1"use strict";(self.webpackChunkcilium_io=self.webpackChunkcilium_io||[]).push([[6760],{2496:function(e,n,a){a.r(n),a.d(n,{Head:function(){return u},default:function(){return m}});var t=a(8453),s=a(6540);function i(e){const n=Object.assign({span:"span",p:"p",h2:"h2",strong:"strong",a:"a",ul:"ul",li:"li",h3:"h3"},(0,t.RP)(),e.components);return s.createElement(s.Fragment,null,s.createElement(n.span,{dangerouslySetInnerHTML:{__html:'<span\n class="gatsby-resp-image-wrapper"\n style="position: relative; display: block; margin-left: auto; margin-right: auto; max-width: 917px; "\n >\n <a\n class="gatsby-resp-image-link"\n href="/static/9c0b7f53852b00058ce6a1fe9750cd24/eb014/ogimage.png"\n style="display: block"\n target="_blank"\n rel="noopener"\n >\n <span\n class="gatsby-resp-image-background-image"\n style="padding-bottom: 44.44444444444444%; position: relative; bottom: 0; left: 0; background-image: url(\'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAJCAYAAAAywQxIAAAACXBIWXMAAAsTAAALEwEAmpwYAAACbUlEQVR42iWQ20uTYRzHd1d0EXhe5DyTZjb9CySQbqtLiQ6eMeg2ugrvggp0alkqJSpKd2Ux1BzpPNsU55zH6dS5jc25zek23+3d9un19YEHvt8Hfp/n+/0p5rYDTKxaWXEEWDrwYLC6cQai0puDeYsdo/2YZdsRi1Yn/lCEibUgU+suTLYTTI4Qq44gZvsZxsNTLO4wijVnEP36FiPTZv4smJi12Ng7FpjbsaJf2+XX+AJji2b0mxaOg2EGJ0941W1DtyHypt9Jvz5A/1SI131u/u2FUJgOpR+Nbkb1O4xN77Gw7cN6FGZ5P4Bubo+RvxZ0swfoTU5cUvIfM8t86O1DOz/K284eeoeHGBgf4d3gkNTIjWLfE8KwcojFecrKlhuz1cuJkMBi92Iw7rNpD7Bh9bPr8CEAp8FdxKAWv+s3PpeWoG8Ywa9FONXhCUkJz8/PEYQwwXCEeDzBxYnFEkSjouRjsl9cWqJFo6Gjo4PW9i80a7po/fhV0t1o2rpp+9TD++bPDAx+RyHGLoZi0h5FvGcXWoJFwhx7XHi9fhnY3NzClavXUGVlk6NSocxIJy0tHaXyBhlKJdl5eVxPSqa8/B6KSCQqQ3SmCN6AKANEUcDn80hAn+w7O7tQqXIoVZehvqumqOgOhYW3KZF0cXEJ6tIycnLzefDwkQQUIvKQbsTG5LdnOGxTsk8kElL1y8rt7e0kpSZTcKtAGswhKzebzEzV5b2pIj+/gJSUVCoqKlDExMtUhkknP9vuszyjkX08EZd2GJe1VqvladUTGl82UltfS8OLBurq66iuqqa2pobq51U8rqykqamJ//XXLaPYIDRnAAAAAElFTkSuQmCC\'); background-size: cover; display: block;"\n ></span>\n <picture>\n <source\n srcset="/static/9c0b7f53852b00058ce6a1fe9750cd24/2ff5b/ogimage.webp 252w,\n/static/9c0b7f53852b00058ce6a1fe9750cd24/4d583/ogimage.webp 504w,\n/static/9c0b7f53852b00058ce6a1fe9750cd24/d4843/ogimage.webp 917w"\n sizes="(max-width: 917px) 100vw, 917px"\n type="image/webp"\n />\n <source\n srcset="/static/9c0b7f53852b00058ce6a1fe9750cd24/019e0/ogimage.png 252w,\n/static/9c0b7f53852b00058ce6a1fe9750cd24/0dcb2/ogimage.png 504w,\n/static/9c0b7f53852b00058ce6a1fe9750cd24/eb014/ogimage.png 917w"\n sizes="(max-width: 917px) 100vw, 917px"\n type="image/png"\n />\n <img\n class="gatsby-resp-image-image"\n src="/static/9c0b7f53852b00058ce6a1fe9750cd24/eb014/ogimage.png"\n alt="Release Overview"\n title=""\n loading="lazy"\n decoding="async"\n style="width:100%;height:100%;margin:0;vertical-align:middle;position:absolute;top:0;left:0;"\n />\n </picture>\n </a>\n </span>'}}),"\n",s.createElement(n.p,null,"We are excited to announce the Cilium 1.4 release. The release introduces\nseveral new features as well as optimization and scalability work. The\nhighlights include the addition of global services to provide Kubernetes\nservice routing across multiple clusters, DNS request/response aware\nauthorization and visibility, transparent encryption (beta), IPVLAN support for\nbetter performance and latency (beta), integration with Flannel, GKE on COS\nsupport, AWS metadata based policy enforcement (alpha) as well as significant\nefforts into optimizing memory and CPU usage."),"\n",s.createElement(n.p,null,"As usual, a big shout out to the entire community of Cilium developers who have\ncontributed 1048 commits in the last 4 months between version 1.3 and 1.4."),"\n",s.createElement(n.h2,null,"What is Cilium?"),"\n",s.createElement(n.p,null,"Cilium is open source software for transparently providing and securing the\nnetwork and API connectivity between application services deployed using Linux\ncontainer management platforms like Kubernetes, Docker, and Mesos."),"\n",s.createElement(n.p,null,"At the foundation of Cilium is a new Linux kernel technology called BPF, which\nenables the dynamic insertion of powerful security, visibility, and networking\ncontrol logic within Linux itself. BPF is utilized to provide functionality\nsuch as multi-cluster routing, load balancing to replace kube-proxy,\ntransparent encryption using X.509 certificates as well as network and service\nsecurity. Besides providing traditional network level security, the flexibility\nof BPF enables security with the context of application protocols and DNS\nrequests/responses. Cilium is tightly integrated
1with Envoy and provides an\nextension framework based on Go. Because BPF runs inside the Linux kernel, all\nCilium functionality can be applied without any changes to the application code\nor container configuration."),"\n",s.createElement(n.p,null,"See the section ",s.createElement(n.strong,null,s.createElement(n.a,{href:"https://cilium.readthedocs.io/en/stable/intro/"},"Introduction to Cilium"))," for a more detailed general\nintroduction to Cilium."),"\n",s.createElement(n.h2,null,"Multi-Cluster Service Routing"),"\n",s.createElement(n.p,null,"Cilium 1.3 introduced the basic pod IP routing capability between multiple\nclusters. Cilium 1.4 is introducing the concept of global services based on\nstandard Kubernetes services. Global services allow a user to nominate a\nKubernetes service to be available in multiple clusters. That service can then\nhave backend pods in multiple clusters."),"\n",s.createElement(n.p,null,"The user experience is as simple as defining a Kubernetes service with\nidentical name and namespace in each cluster and adding an annotation to mark\nit as global."),"\n",s.createElement(n.span,{dangerouslySetInnerHTML:{__html:'<span\n class="gatsby-resp-image-wrapper"\n style="position: relative; display: block; margin-left: auto; margin-right: auto; max-width: 1008px; "\n >\n <a\n class="gatsby-resp-image-link"\n href="/static/d571ea42066d163634133cf758ef45a8/f0f6e/multicluster.png"\n style="display: block"\n target="_blank"\n rel="noopener"\n >\n <span\n class="gatsby-resp-image-background-image"\n style="padding-bottom: 43.65079365079365%; position: relative; bottom: 0; left: 0; background-image: url(\'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAJCAYAAAAywQxIAAAACXBIWXMAABYlAAAWJQFJUiTwAAACA0lEQVR42l2R6W7aUBCF/f4P0kptU7VSyFYgaQJJwKzeymIwNgQwOBiwDXZYvl6c/Kg60tEsd86ZGV3p7GmJ3HZRnZCWm6CPhZ++0XZ3GOMt/fkWOCKbe4rGmmZ/RncW0/cO9OZ7zFnyER9Ybw9ID+0lWUXhplml0LGoDlbcGQZZtc5De0DTiVhudvyUu5w9ydxqOo+dkeA0yOs6BdGT01Sum3W60wVSw1lza2icyw+pkNzzuG7IZCpF0dxHHUUswh1P3Q4X1SJ5VRV1i4xc4KpW4r7V5ar6TEbAdIVgzQ5QXmLun6f8OFP4/KnIZcak3FrRFHVlGOBHO5RRjDreUe0FXF50+PalxvevTbJ5S9QTGsMEZ5Eg1QVBmUSU2x6/Kza5Up9HdUKlvxDnL2kMfOarLTXLF7lPzV6m7/lSjzvZotSao042VO01trdFKps+N/cm5zcaRc2l3F2QyRlc5ls8GjOxWShOPm0Q8CzIp/pF7o/o8ymoU85/6WQLfUpCx36NkdriV6vqmFLNRustaI0C5MaIijJCExsO/Zjd/pA26/aKcnNIqe5gOCsU00t5NX3CSWe13SPxj/m+mGIPeF14bOMNm03EJgqJond/yuO3mEQg2oQkScz/lgoej8cUJ+LL6AXLsnAcB9d1mc1mKU7DPM8jCALCMEwRx/EH913sFP8FZs+K8VUkhNYAAAAASUVORK5CYII=\'); background-size: cover; display: block;"\n ></span>\n <picture>\n <source\n srcset="/static/d571ea42066d163634133cf758ef45a8/2ff5b/multicluster.webp 252w,\n/static/d571ea42066d163634133cf758ef45a8/4d583/multicluster.webp 504w,\n/static/d571ea42066d163634133cf758ef45a8/905a7/multicluster.webp 1008w,\n/static/d571ea42066d163634133cf758ef45a8/bb9f8/multicluster.webp 1512w,\n/static/d571ea42066d163634133cf758ef45a8/84188/multicluster.webp 1856w"\n sizes="(max-width: 1008px) 100vw, 1008px"\n type="image/webp"\n />\n <source\n srcset="/static/d571ea42066d163634133cf758ef45a8/019e0/multicluster.png 252w,\n/static/d571ea42066d163634133cf758ef45a8/0dcb2/multicluster.png 504w,\n/static/d571ea42066d163634133cf758ef45a8/832a9/multicluster.png 1008w,\n/static/d571ea42066d163634133cf758ef45a8/19357/multicluster.png 1512w,\n/static/d571ea42066d163634133cf758ef45a8/f0f6e/multicluster.png 1856w"\n sizes="(max-width: 1008px) 100vw, 1008px"\n type="image/png"\n />\n <img\n class="gatsby-resp-image-image"\n src="/static/d571ea42066d163634133cf758ef45a8/832a9/multicluster.png"\n alt="Multi Cluster Services"\n title=""\n loading="lazy"\n decoding="async"\n style="width:100%;height:100%;margin:0;vertical-align:middle;position:absolute;top:0;left:0;"\n />\n </picture>\n </a>\n </span>'}}),"\n",s.createElement(n.p,null,"The Kubernetes health-check information is leveraged to add and remove service\nbackends automatically as pods scale up and down or become unhealthy."),"\n",s.createElement(n.span,{dangerouslySetInnerHTML:{__html:'<span\n class="gatsby-resp-image-wrapper"\n style="position: relative; display: block; margin-left: auto; margin-right: auto; max-width: 1008px; "\n >\n <a\n class="gatsby-resp-image-link"\n href="/static/e01482aac86fa5fbc24b8f37cf96bd05/f8a0f/multicluster_failover.png"\n style="display: block"\n target="_blank"\n rel="noopener"\n >\n <span\n class="gatsby-resp-image-background-image"\n style="padding-bottom: 33.73015873015873%; position: relative; bottom: 0; left: 0; background-image: url(\'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAHCAYAAAAIy204AAAACXBIWXMAABYlAAAWJQFJUiTwAAABtElEQVR42h2QCZOaUBCE+f+/JKlKrOxmdT2iJooHAqIgBMQL8IgXkVXXM355tfVqanrqVU93j/TcStC8FXa0x19dcRdH/OX1A3t/zgSbEw/x2uMb2mCPE2wYrs9MtjfGmxuj9UXg+8d8vPxDKjsJRdOhYHaR+xP0SULZcSn2LGQvoDs9kLzfSClDUg2dkuVQ688oWj3KtitwRKlnkzd7jFc7pE70Jj4sXtSq6D2xMCZrKKRVmao7oDc7Eh/ugvibjFqhLISqrk9aq5AzmkJ0QEaTybSbjFYxkjZ5w5yfkdUlTymLz58aZDM+qrujO7tgCYfx8SacnrHmIrafUCiMSH0x+PbVpFQJMKcnjPDM9O8VSQ/2mIt3FG9DuTWhUPeROzPU4RY92NERtU5OaOOYtsC66Lmax0vJoqJFqP1Y8I/o4Z4oPiMpwx35yoDveZuatUTxY15/CsIPcStnLdQPbPYX2tGR14rBc65DuuTR8NbI5oLcrwGprM5Tw2We3JHc+QHNnNHUhfXBFlu4UIyQlhFhT3YixoXb/UEYX2jZIUo7QBUJnDCh01+JOaSuj6jbAYfrg//jBe8mGuX1xwAAAABJRU5ErkJggg==\'); background-size: cover; display: block;"\n ></span>\n <picture>\n <source\n srcset="/static/e01482aac86fa5fbc24b8f37cf96bd05/2ff5b/multicluster_failover.webp 252w,\n/static/e01482aac86fa5fbc24b8f37cf96bd05/4d583/multicluster_failover.webp 504w,\n/static/e01482aac86fa5fbc24b8f37cf96bd05/905a7/multicluster_failover.webp 1008w,\n/static/e01482aac86fa5fbc24b8f37cf96bd05/bb9f8/multicluster_failover.webp 1512w,\n/static/e01482aac86fa5fbc24b8f37cf96bd05/32545/multicluster_failover.webp 1880w"\n sizes="(max-width: 1008px) 100vw, 1008px"\n type="image/webp"\n />\n <source\n srcset="/static/e01482aac86fa5fbc24b8f37cf96bd05/019e0/multicluster_failover.png 252w,\n/static/e01482aac86fa5fbc24b8f37cf96bd05/0dcb2/multicluster_failover.png 504w,\n/static/e01482aac86fa5fbc24b8f37cf96bd05/832a9/multicluster_failover.png 1008w,\n/static/e01482aac86fa5fbc24b8f37cf96bd05/19357/multicluster_failover.png 1512w,\n/static/e01482aac86fa5fbc24b8f37cf96bd05/f8a0f/multicluster_failover.png 1880w"\n sizes="(max-width: 1008px) 100vw, 1008px"\n type="image/png"\n />\n <img\n class="gatsby-resp-image-image"\n src="/static/e01482aac86fa5fbc24b8f37cf96bd05/832a9/multicluster_failover.png"\n alt="Multi Cluster Failover"\n title=""\n loading="lazy"\n decoding="async"\n style="width:100%;height:100%;margin:0;vertical-align:middle;position:absolute;top:0;left:0;"\n />\n </picture>\n </a>\n </span>'}}),"\n",s.createElement(n.p,null,"The control plane is built on top of etcd similar to how Kubernetes itself\noperates with resiliency and simplicity as its foundational design pattern.\nEach cluster continues to operate its own etcd cluster and replication happens\non a read-only basis which ensures that failures in a cluster do not impact\
1nother clusters."),"\n",s.createElement(n.span,{dangerouslySetInnerHTML:{__html:'<span\n class="gatsby-resp-image-wrapper"\n style="position: relative; display: block; margin-left: auto; margin-right: auto; max-width: 1008px; "\n >\n <a\n class="gatsby-resp-image-link"\n href="/static/d36b1251334244f8a5c7dc6c84dcd425/6a961/multicluster_control_plane.png"\n style="display: block"\n target="_blank"\n rel="noopener"\n >\n <span\n class="gatsby-resp-image-background-image"\n style="padding-bottom: 49.20634920634921%; position: relative; bottom: 0; left: 0; background-image: url(\'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAKCAYAAAC0VX7mAAAACXBIWXMAABYlAAAWJQFJUiTwAAAByUlEQVR42o2OW4/SUBRG+f+v/gAf1GRiTDTGSXxwEhJmxgBtYSh3ZJjCYMut9E7vy9ODEp8cT7L67Zzuvfap1fsR18oOZbJEX7mMrZCRGVzorwO8OMdyMq4aHsrMRHvcMjQjBj9DmfqzR8fwmG1CasoipDGLaS0CVCNCXWWCBG0Vy7r1dMJyEzZeysfmnnc3Cz7dL9GWvuj3aP2wuR0t+aZpqPMDtcHKpjduo0+7aNOZrB8mOtpkTH/SRBmPsIRs52c0hhbXdzqf6wrN2Q71yRXCPd11yJ32AaXzlZq+sOi136J33qP2bukrb3jofkHt1hmpr1G6N+yCnH0I6qBN//srdO2K1vyIZrjcj7Y0epYQm/SXG2pxVmKfCg5hjp+UYjjDOZV4ss45RjlBGAoidkefveNieyGeuI/E7Gj4TFd9JEhLIkENccqyoMhTyiKjyBJKURf5ua7u4zgWnEiTRGaWip4iP/eImWpefCrVWfivk+cFrutKfN8nEdI0/b1ELhB5Osms/r0orJqm0ynz+RzLsnAc50K14G+CIHhZWBQF6/VaCg3DkFLTNCXH41GKq9dX6Xne/wmrzdvtVlJJbNvmcDhcqGR/8heIB+2ybnNoMwAAAABJRU5ErkJggg==\'); background-size: cover; display: block;"\n ></span>\n <picture>\n <source\n srcset="/static/d36b1251334244f8a5c7dc6c84dcd425/2ff5b/multicluster_control_plane.webp 252w,\n/static/d36b1251334244f8a5c7dc6c84dcd425/4d583/multicluster_control_plane.webp 504w,\n/static/d36b1251334244f8a5c7dc6c84dcd425/905a7/multicluster_control_plane.webp 1008w,\n/static/d36b1251334244f8a5c7dc6c84dcd425/bb9f8/multicluster_control_plane.webp 1512w,\n/static/d36b1251334244f8a5c7dc6c84dcd425/2f1bb/multicluster_control_plane.webp 1706w"\n sizes="(max-width: 1008px) 100vw, 1008px"\n type="image/webp"\n />\n <source\n srcset="/static/d36b1251334244f8a5c7dc6c84dcd425/019e0/multicluster_control_plane.png 