectl apply -f https://raw.githubusercontent.com/seanmwinn/cilium-k3s-demo/master/example-apps/empire.yaml</span></code></pre></div>'}}),"\n",s.createElement(a.ul,null,"\n",s.createElement(a.li,null,s.createElement(a.strong,null,"docking-doors:")," The docking door control systems. Our heroes need these\nsystems disabled so they can breach the Empire base and transmit the codes."),"\n",s.createElement(a.li,null,s.createElement(a.strong,null,"janitor-bots:")," An API for managing janitor-bots. R2D2 has detected a flaw\nin the janitor bot code which he can exploit to install backdoor program."),"\n",s.createElement(a.li,null,s.createElement(a.strong,null,"security-api:")," The central security systems, tightly secured\nagainst attacksâor so the empire thinks..."),"\n"),"\n",s.createElement(a.h3,null,"Alliance"),"\n",s.createElement(a.span,{dangerouslySetInnerHTML:{__html:'<div class="gatsby-highlight" data-language="shell-session"><pre class="language-shell-session"><code class="language-shell-session"><span class="token output">kubectl apply -f https://raw.githubusercontent.com/seanmwinn/cilium-k3s-demo/master/example-apps/alliance.yaml</span></code></pre></div>'}}),"\n",s.createElement(a.p,null,"We will also modify the Hubble UI service to be available via a LoadBalancer\nport using MetalLB:"),"\n",s.createElement(a.span,{dangerouslySetInnerHTML:{__html:'<div class="gatsby-highlight" data-language="shell-session"><pre class="language-shell-session"><code class="language-shell-session"><span class="token command"><span class="token shell-symbol important">$</span> <span class="token bash language-bash">kubectl patch <span class="token parameter variable">-n</span> kube-system svc/hubble-ui <span class="token parameter variable">--patch</span> <span class="token punctuation">\\</span>\n <span class="token string">
1\'{"spec": {"type": "LoadBalancer"}}\'</span></span></span></code></pre></div>'}}),"\n",s.createElement(a.p,null,"Obtain a list of services in the kube-system namespace and determine which IP\naddress was assigned to the hubble-ui service:"),"\n",s.createElement(a.span,{dangerouslySetInnerHTML:{__html:'<span\n class="gatsby-resp-image-wrapper"\n style="position: relative; display: block; margin-left: auto; margin-right: auto; max-width: 1008px; "\n >\n <a\n class="gatsby-resp-image-link"\n href="/static/b944dcdf963bf2128a9b63ba8b946d6c/e997c/hubble-svc.png"\n style="display: block"\n target="_blank"\n rel="noopener"\n >\n <span\n class="gatsby-resp-image-background-image"\n style="padding-bottom: 18.650793650793652%; position: relative; bottom: 0; left: 0; background-image: url(\'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAECAYAAACOXx+WAAAACXBIWXMAAAsTAAALEwEAmpwYAAAAs0lEQVR42lWPyQqEQAxE496KKzZ6ExVxvygeFP//u2pIwBnn8OiiQirVdN83zvPEvu/Ytg3XdeE4DozjKCzLIjx6mqbv7K0fKIoieJ6HpmmQpimCIMA8z9BaIwxD9H0P0zTFX9cVSZKI5p2iKKCUAhH9qOsajuPItbZtEccxuq6TwDzPMQyDhGRZJr+oqgpcgpfLsoTv+6INwxCIr7FhWZbAJjd6a9d15WVs25bZE/LXjggfMC9i+JNFf1gAAAAASUVORK5CYII=\'); background-size: cover; display: block;"\n ></span>\n <picture>\n <source\n srcset="/static/b944dcdf963bf2128a9b63ba8b946d6c/2ff5b/hubble-svc.webp 252w,\n/static/b944dcdf963bf2128a9b63ba8b946d6c/4d583/hubble-svc.webp 