252w,\n/static/d36b1251334244f8a5c7dc6c84dcd425/0dcb2/multicluster_control_plane.png 504w,\n/static/d36b1251334244f8a5c7dc6c84dcd425/832a9/multicluster_control_plane.png 1008w,\n/static/d36b1251334244f8a5c7dc6c84dcd425/19357/multicluster_control_plane.png 1512w,\n/static/d36b1251334244f8a5c7dc6c84dcd425/6a961/multicluster_control_plane.png 1706w"\n sizes="(max-width: 1008px) 100vw, 1008px"\n type="image/png"\n />\n <img\n class="gatsby-resp-image-image"\n src="/static/d36b1251334244f8a5c7dc6c84dcd425/832a9/multicluster_control_plane.png"\n alt="Multi Cluster Control Plane"\n title=""\n loading="lazy"\n decoding="async"\n style="width:100%;height:100%;margin:0;vertical-align:middle;position:absolute;top:0;left:0;"\n />\n </picture>\n </a>\n </span>'}}),"\n",s.createElement(n.p,null,"Connecting clusters together is as simple as providing routing between VPCs\nusing standard routing APIs of cloud providers or on-prem infrastructure via\nregular IPSec based VPN gateways and tunnels and then exposing the Cilium\ncontrol plane via an internal Kubernetes Loadbalancer to expose it to the\ninternal VPCs. TLS is used to authenticate the client and server with the\ncertificates and keys managed as Kubernetes secrets."),"\n",s.createElement("a",{name:"ipvlan-support-beta"}),"\n",s.createElement(n.h2,null,"IPVLAN support (beta)"),"\n",s.createElement(n.p,null,"A new IPVLAN based datapath mode has been added. IPVLAN has latency advantages\nover veth based architectures. The following benchmarks have been measured with\nnetperf between two local containers on a 3.40Ghz Xeon with hyper-threading\ndisabled using a single core. The 99th percentile latency is considerably\nlower with IPVLAN compared to veth (lower is better):"),"\n",s.createElement(n.span,{dangerouslySetInnerHTML:{__html:'<span\n class="gatsby-resp-image-wrapper"\n style="position: relative; display: block; margin-left: auto; margin-right: auto; max-width: 1008px; "\n >\n <a\n class="gatsby-resp-image-link"\n href="/static/52fcb467829ab0447147adddd0efd808/815f9/ipvlan_perf_latency.png"\n style="display: block"\n target="_blank"\n rel="noopener"\n >\n <span\n class="gatsby-resp-image-background-image"\n style="padding-bottom: 58.333333333333336%; position: relative; bottom: 0; left: 0; background-image: url(\'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAMCAYAAABiDJ37AAAACXBIWXMAABYlAAAWJQFJUiTwAAACOElEQVR42o2T22sTQRTG968Stb5a9FFQ++zfIWpBQcR66YOgVitYUSmirUTFqq2WSry0tUXbqGhMNvdkl+wm22Rvsz9nJmn1oV4OzM43s2e+mXPOd4xarUa5XMa2bVqtFmrtui7ValXjIAhQliQJQgg5Yokhkp9fe4JNM8IwxPd9vVDOmw5CRHqOY7G1l/RJwlCQK7RxHEePZrO5dbHBf5giUZYvzGBlX2nc+rauI1PRqMja7ba8PMZQnzCKtFOjsYbvVBUFtcoHhN9Bvg
1s/8PT/ufQwmZkzGoftz1QqFXmmQb1eJ+pzGAoEkSBwXKbuDVHNLOBZJg9uDSLcFkVzltepI5SLcGPkAGb6oj64bhewLRvLsjShqoEK29hM6NKLj9w8u5uaucr8nRQPrw3QtH2ejw3zZvoQ+RxcHh7EfDuq/V1zhXw+T6lUolgs6lmH7HkeyRbhLiq5ZV7eTpG6PkCh2GHy/DHepw6T+wFXT+4jl76gCWPP0vlTBf290kbcj315bo2JkQH5whXm7z4mNb5H5sjn/ugJFh8NYeZh7NR++cJeyIlUxHZmJH3mdzOrjJ/eQSm7xOzENFNXdmIWNpgcOUp66iDZ73Dp+F6yC+f6hNEfCKUkYklaLdTJrDzBa1mYX7JkM0+lFHy+ri7KNCzgOjGflp7RrKzTU1GyPWFP0IJOt0OsyOOIDYmVexj4dORQ2Pe7+FH4T81qQtUtSj6qUxyn2e+QiF7BZGdIOXS6XY2TRPyV8Ceq1XkMWpE8nwAAAABJRU5ErkJggg==\'); background-size: cover; display: block;"\n ></span>\n <picture>\n <source\n srcset="/static/52fcb467829ab0447147adddd0efd808/2ff5b/ipvlan_perf_latency.webp 252w,\n/static/52fcb467829ab0447147adddd0efd808/4d583/ipvlan_perf_latency.webp 504w,\n/static/52fcb467829ab0447147adddd0efd808/905a7/ipvlan_perf_latency.webp 1008w,\n/static/52fcb467829ab0447147adddd0efd808/f13d9/ipvlan_perf_latency.webp 1162w"\n sizes="(max-width: 1008px) 100vw, 1008px"\n type="image/webp"\n />\n <source\n srcset="/static/52fcb467829ab0447147adddd0efd808/019e0/ipvlan_perf_latency.png 252w,\n/static/52fcb467829ab0447147adddd0efd808/0dcb2/ipvlan_perf_latency.png 504w,\n/static/52fcb467829ab0447147adddd0efd808/832a9/ipvlan_perf_latency.png 1008w,\n/static/52fcb467829ab0447147adddd0efd808/815f9/ipvlan_perf_latency.png 1162w"\n sizes="(max-width: 1008px) 100vw, 1008px"\n type="image/png"\n />\n <img\n class="gatsby-resp-image-image"\n src="/static/52fcb467829ab0447147adddd0efd808/832a9/ipvlan_perf_latency.png"\n alt="IPVLAN performance (latency)"\n title=""\n loading="lazy"\n decoding="async"\n style="width:100%;height:100%;margin:0;vertical-align:middle;position:absolute;top:0;left:0;"\n />\n </picture>\n </a>\n </span>'}}),"\n",s.createElement(n.p,null,"The maximum throughput (higher is better) is quite similar between IPVLAN and\nveth but a very noticeable performance gain can be achieved by compiling out\nnetfilter/iptables from the kernel. Running your Kubernetes cluster completely\niptables free is already possible if you are not using NodePort services and do\nnot require to masquerade network traffic as it leaves a Kubernete worker node.\nWe'll provide a guide on how to run iptables and kube-proxy free in the next\ncouple of weeks."),"\n",s.createElement(n.span,{dangerouslySetInnerHTML:{__html:'<span\n class="gatsby-resp-image-wrapper"\n style="position: relative; display: block; margin-left: auto; margin-right: auto; max-width: 1008px; "\n >\n <a\n class="gatsby-resp-image-link"\n href="/static/0ef82414bb6bae0344ed4aebc8eecce9/f9f46/ipvlan_perf.png"\n style="display: block"\n target="_blank"\n rel="noopener"\n >\n <span\n class="gatsby-resp-image-background-image"\n style="padding-bottom: 57.93650793650793%; position: relative; bottom: 0; left: 0; background-image: url(\'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAMCAYAAABiDJ37AAAACXBIWXMAABYlAAAWJQFJUiTwAAABx0lEQVR42p2TTUsbURSGs1f/htRVN9KCZGVcVLvoQvwBduOmK0Fb3LgpxZ24bhelwRQtFIKFdtN9QTc2WtFOqJIxzQcJM8lM5uN+vJ1zbkxCSUS8cO7lcu995n3POZOqVquo1Wool8uoVCpwXTfZ1xFFMe4zUnEcw3EcdDodSCk5lBTJkYKmWakhoXFpe8k7l982Gg2EYWiANGmtYVbzlYqjcFoS0HGUEGX/YGC4RQt/r68Z2Gq14Hkei0kRjFSyMsVY5A6BpY1zlJ4vIbr6YwjmsDs0VKeIZqOOZrPZC1KZIgvtdps3QtIjYYDrJyhmHsH/8RZeYMEJg4QpjWWt8KteRMkuoZyotG2ba8DAQRuyq/DjkQFaT+eAD2PY/PwQT77tdLWZ4YuIC0h2aSWXnEPf91lhEASJQrouscsKC/g9Pwtkx7G2/wCP8284l7KrcmSVKXeUR82XBxUWYC0Y4MtPU0gfbPUU6tvahiYhhGkZxY2C3C1Ayp/Wo5FcZSp5vyj/W57AqxvgXSwPK0o2AT5b/YmLzAzwfgyre5OYzr++u2X6SyiCgBo5wJfjGGvbZ7BerCDKp7H9dRHL399BRSEXLxZiJPAfVtBzMLDed1QAAAAASUVORK5CYII=\'); background-size: cover; display: block;"\n ></span>\n <picture>\n <source\n srcset="/static/0ef82414bb6bae0344ed4aebc8eecce9/2ff5b/ipvlan_perf.webp 252w,\n/static/0ef82414bb6bae0344ed4aebc8eecce9/4d583/ipvlan_perf.webp 504w,\n/static/0ef82414bb6bae0344ed4aebc8eecce9/905a7/ipvlan_perf.webp 1008w,\n/static/0ef82414bb6bae0344ed4aebc8eecce9/7342b/ipvlan_perf.webp 1172w"\n sizes="(max-width: 1008px) 100vw, 1008px"\n type="image/webp"\n />\n <source\n srcset="/static/0ef82414bb6bae0344ed4aebc8eecce9/019e0/ipvlan_perf.png 252w,\n/static/0ef82414bb6bae0344ed4aebc8eecce9/0dcb2/ipvlan_perf.png 504w,\n/static/0ef82414bb6bae0344ed4aebc8eecce9/832a9/ipvlan_perf.png 1008w,\n/static/0ef82414bb6bae0344ed4aebc8eecce9/f9f46/ipvlan_perf.png 1172w"\n sizes="(max-width: 1008px) 100vw, 1008px"\n type="image/png"\n />\n <img\n class="gatsby-resp-image-image"\n src="/static/0ef82414bb6bae0344ed4aebc8eecce9/832a9/ipvlan_perf.png"\n alt="IPVLAN performance"\n title=""\n loading="lazy"\n decoding="async"\n style="width:100%;height:100%;margin:0;vertical-align:middle;position:absolute;top:0;left:0;"\n />\n </picture>\n </a>\n </span>'}}),"\n",s.createElement(n.p,null,"IPVLAN is a beta level feature in 1.4, see the ",s.createElement(n.a,{href:"https://docs.cilium.io/en/v1.4/gettingstarted/ipvlan/"},"IPVLAN getting started guide")," for instructions\non how to enable and configure the feature."),"\n",s.createElement(n.h2,null,"DNS Request/Response Aware Security & Visibility"),"\n",s.createElement(n.p,null,"Cilium 1.4 extends the existing DNS security policy model to be aware of the\nDNS requests that individual pods issue and the DNS responses they receive.\nThis significantly improves the security of pods accessing services outside of\nthe cluster:"),"\n",s.createElement(n.ul,null,"\n",s.createElement(n.li,null,"\n",s.createElement(n.p,null,"Pods can be restricted to have minimal privileges when performing DNS\nlookups, i.e. pod can be limited to only succeed in looking up DNS names\nmatching a pattern such as ",s.createElement(n.span,{dangerouslySetInnerHTML:{__html:'<code class="language-text">*.domain.com</code>'}}),". Any request outside of the allowed\npattern will receive a ",s.createElement(n.span,{dangerouslySetInnerHTML:{__html:'<code class="language-text">request refused</code>'}})," DNS response in return."),"\n"),"\n",s.createElement(n.li,null,"\n",s.createElement(n.p,null,"The communication following the DNS lookup can be limited to the IP addresses\nas returned in the DNS response that the specific pod received. This reduces\nthe privileges of a compromised application significantly and improves the\nreliability of DNS based policy rules as the enforcement logic no longer\nrequires to know about all possible IP addresses that a DNS name can map to."),"\n",s.createElement(n.p,null,"In particular for popular storage, messaging, and database services offered\nby cloud providers, a single DNS name can map to hundreds or thousands of IP\naddresses."),"\n"),"\n",s.createElement(n.li,null,"\n",s.createElement(n.p,null,"DNS lookups and responses are now logged via the Cilium authorization\nlogging layer that is accessible via an API. This provides an exact log of\nevery DNS request and response that a pod has performed."),"\n"),"\n"),"\n",s.createElement(n.span,{dangerouslySetInnerHTML:{__html:'<span\n class="gatsby-resp-image-wrapper"\n style="position: relative; display: block; margin-left: auto; margin-right: auto; max-width: 1008px; "\n >\n <a\n class="gatsby-resp-image-link"\n href="/static/39d5d2970fe217ab2a5bd4e5237f3b2c/bf054/dns.png"\n style="display: block"\n target="_blank"\n rel="noopener"\n >\n <span\n class="gatsby-resp-image-background-image"\n style="padding-bottom: 21.428571428571427%; position: relative; bottom: 0; left: 0; background-image: url(\'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAECAYAAACOXx+WAAAACXBIWXMAABYlAAAWJQFJUiTwAAABGElEQVR42h2PWUsCYQBF/b/1F6qHXnsxECooUKzsQc2lBK1MpUUJNFvIpcjS0Wq
1c+caRWdXTh+/33HtPoJzvkIk1UX8Fo9GQ/qCPNbUptBJsJFcJVTYx3DFzD1LHDa5zbYQQDPvf/AwUdDEmXAuyHl8hVt8hUDzvchp9YiIcbNuSAQELqA9uOWnskX09wvJNPHtBMtrkKtvB9zwcw8DRNFzJVD5ypJ4j3HzmZeFZh/ThCyNFQ9NUdF3Hd30evspE7rZJPoaxZqYE58vhy4x8KMtUVcU0p9iuTf4tQbQaotjNEKiVelyk25iGLVV0FEVh7i8ovWcJltc4qG5hOBozqVxItbgv9vDkw4n6x1TTcXxHmuwus/HmPv+VMhfFFgcefgAAAABJRU5ErkJggg==\'); background-size: cover; display: block;"\n ></span>\n <picture>\n <source\n srcset="/static/39d5d2970fe217ab2a5bd4e5237f3b2c/2ff5b/dns.webp 252w,\n/static/39d5d2970fe217ab2a5bd4e5237f3b2c/4d583/dns.webp 504w,\n/static/39d5d2970fe217ab2a5bd4e5237f3b2c/905a7/dns.webp 1008w,\n/static/39d5d2970fe217ab2a5bd4e5237f3b2c/bb9f8/dns.webp 1512w,\n/static/39d5d2970fe217ab2a5bd4e5237f3b2c/44499/dns.webp 1566w"\n sizes="(max-width: 1008px) 100vw, 1008px"\n type="image/webp"\n />\n <source\n srcset="/static/39d5d2970fe217ab2a5bd4e5237f3b2c/019e0/dns.png 252w,\n/static/39d5d2970fe217ab2a5bd4e5237f3b2c/0dcb2/dns.png 504w,\n/static/39d5d2970fe217ab2a5bd4e5237f3b2c/832a9/dns.png 1008w,\n/static/39d5d2970fe217ab2a5bd4e5237f3b2c/19357/dns.png 1512w,\n/static/39d5d2970fe217ab2a5bd4e5237f3b2c/bf054/dns.png 1566w"\n sizes="(max-width: 1008px) 100vw, 1008px"\n type="image/png"\n />\n <img\n class="gatsby-resp-image-image"\n src="/static/39d5d2970fe217ab2a5bd4e5237f3b2c/832a9/dns.png"\n alt="DNS"\n title=""\n loading="lazy"\n decoding="async"\n style="width:100%;height:100%;margin:0;vertical-align:middle;position:absolute;top:0;left:0;"\n />\n </picture>\n </a>\n </span>'}}),"\n",s.createElement(n.p,null,"The above example shows a successful DNS sequence followed by an HTTP request\nto the IP as responded by the DNS server. This is how an application is\nexpected to behave and what is permitted. Subsequent HTTP requests can use the\ncached DNS information, allowing such requests. The DNS information will time\nout according to TTL information in the record."),"\n",s.createElement(n.p,null,"On the right is a sequence where the application is performing a DNS lookup\noutside of the allowed DNS policy. It also shows that if the application fails\nto perform a DNS lookup, any attempt to contact the IP address, even if the IP\naddress actually maps to a DNS name which is permitted, will be blocked if the\napplication failed to lookup the DNS name at some point."),"\n",s.createElement(n.h3,null,"Policy Example"),"\n",s.createElement(n.span,{dangerouslySetInnerHTML:{__html:'<div class="gatsby-highlight" data-language="yaml"><pre class="language-yaml"><code class="language-yaml"><span class="token key atrule">apiVersion</span><span class="token punctuation">:</span> <span class="token string">\'cilium.io/v2\'</span>\n<span class="token key atrule">kind</span><span class="token punctuation">:</span> CiliumNetworkPolicy\n<span class="token key atrule">metadata</span><span class="token punctuation">:</span>\n <span class="token key atrule">name</span><span class="token punctuation">:</span> <span class="token string">\'egress-domain-wildcard\'</span>\n<span class="token key atrule">spec</span><span class="token punctuation">:</span>\n <span class="token key atrule">endpointSelector</span><span class="token punctuation">:</span>\n <span class="token key atrule">matchLabels</span><span class="token punctuation">:</span>\n <span class="token key atrule">app</span><span class="token punctuation">:</span> myService\n <span class="token key atrule">egress</span><span class="token punctuation">:</span>\n <span class="token punctuation">-</span> <span class="token key atrule">toEndpoints</span><span class="token punctuation">:</span>\n <span class="token punctuation">-</span> <span class="token key atrule">matchLabels</span><span class="token punctuation">:</span>\n <span class="token key atrule">\'k8s:io.kubernetes.pod.namespace\'</span><span class="token punctuation">:</span> kube<span class="token punctuation">-</span>