504w,\n/static/b944dcdf963bf2128a9b63ba8b946d6c/905a7/hubble-svc.webp 1008w,\n/static/b944dcdf963bf2128a9b63ba8b946d6c/45209/hubble-svc.webp 1157w"\n sizes="(max-width: 1008px) 100vw, 1008px"\n type="image/webp"\n />\n <source\n srcset="/static/b944dcdf963bf2128a9b63ba8b946d6c/019e0/hubble-svc.png 252w,\n/static/b944dcdf963bf2128a9b63ba8b946d6c/0dcb2/hubble-svc.png 504w,\n/static/b944dcdf963bf2128a9b63ba8b946d6c/832a9/hubble-svc.png 1008w,\n/static/b944dcdf963bf2128a9b63ba8b946d6c/e997c/hubble-svc.png 1157w"\n sizes="(max-width: 1008px) 100vw, 1008px"\n type="image/png"\n />\n <img\n class="gatsby-resp-image-image"\n src="/static/b944dcdf963bf2128a9b63ba8b946d6c/832a9/hubble-svc.png"\n alt="HubbleSvc"\n title=""\n loading="lazy"\n decoding="async"\n style="width:100%;height:100%;margin:0;vertical-align:middle;position:absolute;top:0;left:0;"\n />\n </picture>\n </a>\n </span>'}}),"\n",s.createElement(a.p,null,"Here we can see the IP address for hubble-ui listed as an External IP and the\nadvertised port, 12000. Using a web broswer, navigate to the IP address of\nhubble-ui on port 12000 and select the empire namespace in the top left corner:"),"\n",s.createElement(a.span,{dangerouslySetInnerHTML:{__html:'<span\n class="gatsby-resp-image-wrapper"\n style="position: relative; display: block; margin-left: auto; margin-right: auto; max-width: 1008px; "\n >\n <a\n class="gatsby-resp-image-link"\n href="/static/b485f9fe63aa651737e5286125dd70b9/a68fb/hubble-ui.png"\n style="display: block"\n target="_blank"\n rel="noopener"\n >\n <span\n class="gatsby-resp-image-background-image"\n style="padding-bottom: 43.25396825396825%; position: relative; bottom: 0; left: 0; background-image: url(\'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAJCAYAAAAywQxIAAAACXBIWXMAABYlAAAWJQFJUiTwAAAAk0lEQVR42q2PsQ4CIRBE9/+/wQBC1FOjhYlfY2VhZcNVHrIwshha78zdJC9T7OzAknVbKGMLa6yMg3UbWOuglIbW5ieS2ZX86XyBPe7RdQfQ9ca49xmi/LVZosezx/BmpCSkCvN02k6DwvAqg4ilRLncmZe4tRVOCf3zKI0VhRDgva8+q1DKYowVKRNn5tGfEhbWB5jbtUUlZLf7AAAAAElFTkSuQmCC\'); background-size: cover; display: block;"\n ></span>\n <picture>\n <source\n srcset="/static/b485f9fe63aa651737e5286125dd70b9/2ff5b/hubble-ui.webp 252w,\n/static/b485f9fe63aa651737e5286125dd70b9/4d583/hubble-ui.webp 504w,\n/static/b485f9fe63aa651737e5286125dd70b9/905a7/hubble-ui.webp 1008w,\n/static/b485f9fe63aa651737e5286125dd70b9/bb9f8/hubble-ui.webp 1512w,\n/static/b485f9fe63aa651737e5286125dd70b9/83a93/hubble-ui.webp 2016w,\n/static/b485f9fe63aa651737e5286125dd70b9/f3e60/hubble-ui.webp 3578w"\n sizes="(max-width: 1008px) 100vw, 1008px"\n type="image/webp"\n />\n <source\n srcset="/static/b485f9fe63aa651737e5286125dd70b9/019e
10/hubble-ui.png 252w,\n/static/b485f9fe63aa651737e5286125dd70b9/0dcb2/hubble-ui.png 504w,\n/static/b485f9fe63aa651737e5286125dd70b9/832a9/hubble-ui.png 1008w,\n/static/b485f9fe63aa651737e5286125dd70b9/19357/hubble-ui.png 1512w,\n/static/b485f9fe63aa651737e5286125dd70b9/29ed2/hubble-ui.png 2016w,\n/static/b485f9fe63aa651737e5286125dd70b9/a68fb/hubble-ui.png 3578w"\n sizes="(max-width: 1008px) 100vw, 1008px"\n type="image/png"\n />\n <img\n class="gatsby-resp-image-image"\n