1system\n <span class="token key atrule">k8s-app</span><span class="token punctuation">:</span> kube<span class="token punctuation">-</span>dns\n <span class="token key atrule">toPorts</span><span class="token punctuation">:</span>\n <span class="token punctuation">-</span> <span class="token key atrule">ports</span><span class="token punctuation">:</span>\n <span class="token punctuation">-</span> <span class="token key atrule">port</span><span class="token punctuation">:</span> <span class="token string">\'53\'</span>\n <span class="token key atrule">protocol</span><span class="token punctuation">:</span> UDP\n <span class="token key atrule">rules</span><span class="token punctuation">:</span>\n <span class="token key atrule">dns</span><span class="token punctuation">:</span>\n <span class="token punctuation">-</span> <span class="token key atrule">matchPattern</span><span class="token punctuation">:</span> <span class="token string">\'*.domain.com\'</span>\n <span class="token punctuation">-</span> <span class="token key atrule">toFQDNs</span><span class="token punctuation">:</span>\n <span class="token punctuation">-</span> <span class="token key atrule">matchPattern</span><span class="token punctuation">:</span> <span class="token string">\'*.domain.com\'</span>\n <span class="token key atrule">toPorts</span><span class="token punctuation">:</span>\n <span class="token punctuation">-</span> <span class="token key atrule">ports</span><span class="token punctuation">:</span>\n <span class="token punctuation">-</span> <span class="token key atrule">port</span><span class="token punctuation">:</span> <span class="token string">\'443\'</span>\n <span class="token key atrule">protocol</span><span class="token punctuation">:</span> TCP</code></pre></div>'}}),"\n",s.createElement(n.p,null,"The above policy example grants a pod or container the privilege to perform DNS\nrequests via kube-dns but limits the allowed DNS lookups to ",s.createElement(n.span,{dangerouslySetInnerHTML:{__html:'<code class="language-text">*.domain.com</code>'}}),". A\nrequest not matching the pattern will receive a ",s.createElement(n.span,{dangerouslySetInnerHTML:{__html:'<code class="language-text">request refused</code>'}})," DNS response.\nIt further grants the pod egress access on port 443/TCP to the IPs returned in\nthe DNS response. Any attempt to access any IP address not previously returned\nin a DNS response is rejected."),"\n",s.createElement(n.p,null,"To get started using DNS-based policies, follow the ",s.createElement(n.a,{href:"https://docs.cilium.io/en/v1.4/gettingstarted/dns/"},"DNS-based getting started\nguide"),"."),"\n",s.createElement(n.h2,null,"Transparent Encryption & Authentication (beta)"),"\n",s.createElement(n.p,null,"Providing transparent encryption for all service-to-service communication\nwithin a cluster and across clusters has been a frequently requested feature.\nThe encryption allows to run Kubernetes in untrusted networks transparently\nencrypting all communication between services in the cluster. The\nauthentication ensures that only trusted worker nodes can participate in the\ncluster."),"\n",s.createElement(n.span,{dangerouslySetInnerHTML:{__html:'<span\n class="gatsby-resp-image-wrapper"\n style="position: relative; display: block; margin-left: auto; margin-right: auto; max-width: 1008px; "\n >\n <a\n class="gatsby-resp-image-link"\n href="/static/9e985cb6df4488cfb9f3a62818edb984/728cd/encryption.png"\n style="display: block"\n target="_blank"\n rel="noopener"\n >\n <span\n class="gatsby-resp-image-background-image"\n style="padding-bottom: 42.06349206349206%; position: relative; bottom: 0; left: 0; background-image: url(\'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAICAYAAAD5nd/tAAAACXBIWXMAABYlAAAWJQFJUiTwAAAB1klEQVR42mWS72tSURjH93cG9mKVI/YiIqztjfViLyLDYjWCJJm2ZWFbMCPH2IJwzqb4IzflXm/OX/cqW5u6e++uJm6fjrKhowPf85zne+DzHL6cCYbrgljhjEDklJ28SiRbIqEckatb7GsmOaH9MeWuvPplL6rR7Q9JE4Ot0+sTzpzi3WyzLf3hx57KrnJMumqSqugkK6aQIXpD9MaYZw69eElHbXVHwAF9cOEONZn1l3AGjwlnDbKqwfy3Fo98JWaW66wkdPINA89mC8c7hdn3VQIxnUxNAJtjQPNvn92SyT2PyrQrid0tsxxtk2uYzPgbTD9Pc9uVx/O9hXxo8kQMnFzQmHxdZz7c5JcYfB0oXhgvn/HYV8E5F+KhO0EwbpLVOsx90nA+DeN4FsUf0ZEOO7jWTnC8THH/RYa3W+3/gUb3XOTSJpD4ijf6mcWdFYKZNbaSHpY23vBq/QML60sEU6uE9r7wMbHK4nYQb2SZcC5Bqmpdz1DvXpAun2DID+jKt+hIU6JOUYneRNq4gfbThhqzYeTuYObtWJKdjnyXnmSjUfQRK/fQWtYI2D+H4pGFUv1NsSYLFTgQUioKcrlAoSyJ88gvXuqgJiGrmvg+1jC2AfAfN+op2hiipicAAAAASUVORK5CYII=\'); background-size: cover; display: block;"\n ></span>\n <picture>\n <source\n srcset="/static/9e985cb6df4488cfb9f3a62818edb984/2ff5b/encryption.webp 252w,\n/static/9e985cb6df4488cfb9f3a62818edb984/4d583/encryption.webp 504w,\n/static/9e985cb6df4488cfb9f3a62818edb984/905a7/encryption.webp 1008w,\n/static/9e985cb6df4488cfb9f3a62818edb984/13fbc/encryption.webp 1160w"\n sizes="(max-width: 1008px) 100vw, 1008px"\n type="image/webp"\n />\n <source\n srcset="/static/9e985cb6df4488cfb9f3a62818edb984/019e0/encryption.png 252w,\n/static/9e985cb6df4488cfb9f3a62818edb984/0dcb2/encryption.png 504w,\n/static/9e985cb6df4488cfb9f3a62818edb984/832a9/encryption.png 1008w,\n/static/9e985cb6df4488cfb9f3a62818edb984/728cd/encryption.png 1160w"\n sizes="(max-width: 1008px) 100vw, 1008px"\n type="image/png"\n />\n <img\n class="gatsby-resp-image-image"\n src="/static/9e985cb6df4488cfb9f3a62818edb984/832a9/encryption.png"\n alt="Encryption"\n title=""\n loading="lazy"\n decoding="async"\n style="width:100%;height:100%;margin:0;vertical-align:middle;position:absolute;top:0;left:0;"\n />\n </picture>\n </a>\n </span>'}}),"\n",s.createElement(n.p,null,"The encryption is based on X.509 certificates and ke