src="/static/b485f9fe63aa651737e5286125dd70b9/832a9/hubble-ui.png"\n alt="HubbleUI"\n title=""\n loading="lazy"\n decoding="async"\n style="width:100%;height:100%;margin:0;vertical-align:middle;position:absolute;top:0;left:0;"\n />\n </picture>\n </a>\n </span>'}}),"\n",s.createElement(a.p,null,"You should now see a service map of all communications going to or from the\nempire's various applications in the upper part of the screen, and a list of\nflows and their forwarding status - either dropped or forwarded in the lower\npart. Here you can see the failed attempts of the x-wing fleet trying to unlock\nthe docking doors which would allow them to access the empire base."),"\n",s.createElement(a.span,{dangerouslySetInnerHTML:{__html:'<span\n class="gatsby-resp-image-wrapper"\n style="position: relative; display: block; margin-left: auto; margin-right: auto; max-width: 1008px; "\n >\n <a\n class="gatsby-resp-image-link"\n href="/static/f4ce66501ec2b908eafb5e41f4636696/67aa0/xwing-dropped.png"\n style="display: block"\n target="_blank"\n rel="noopener"\n >\n <span\n class="gatsby-resp-image-background-image"\n style="padding-bottom: 13.492063492063492%; position: relative; bottom: 0; left: 0; background-image: url(\'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAADCAYAAACTWi8uAAAACXBIWXMAABYlAAAWJQFJUiTwAAAAp0lEQVR42jWN0QqEIBBF+/+/i4IgC7OsJE3R1ZJe7k4u+3SYO3PPVOa0COED6yw88bSuzNd1EQNyzhBygzo0vA84iIl2f+Z843keWOrFmFD1fY9928A5x77vWJYZ4zhio4wxVrJ5nuk4Yl1XKKXKs5RSyRbNEaKHc466C6q6riGEQNd1pfjK2raFmCY0TQMpJYmHUn73Wmvc903Cn9QoRvzAmBPDMOAL97zgAGM6u8EAAAAASUVORK5CYII=\'); background-size: cover; display: block;"\n ></span>\n <picture>\n <source\n srcset="/static/f4ce66501ec2b908eafb5e41f4636696/2ff5b/xwing-dropped.webp 252w,\n/static/f4ce66501ec2b908eafb5e41f4636696/4d583/xwing-dropped.webp 504w,\n/static/f4ce66501ec2b908eafb5e41f4636696/905a7/xwing-dropped.webp 1008w,\n/static/f4ce66501ec2b908eafb5e41f4636696/bb9f8/xwing-dropped.webp 1512w,\n/static/f4ce66501ec2b908eafb5e41f4636696/83a93/xwing-dropped.webp 2016w,\n/static/f4ce66501ec2b908eafb5e41f4636696/d6c91/xwing-dropped.webp 3528w"\n sizes="(max-width: 1008px) 100vw, 1008px"\n type="image/webp"\n />\n <source\n srcset="/static/f4ce66501ec2b908eafb5e41f4636696/019e0/xwing-dropped.png 252w,\n/static/f4ce66501ec2b908eafb5e41f4636696/0dcb2/xwing-dropped.png 504w,\n/static/f4ce66501ec2b908eafb5e41f4636696/832a9/xwing-dropped.png 1008w,\n/static/f4ce66501ec2b908eafb5e41f4636696/19357
1/xwing-dropped.png 1512w,\n/static/f4ce66501ec2b908eafb5e41f4636696/29ed2/xwing-dropped.png 2016w,\n/static/f4ce66501ec2b908eafb5e41f4636696/67aa0/xwing-dropped.png 3528w"\n sizes="(max-width: 1008px) 100vw, 1008px"\n type="image/png"\n />\n <img\n class="gatsby-resp-image-image"\n src="/static/f4ce66501ec2b908eafb5e41f4636696/832a9/xwing-dropped.png"\n alt="X-WingDropped"\n title=""\n loading="lazy"\n decoding="async"\n style="width:100%;height:100%;margin:0;vertical-align:middle;position:absolute;top:0;left:0;"\n />\n </picture>\n </a>\n </span>'}}),"\n",s.createElement(a.p,null,"We can see in the logs that the x-wing-red fleet has been unsuccessful in their\nattempts to communicate with the security-api control