1ys. For now, a PSK is used\nthat is distributed to all nodes using a Kubernetes secret. However, the\ninfrastructure is compatible with SPIFFE and allows to provide service\nauthentication using SPIFFE certificates on a per service level in a future\nrelease. The datapath implementation uses the IPSec implementation of the Linux\nkernel which avoids the need to run sidecar proxies as part of all services and\nensures efficient and automatic use of hardware-assisted crypto acceleration\nvia specialized CPU instruction sets as found in modern processors."),"\n",s.createElement(n.p,null,"Transparent encryption is a beta level feature. To enable the feature, pass\n",s.createElement(n.span,{dangerouslySetInnerHTML:{__html:'<code class="language-text">--enable-ipsec</code>'}})," option to the agent and provide a pre shared key (PSK) via\nthe ",s.createElement(n.span,{dangerouslySetInnerHTML:{__html:'<code class="language-text">--ipsec-key-file</code>'}})," option or by using a Kubernetes secret."),"\n",s.createElement("a",{name:"sockmap-bpf-based-sidecar-acceleration-alpha"}),"\n",s.createElement(n.h2,null,"Sockmap BPF based sidecar acceleration (alpha)"),"\n",s.createElement(n.p,null,"As ",s.createElement(n.a,{href:"https://www.youtube.com/watch?v=ER9eIXL2_14"},"announced at KubeCon"),", we are\nmaking the local process communication acceleration available with Cilium 1.4."),"\n",s.createElement(n.p,null,"Sockmap accelerated local process communication is primarily useful for\ncommunication between sidecar proxies and local processes but applies to all\nlocal processes."),"\n",s.createElement(n.span,{dangerouslySetInnerHTML:{__html:'<span\n class="gatsby-resp-image-wrapper"\n style="position: relative; display: block; margin-left: auto; margin-right: auto; max-width: 1008px; "\n >\n <a\n class="gatsby-resp-image-link"\n href="/static/25c756e42167566cc6a2dd528d873faf/d284e/sockmap_latency.png"\n style="display: block"\n target="_blank"\n rel="noopener"\n >\n <span\n class="gatsby-resp-image-background-image"\n style="padding-bottom: 59.92063492063492%; position: relative; bottom: 0; left: 0; background-image: url(\'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAMCAYAAABiDJ37AAAACXBIWXMAABYlAAAWJQFJUiTwAAACPElEQVR42oWT30sUURTH989L6FnqJQj7Hwofeogi6yHqoZJAQcxWLSIRpR+WSkXkg4pWsqS7sLvuzM7v2R8zu3Nn59O9d7QSjQ7cuYcz937POd/zvQXXdWk0GjiOQ6vVotlsEoYhpmnqeL/fR1mWZSdWmoFQ/mDAQC4VU1ZQH3XpODjI5D6Q+yD9ffjkUhczmk7CodGi0wnxPI84jv8A/p3htGUn/8mEejNL+OVdLC/EtiyCINCFHVXY04d8v8bqzjvtV2rbfKvsaD/pd2VW6LQNPnyeIBTQEy6GU6UVtmV1EVEUIYTIAVOR83SweJ2JVzdlANamL7Gytazji8s3MF0Lf2OemenLBDLmdGx+1ssYhwa1Wk23rVtW7fR7UV7VwijTS2OyZPg4dYH1vTWwG0w+OEfV9wg35pgvjmArBtomfqNM086HahgGasCFdrst2xEk8szG01Fm34zRa8HCo4t8Kq2CZTD18Dx1Cbi9NMtc8QqBbN9LEiq2g2fbBFIVvu+TpqmsUBGcxgSSl+XH13j5/jZOEybuDPP1YJX93UOe3B+iHniszRc1oJPmw4rkZBV3Wh1Hgy3kI0s04Ovxqzx/ewvbhMm7w3wprfB9s8r4vSGqrs36i2cUZ0awkqPpn6GJXDapoC8y6uU9TKsiswrKpS2CjofvhpT3N4mlJIxalXr9B7FIldLPFFnh2FHSiXu5fKKoi5B8qDa63U7+KiRnUS/mX2o9BZgkug8NoHhRpvSVxzPta57+A/kLh7yBZ7oLc4kAAAAASUVORK5CYII=\'); background-size: cover; display: block;"\n ></span>\n <picture>\n <source\n srcset="/static/25c756e42167566cc6a2dd528d873faf/2ff5b/sockmap_latency.webp 252w,\n/static/25c756e42167566cc6a2dd528d873faf/4d583/sockmap_latency.webp 504w,\n/static/25c756e42167566cc6a2dd528d873faf/905a7/sockmap_latency.webp 1008w,\n/static/25c756e42167566cc6a2dd528d873faf/1c377/sockmap_latency.webp 1144w"\n sizes="(max-width: 1008px) 100vw, 1008px"\n type="image/webp"\n />\n <source\n srcset="/static/25c756e42167566cc6a2dd528d873faf/019e0/sockmap_latency.png 252w,\n/static/25c756e42167566cc6a2dd528d873faf/0dcb2/sockmap_latency.png 504w,\n/static/25c756e42167566cc6a2dd528d873faf/832a9/sockmap_latency.png 1008w,\n/static/25c756e42167566cc6a2dd528d873faf/d284e/sockmap_latency.png 1144w"\n sizes="(max-width: 1008px) 100vw, 1008px"\n type="image/png"\n />\n <img\n class="gatsby-resp-image-image"\n src="/static/25c756e42167566cc6a2dd528d873faf/832a9/sockmap_latency.png"\n alt="SockMap accelerated latency"\n title=""\n loading="lazy"\n decoding="async"\n style="width:100%;height:100%;margin:0;vertical-align:middle;position:absolute;top:0;left:0;"\n />\n </picture>\n </a>\n </span>'}}),"\n",s.createElement(n.p,null,"The number of requests/s and maximum throughput both double when sockmap is\nenabled:"),"\n",s.createElement(n.span,{dangerouslySetInnerHTML:{__html:'<span\n class="gatsby-resp-image-wrapper"\n style="position: relative; display: block; margin-left: auto; margin-right: auto; max-width: 1008px; "\n >\n <a\n class="gatsby-resp-image-link"\n href="/static/71f3dc0dee028a8437ea6d48260883dd/19986/sockmap_rr.png"\n style="display: block"\n target="_blank"\n rel="noopener"\n >\n <span\n class="gatsby-resp-image-background-image"\n style="padding-bottom: 59.12698412698413%; position: relative; bottom: 0; left: 0; background-image: url(\'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAMCAYAAABiDJ37AAAACXBIWXMAABYlAAAWJQFJUiTwAAACBElEQVR42o2STWvUQBjH9xvoRfCkdz+BePVjCAoWetCDiPiCh7oHC/bYU6F4EbS0Rd3VQwVL7UWsCJal7qFguwuyr9lks002mUlmJn/nmcnGbq3gwJN5ycxvnv/zn9JoNEK320Wv18N4PEZf977vo9XuwPM8UFNKIcuyqVC0DttoPmkl+hAoiiLzQ0ppD2gIjak/HlJalH8k9KUBwmBkEiBGAURxk+0bjsLOTzm1dnJTNmwjbNYxGPrwXBekNEkSC6QBhVS0OcNGLUX5DTMHpcxOyFW0BVz66HsNuO4QcRwbhZxzC2SMmYnI5WzupVh4F+txCiHEtGQlDdBjAQ66v9BptdHRHrg6SyP5eEFVXuXNHwLP3nMz5hqgBNcghVys7dkQUb+J/sAzhjqOY6Al0h4EgUmZ5FGGH+sC8yvaYX8fIvGMm4SxGSpTRz8VaAxcOPmrIBhJL6VpWthuM1TYagIPZ95CPD6LF19v4nu1jO3dbfTkH1/oBNNlCsOweFaFywSlsKZIbDWABzMVYO4crlcvY/XuBcy9XESNWdPkpDantMIUignwk87w0WwVKJ/H7Y2rqDy5hIXXS6hz/B9w2hRdQ53hnWvrWvcZ3Khewdr9iyivLGKP5/v+epynAOkdRlGMLI1Rawm8Wt5Bsn4Lz789xZfVe6h8/oDDUKvgzBQ/+wf0N3mzhlyY+UVlAAAAAElFTkSuQmCC\'); background-size: cover; display: block;"\n ></span>\n <picture>\n <source\n srcset="/static/71f3dc0dee028a8437ea6d48260883dd/2ff5b/sockmap_rr.webp 252w,\n/static/71f3dc0dee028a8437ea6d48260883dd/4d583/sockmap_rr.webp 504w,\n/static/71f3dc0dee028a8437ea6d48260883dd/905a7/sockmap_rr.webp 1008w,\n/static/71f3dc0dee028a8437ea6d48260883dd/6b799/sockmap_rr.webp 1154w"\n sizes="(max-width: 1008px) 100vw, 1008px"\n type="image/webp"\n />\n <source\n srcset="/static/71f3dc0dee028a8437ea6d48260883dd/019e0