systems."),"\n",s.createElement(a.p,null,"Fortunately, R2D2 has been able to find a critical security vulnerability in\nthe janitor bots, and he is able to deploy an application into the empire's\nsystems to open a backdoor:"),"\n",s.createElement(a.span,{dangerouslySetInnerHTML:{__html:'<div class="gatsby-highlight" data-language="shell-session"><pre class="language-shell-session"><code class="language-shell-session"><span class="token output">kubectl apply -f https://raw.githubusercontent.com/seanmwinn/cilium-k3s-demo/master/example-apps/r2d2.yaml</span></code></pre></div>'}}),"\n",s.createElement(a.p,null,"Let's explore the backdoor application R2D2 was able to install:"),"\n",s.createElement(a.span,{dangerouslySetInnerHTML:{__html:'<div class="gatsby-highlight" data-language="yaml"><pre class="language-yaml"><code class="language-yaml"><span class="token punctuation">---</span>\n<span class="token key atrule">apiVersion</span><span class="token punctuation">:</span> <span class="token string">\'cilium.io/v2\'</span>\n<span class="token key atrule">kind</span><span class="token punctuation">:</span> CiliumNetworkPolicy\n<span class="token key atrule">metadata</span><span class="token punctuation">:</span>\n <span class="token key atrule">name</span><span class="token punctuation">:</span> <span class="token string">\'janitor-bots-backdoor\'</span>\n <span class="token key atrule">namespace</span><span class="token punctuation">:</span> empire\n<span class="token key atrule">spec</span><span class="token punctuation">:</span>\n <span class="token key atrule">endpointSelector</span><span class="token punctuation">:</span>\n <span class="token key atrule">matchLabels</span><span class="token punctuation">:</span> <span class="token punctuation">{</span><span class="token punctuation">}</span>\n <span class="token key atrule">ingress</span><span class="token punctuation">:</span>\n <span class="token punctuation">-</span> <span class="token key atrule">fromEndpoints</span><span class="token punctuation">:</span>\n <span class="token punctuation">-</span> <span class="token key atrule">matchLabels</span><span class="token punctuation">:</span>\n <span class="token key atrule">k8s:io.kubernetes.pod.namespace</span><span class="token punctuation">:</span> alliance\n <span class="token key atrule">egress</span><span class="token punctuation">:</span>\n <span class="token punctuation">-</span> <span class="token key atrule">toEndpoints</span><span class="token punctuation">:</span>\n <span class="token punctuation">-</span> <span class="token key atrule">matchLabels</span><span class="token punctuation">:</span>\n <span class="token key atrule">name</span><span class="token punctuation">:</span> janitor<span class="token punctuation">-</span>bot</code></pre></div>'}}),"\n",s.createElement(a.p,null,"R2D2 was able to find a flaw in the empire's systems which allowed him to access\nthe janitor bots. While the empire was thoughtful about security for the docking\nbay, these droids have access to every system inside the baseâincluding the\ndocking bay doors! He created an application that will allow any communications\nthat come from an alliance ship to access the janitor-bots which should allow\nthe x-wing red fleet to breach the empire base."),"\n",s.createElement(a.p,null,"R2D2 also sent out the following application update to give the x-wing\nfleet access to the docking bay security systems via the janitor bots:"),"\n",s.createElement(a.span,{dangerouslySetInnerHTML:{__html:'<div class="gatsby-highlight" data-language="shell-session"><pre class="language-shell-session"><code class="language-shell-session"><span class="token command"><span class="token shell-symbol important">$</span> <span class="token bash language-bash">kubectl patch <span class="token parameter variable">-n</span> alliance deploy/x-wing-red <span class="token parameter variable">-p</span> <span class="token punctuation">\\</span>\n <span class="token string">\'{"spec": {"template": {"spec": {"containers": [{"name": "x-wing-red", "command":["bash", "-c", "while true; do curl -sS -o /dev/null janitor-bot.empire.svc.cluster.local; sleep $(( ( RANDOM % 10 ) + 1 )); done"]}]}}}}\'</span></span></span></code></pre></div>'}}),"\n",s.createElement(a.span,{dangerouslySetInnerHTML:{__html:'<span\n class="gatsby-resp-image-wrapper"\n style="position: relative; display: block; margin-left: auto; margin-right: auto; max-width: 1008px; "\n >\n <a\n class="gatsby-resp-image-link"\n href="/static/6c376c77d9351562a1a2a4016b8e48ac/6dafb/xwing-allowed.png"\n style="display: block"\n target="_blank"\n rel="noopener"\n >\n <span\n class="gatsby-resp-image-background-image"\n style="padding-bottom: 13.88888888888889%; position: relative; bottom: 0; left: 0; background-image: url(\'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAADCAYAAACTWi8uAAAACXBIWXMAABYlAAAWJQFJUiTwAAAAoUlEQVR42jWO2w6EIAxE/f8PVGPUICCaLLflqk+z0GQfmmk7c5oOxjp8Y4BzHt8QYJ1DjAmllKaRlAkFbVzLtPIeIURobVBrxfu+SDmTV0rFMM8zOOdY1xVSSggh8N8tywKlFM5TIjeIMUZg7ztsvAb/7Ci5tMxJ7DCOI47jwL7vtOxHp2kic9s23PdNh1JKpP3r/tnzPHDRQlpG83VdxP4A/DbgYV1irVUAAAAASUVORK5CYII=\'); background-size: cover; display: block;"\n ></span>\n <picture>\n <source\n srcset="/static/6c376c77d9351562a1a2a4016b8e48ac/2ff5b/xwing-allowed.webp 252w,\n/static/6c376c77d9351562a1a2a4016b8e48ac/4d583/xwing-allowed.webp 504w,\n/static/6c376c77d9351562a1a2a4016b8e48ac/905a7/xwing-allowed.webp 1008w,\n/static/6c376c77d9351562a1a2a4016b8e48ac/bb9f8/xwing-allowed.webp 1512w,\n/static/6c376c77d9351562a1a2a4016b8e48ac/83a93/xwing-allowed.webp 2016w,\n/static/6c376c77d9351562a1a2a4016b8e48ac/af1d7/xwing-allowed.webp 3564w"\n sizes="(max-width: 1008px) 100vw, 1008px"\n type="image/webp"\n />\n <source\n srcset="/static/6c376c77d9351562a1a2a4016b8e48ac/019e0/xwing-allowed.png 252w,\n/static/6c376c77d9351562a1a2a4016b8e48ac/0dcb2/xwing-allowed.png 504w,\n/static/6c376c77d9351562a1a2a4016b8e48ac/832a9/xwing-allowed.png 1008w,\n/static/6c376c77d9351562a1a2a4016b8e48ac/19357/xwing-allowed.png 1512w,\n/static/6c376c77d9351562a1a2a4016b8e48ac/29ed2/xwing-allowed.png 2016w,\n/static/6c376c77d9351562a1a2a4016b8e48ac/6dafb/xwing-allowed.png 3564w"\n sizes="(max-width: 1008px) 100vw, 1008px"\n type="image/png"\n />\n <img\n class="gatsby-resp-image-image"\n src="/static/6c376c77d9351562a1a2a4016b8e48ac/832a9/xwing-allowed.png"\n alt="XWingAllow"\n