1/sockmap_rr.png 252w,\n/static/71f3dc0dee028a8437ea6d48260883dd/0dcb2/sockmap_rr.png 504w,\n/static/71f3dc0dee028a8437ea6d48260883dd/832a9/sockmap_rr.png 1008w,\n/static/71f3dc0dee028a8437ea6d48260883dd/19986/sockmap_rr.png 1154w"\n sizes="(max-width: 1008px) 100vw, 1008px"\n type="image/png"\n />\n <img\n class="gatsby-resp-image-image"\n src="/static/71f3dc0dee028a8437ea6d48260883dd/832a9/sockmap_rr.png"\n alt="SockMap accelerated request handling"\n title=""\n loading="lazy"\n decoding="async"\n style="width:100%;height:100%;margin:0;vertical-align:middle;position:absolute;top:0;left:0;"\n />\n </picture>\n </a>\n </span>'}}),"\n",s.createElement(n.span,{dangerouslySetInnerHTML:{__html:'<span\n class="gatsby-resp-image-wrapper"\n style="position: relative; display: block; margin-left: auto; margin-right: auto; max-width: 1008px; "\n >\n <a\n class="gatsby-resp-image-link"\n href="/static/0f88fbd578d12df2c43edd957d28b8d7/19986/sockmap_stream.png"\n style="display: block"\n target="_blank"\n rel="noopener"\n >\n <span\n class="gatsby-resp-image-background-image"\n style="padding-bottom: 58.730158730158735%; position: relative; bottom: 0; left: 0; background-image: url(\'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAMCAYAAABiDJ37AAAACXBIWXMAABYlAAAWJQFJUiTwAAAB4ElEQVR42oWTPW/TQBzG8xkYYILP0BV2pI4gsSB1qpAKHSohXiYEA+rSz5AKqUsFAyOMfANGKC9x09h5cRynjuOXOL67H3dnRwlK1J709+nufI9/zz3nRhAE+L5Pt9vFdV3G4zFhOCJNYkxTSq2VfiD0mqzHUkoWrWEmkiQhTdNqQUnyQtIeCualtHOrJYTZrOgHBX1/QjKdWIjZbFYJstKkqvp2IHn2ISPOVU258lI9EN2fjC/OGF1OGGqHURRRlmVFaNRNSauoONd0e82MSVrRmPml5cpeNvfxRx0m0ZQ8z6xDo2EF8zy3VdmROH7J3nFGlNqTsvNLy8IKenGA0+touiG9Xs9WGIaV4CbLT7VgnFXEmywTeYzcv3i9AZ7nMRgMLFTDBJJlGdPpdJ0wq89QqrVwzIqhXdQi6YYZLM/Hbqd9CU+Ouvx+95z59wOUiBZ4XNdsykbUJFSFoq+M3r/73uHHw3u4n26y//UV/dN9iPvYmJS8WtAkZKwLiy0414S7h21+7dyn9fkWW81tWi9ug/+H0nxSlFcL/h+Kvjaa8PFbh7MHd3E+3mDreBvn9R0IWpaQ6wiLoiCOY2a6F/McN5xzdNKhdfiSi2+POPjyhk5zBxm0yfXfU9R/xSbBfxl3ilL0jsW6AAAAAElFTkSuQmCC\'); background-size: cover; display: block;"\n ></span>\n <picture>\n <source\n srcset="/static/0f88fbd578d12df2c43edd957d28b8d7/2ff5b/sockmap_stream.webp 252w,\n/static/0f88fbd578d12df2c43edd957d28b8d7/4d583/sockmap_stream.webp 504w,\n/static/0f88fbd578d12df2c43edd957d28b8d7/905a7/sockmap_stream.webp 1008w,\n/static/0f88fbd578d12df2c43edd957d28b8d7/6b799/sockmap_stream.webp 1154w"\n sizes="(max-width: 1008px) 100vw, 1008px"\n type="image/webp"\n />\n <source\n srcset="/static/0f88fbd578d12df2c43edd957d28b8d7/019e0/sockmap_stream.png 252w,\n/static/0f88fbd578d12df2c43edd957d28b8d7/0dcb2/sockmap_stream.png 504w,\n/static/0f88fbd578d12df2c43edd957d28b8d7/832a9/sockmap_stream.png 1008w,\n/static/0f88fbd578d12df2c43edd957d28b8d7/19986/sockmap_stream.png 1154w"\n sizes="(max-width: 1008px) 100vw, 1008px"\n type="image/png"\n />\n <img\n class="gatsby-resp-image-image"\n src="/static/0f88fbd578d12df2c43edd957d28b8d7/832a9/sockmap_stream.png"\n alt="SockMap accelerated throughput"\n title=""\n loading="lazy"\n decoding="async"\n style="width:100%;height:100%;margin:0;vertical-align:middle;position:absolute;top:0;left:0;"\n />\n </picture>\n </a>\n </span>'}}),"\n",s.createElement(n.p,null,"Note that all of these performance numbers are per CPU core."),"\n",s.createElement(n.p,null,"Sockmap acceleration is an alpha level feature in 1.4. It can be enabled using\nthe ",s.createElement(n.span,{dangerouslySetInnerHTML:{__html:'<code class="language-text">--sockops-enable</code>'}})," option."),"\n",s.createElement(n.h2,null,"New Grafana Dashboard"),"\n",s.createElement(n.span,{dangerouslySetInnerHTML:{__html:'<span\n class="gatsby-resp-image-wrapper"\n style="position: relative; display: block; margin-left: auto; margin-right: auto; max-width: 1008px; "\n >\n <a\n class="gatsby-resp-image-link"\n href="/static/80055a7c9f6aab39d646083c0ccef442/bc928/grafana.png"\n style="display: block"\n target="_blank"\n rel="noopener"\n >\n <span\n class="gatsby-resp-image-background-image"\n style="padding-bottom: 22.619047619047617%; position: relative; bottom: 0; left: 0; background-image: url(\'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAFCAYAAABFA8wzAAAACXBIWXMAABYlAAAWJQFJUiTwAAABJElEQVR42jVQ207CQBTsh0C3eynFdrukUFtaSmOQS+DBBKkivqiJFzAxPvn949kSHiZnd87M7DnrcC7heQK+H0BrgyiK22rvlr/0bRVSgdNZqV6r0
1Ret9OGxs8ZRvR6k8CGJ5EK1YGQSQracNQviLEyloQIFt8PBXA8uocs8sH4ARWgDuaSmdxZ4XQbpcgQUZAPcLhk6LhhVO125TZGtMwzyBDo2GA4SlEWJ998T6tmsHcC5bTZYbJeoFgvM93usDs/YHY8YXWco6hqr+y2ScdGufbPe4O70geb4hsfXAx6+v9B8vuPl7wfLpz3muwZOWVXIshwZmfJpjZReTIsJhqMUeZ5jMp0i6F/R32qMqWdMgjAyiM0AURgj1hoRrRuFIfqhxj947Z0HaNyfewAAAABJRU5ErkJggg==\'); background-size: cover; display: block;"\n ></span>\n <picture>\n <source\n srcset="/static/80055a7c9f6aab39d646083c0ccef442/2ff5b/grafana.webp 252w,\n/static/80055a7c9f6aab39d646083c0ccef442/4d583/grafana.webp 504w,\n/static/80055a7c9f6aab39d646083c0ccef442/905a7/grafana.webp 1008w,\n/static/80055a7c9f6aab39d646083c0ccef442/bb9f8/grafana.webp 1512w,\n/static/80055a7c9f6aab39d646083c0ccef442/83a93/grafana.webp 2016w,\n/static/80055a7c9f6aab39d646083c0ccef442/8345c/grafana.webp 3162w"\n sizes="(max-width: 1008px) 100vw, 1008px"\n type="image/webp"\n />\n <source\n srcset="/static/80055a7c9f6aab39d646083c0ccef442/019e0/grafana.png 252w,\n/static/80055a7c9f6aab39d646083c0ccef442/0dcb2/grafana.png 504w,\n/static/80055a7c9f6aab39d646083c0ccef442/832a9/grafana.png 1008w,\n/static/80055a7c9f6aab39d646083c0ccef442/19357/grafana.png 1512w,\n/static/80055a7c9f6aab39d646083c0ccef442/29ed2/grafana.png 2016w,\n/static/80055a7c9f6aab39d646083c0ccef442/bc928/grafana.png 3162w"\n sizes="(max-width: 1008px) 100vw, 1008px"\n type="image/png"\n />\n <img\n class="gatsby-resp-image-image"\n src="/static/80055a7c9f6aab39d646083c0ccef442/832a9/grafana.png"\n alt="Grafana"\n title=""\n loading="lazy"\n decoding="async"\n style="width:100%;height:100%;margin:0;vertical-align:middle;position:absolute;top:0;left:0;"\n />\n </picture>\n </a>\n </span>'}}),"\n",s.createElement(n.p,null,"Several new Prometheus metrics have been added and a new Grafana dashboard is\navailable that can be deployed into any Kubernetes cluster with a single\ncommand:"),"\n",s.createElement(n.span,{dangerouslySetInnerHTML:{__html:'<div class="gatsby-highlight" data-language="text"><pre class="language-text"><code class="language-text">kubectl apply -f https://raw.githubusercontent.com/cilium/cilium/v1.4/examples/kubernetes/addons/prometheus/monitoring-example.yaml</code></pre></div>'}}),"\n",s.createElement(n.span,{dangerouslySetInnerHTML:{__html:'<span\n class="gatsby-resp-image-wrapper"\n style="position: relative; display: block; margin-left: auto; margin-right: auto; max-width: 1008px; "\n >\n <a\n class="gatsby-resp-image-link"\n href="/static/eb4b157be560d2d2564d6eb2341a9630/458c9/grafana2.png"\n style="display: block"\n target="_blank"\n rel="noopener"\n >\n <span\n class="gatsby-resp-image-background-image"\n style="padding-bottom: 40.476190476190474%; position: relative; bottom: 0; left: 0; background-image: url(\'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAICAYAAAD5nd/tAAAACXBIWXMAABYlAAAWJQFJUiTwAAABSUlEQVR42lVSWZbDIAzLSdqEsIclS5fX3v9eGtmdzLx+6IGNsIXMMI4G1+v0hxgzfEi4XP5z0zTDGPvFC+QIdxznr/wgSSHPs4MlnIsoMaLGAGuZs17PpIDslfubz3VFfbzhU1GOYFhKxbHfsCwVORdUxo0oedFYi0wWzgcIV3JJuETMGYE86yOMNCZUoVTWZ/FikkIpaywQSwReLlHdiZQWRCo7z08M0lF94wXBPHtEqknqZaayqJ1r68pzLpCXVESuFf3+RGBhyVvaNUSqabXDS8IGFD6llKaxNDg7z1ZU8YkhsnDSBr2vujeGrzGfwQ377WCXivXRsD07jveGvlcsLWN/dYLG18aBWVhjuM66emngPRzjHDgkFvSOHvZ1xf11Q2ORdjTUgwp7wVIX1K1gu60Qjk6VvokV4nGiMvkV8hMcz1L8DPEHhpPpR12fiZEAAAAASUVORK5CYII=\'); background-size: cover; display: block;"\n ></span>\n <picture>\n <source\n srcset="/static/eb4b157be560d2d2564d6eb2341a9630/2ff5b/grafana2.webp 252w,\n/static/eb4b157be560d2d2564d6eb2341a9630/4d583/grafana2.webp 504w,\n/static/eb4b157be560d2d2564d6eb2341a9630/905a7/grafana2.webp 1008w,\n/static/eb4b157be560d2d2564d6eb2341a9630/bb9f8/grafana2.webp 1512w,\n/static/eb4b157be560d2d2564d6eb2341a9630/83a93/grafana2.webp 2016w,\n/static/eb4b157be560d2d2564d6eb2341a9630/d5546/grafana2.webp 3136w"\n sizes="(max-width: 1008px) 100vw, 1008px"\n type="image/webp"\n />\n <source\n srcset="/static/eb4b157be560d2d2564d6eb2341a9630/019e0