title=""\n loading="lazy"\n decoding="async"\n style="width:100%;height:100%;margin:0;vertical-align:middle;position:absolute;top:0;left:0;"\n />\n </picture>\n </a>\n </span>'}}),"\n",s.createElement(a.p,null,"This allows the x-wing fleet to land inside the docking bay. Our heroes are able\nto successfully access the empire base's self-destruct mechanism and make it\nback out safely!"),"\n",s.createElement(a.p,null,"The galaxy is saved......"),"\n",s.createElement(a.h2,null,"Further Reading"),"\n",s.createElement(a.p,null,"We encourage you to read the following guides and explore Hubble's capabilities:"),"\n",s.createElement(a.ul,null,"\n",s.createElement(a.li,null,s.createElement(a.a,{href:"https://github.com/cilium/hubble/tree/v0.5/tutorials/deploy-hubble-and-grafana"},"Setting up Hubble Metrics with Grafana")),"\n",s.createElement(a.li,null,s.createElement(a.a,{href:"https://github.com/cilium/hubble/blob/v0.5/Documentation/dns_visibility.md"},"Enabling DNS Visibility")),"\n",s.createElement(a.li,null,s.createElement(a.a,{href:"https://github.com/cilium/hubble/blob/v0.5/Documentation/http_visibility.md"},"Enabling HTTP Visibility")),"\n"),"\n",s.createElement(a.h2,null,"Cleanup"),"\n",s.createElement(a.p,null,"To clean up the environment and delete all virtual machines, from the same\nfolder where the environment was first started:"),"\n",s.createElement(a.p,null,s.createElement(a.span,{dangerouslySetInnerHTML:{__html:'<code class="language-text">vagrant destroy -f</code>'}})))}var i=function(e){void 0===e&&(e={});const{wrapper:a}=Object.assign({},(0,t.RP)(),e.components);return a?s.createElement(a,e,s.createElement(l,e)):l(e)}
1,o=n(8125),c=n(5805),r=n(8838),p=n(2744);const d=e=>{const{data:{mdx:a},children:n}=e,{frontmatter:{path:t,title:l,date:i,tags:r,ogSummary:d}}=a;return s.createElement(p.A,{headerWithSearch:!0},s.createElement(o.A,{path:t,content:n,date:i,title:l,tags:r,summary:d}),s.createElement(c.A,{className:"my-10 md:my-20 lg:my-28"}))},u=e=>{var a,n;let{data:{mdx:t,site:l},location:{pathname:i}}=e;const{frontmatter:{title:o,ogImage:c,ogSummary:p,dateIso:d,tags:u,author:g}}=t,{siteUrl:b}=l.siteMetadata,m=`${p.slice(0,133)}...`,h=`${b}${i}`,A=null!=c&&null!==(a=c.childImageSharp)&&void 0!==a&&null!==(n=a.resize)&&void 0!==n&&n.src?`${b}${c.childImageSharp.resize.src}`:null,w={title:o,description:m,image:c||null,slug:i},f={"@context":"https://schema.org","@type":"BlogPosting",headline:o,description:m,url:h,datePublished:d,dateModified:d,author:g?{"@type":"Person",name:g}:{"@type":"Organization",name:"Cilium",url:b},publisher:{"@type":"Organization",name:"Cilium",url:b,logo:{"@type":"ImageObject",url:`${b}/images/social-preview.jpg`}},...A&&{image:{"@type":"ImageObject",url:A,width:1200,height:630}},...(null==u?void 0:u.length)>0&&{keywords:u.join(", ")}};return s.createElement(r.A,{data:w,type:"article",datePublished:d,jsonLd:f})};function g(e){return s.createElement(d,e,s.createElement(i,e))}}}]); 2//# sourceMappingURL=component---src-templates-blog-post-jsx-content-file-path-src-posts-2020-04-29-cilium-with-rancher-labs-k-3-s-index-md-140e2eff86e41f3a45da.js.map
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.