1/grafana2.png 252w,\n/static/eb4b157be560d2d2564d6eb2341a9630/0dcb2/grafana2.png 504w,\n/static/eb4b157be560d2d2564d6eb2341a9630/832a9/grafana2.png 1008w,\n/static/eb4b157be560d2d2564d6eb2341a9630/19357/grafana2.png 1512w,\n/static/eb4b157be560d2d2564d6eb2341a9630/29ed2/grafana2.png 2016w,\n/static/eb4b157be560d2d2564d6eb2341a9630/458c9/grafana2.png 3136w"\n sizes="(max-width: 1008px) 100vw, 1008px"\n type="image/png"\n />\n <img\n class="gatsby-resp-image-image"\n src="/static/eb4b157be560d2d2564d6eb2341a9630/832a9/grafana2.png"\n alt="Grafana"\n title=""\n loading="lazy"\n decoding="async"\n style="width:100%;height:100%;margin:0;vertical-align:middle;position:absolute;top:0;left:0;"\n />\n </picture>\n </a>\n </span>'}}),"\n",s.createElement(n.h2,null,"Flannel Integration (beta)"),"\n",s.createElement(n.p,null,"Integration with Flannel has been a frequent ask by users looking for the\nsecurity policy enforcement and load-balancing capability of Cilium for\nexisting clusters configured using the Flannel CNI plugin."),"\n",s.createElement(n.p,null,"Cilium 1.4 introduces a new configuration option:"),"\n",s.createElement(n.span,{dangerouslySetInnerHTML:{__html:'<div class="gatsby-highlight" data-language="text"><pre class="language-text"><code class="language-text">flannel-master-device: "cni0"</code></pre></div>'}}),"\n",s.createElement(n.p,null,"which enables Cilium to run on top of Flannel using CNI chaining. It is also\npossible to automatically pick up existing containers/pods on worker nodes by\nenabling the following option:"),"\n",s.createElement(n.span,{dangerouslySetInnerHTML:{__html:'<div class="gatsby-highlight" data-language="text"><pre class="language-text"><code class="language-text">flannel-manage-existing-containers: "true"</code></pre></div>'}}),"\n",s.createElement(n.p,null,"The option also requires to edit the Cilium DaemonSet to enable the ",s.createElement(n.span,{dangerouslySetInnerHTML:{__html:'<code class="language-text">hostPID: true</code>'}})," option so Cilium can see all processes to attach to existing containers."),"\n",s.createElement(n.p,null,"The Flannel integration is primarily useful to try out Cilium functionality in\nexisting clusters or for migration purposes. Several features which will help at\nlarge scale will not function, this includes the ability to embed the security\nidentity of the source into network packets which requires to fall back to IP\nbased identification."),"\n",s.createElement(n.p,null,"For more details, see the ",s.createElement(n.a,{href:"https://docs.cilium.io/en/v1.4/gettingstarted/flannel-integration/"},"flannel getting started guide")),"\n",s.createElement(n.h2,null,"Benchmarking Other CNIs"),"\n",s.createElement(n.p,null,"We have been approached a lot in the last two months how Cilium compares to\nother CNI plugins. As a result, we have run a couple of benchmarks against\nother popular CNI plugins."),"\n",s.createElement(n.p,null,"A couple of words before we get into the actual numbers:"),"\n",s.createElement(n.ul,null,"\n",s.createElement(n.li,null,"\n",s.createElement(n.p,null,"Benchmarking is hard. We do not claim that we can configure other CNI\nplugins in the ideal configuration. Approach us if you have input and we are\nhappy to adjust. The goal of these benchmarks is to show that the most\nimpact can be made by changing architecture and using different technologies\nin the stack rather than just comparing one CNI against another. Even Cilium\nwill behave very differently depending on the configuration."),"\n"),"\n",s.createElement(n.li,null,"\n",s.createElement(n.p,null,"We have focused on measuring the networking overhead so we are running the\nbenchmarks between two local containers to remove as many hardware\nlimitations as possible."),"\n"),"\n",s.createElement(n.li,null,"\n",s.createElement(n.p,null,"The goal is not to get to the largest or lowest number possible. We are\nmeasuring using a single CPU core which arbitrarily limits the number.\nLarger systems will be able to achieve much better absolute numbers. Focus\non the difference between the numbers, not the absolute numbers."),"\n"),"\n",s.createElement(n.li,null,"\n",s.createElement(n.p,null,"As usual, take any benchmark with several kilos of salt. Benchmarking is\nalways done in a particular context. Understanding that context is\nimportant. If something is unclear about the numbers we publish here,\napproach us and we will clarify it."),"\n"),"\n"),"\n",s.createElement(n.p,null,"That said, let's dig into the numbers:"),"\n",s.createElement(n.span,{dangerouslySetInnerHTML:{__html:'<span\n class="gatsby-resp-image-wrapper"\n style="position: relative; display: block; margin-left: auto; margin-right: auto; max-width: 575px; "\n >\n <a\n class="gatsby-resp-image-link"\n href="/static/d990e5366d1f2fb7e7a3b13aae93061e/facd4/cni_latency.png"\n style="display: block"\n target="_blank"\n rel="noopener"\n >\n <span\n class="gatsby-resp-image-background-image"\n style="padding-bottom: 61.50793650793651%; position: relative; bottom: 0; left: 0; background-image: url(\'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAMCAYAAABiDJ37AAAACXBIWXMAAAsTAAALEwEAmpwYAAACPUlEQVR42oVSW2sTQRTOny3ik9RX6ZvYik99sF5oqdWAWtK0QalKbKkaCV6QPlTQXpImm8tes9ls9jazs59nZpsEJeDA2T2zO/Od73znK/i+D8uyYNs2oiiCYRgYj8dqr+s64jjGvJVdxb+rIB+MMXDOIURK7xQiFUhpr3Ih1PdJpGmqoEwrRqc7hOe5qngQBDPALMtU5Hk6rT3LZ1xEGuU7+xJB9wzuaAx3MMBoNFLEpgyJCHyvj1r9Fd1iOO3+xsXJkQJh8RgZj2H5Bj4ebIB7HgI+QEc/h2XakLJJmZIkyQFFytXF/pdNFDeWgTRD9fVtfNt/Tl85Diqr0DpN9M6rKD1ahPBiuMxHx+zBNi3ohk6te3nLslWW5ML3Pz3Ai627QMJxuLuEH+/LwLCN0uoCGi0N+tk77K7fREyACEz4/QZMe6CGJ8NxHBQkVc5ywF/V
1h9h+ugIWClReLuH4cAfweijfv45LrYPj72+xR4BiGMKh802LnNDrwXXzwUhHKIaCJ2B0oL63hlJxhURmeLZ5Cz8/7MDV2nhy7xoBaqjV9glwEckoQOIyDDQHLk1ZTljqN50yIULO82tlDdtbd+C5HEUCPDkqwWlrWF9eQIuA65/foPz4BpiXII4MOGYTQRgry+V2ugKUXktYCrNHOvU1op6g3bqANyB/0QTbzVOEYUgTNdDvNJBE8dRmc40tF+eMqIcqj6JQ6SEv+f6YqgvFQOo982v2l3/nAHL1U3py4nqZT7SRBWQn/1t/AASgg7P0ZtidAAAAAElFTkSuQmCC\'); background-size: cover; display: block;"\n ></span>\n <picture>\n <source\n srcset="/static/d990e5366d1f2fb7e7a3b13aae93061e/2ff5b/cni_latency.webp 252w,\n/static/d990e5366d1f2fb7e7a3b13aae93061e/4d583/cni_latency.webp 504w,\n/static/d990e5366d1f2fb7e7a3b13aae93061e/4410d/cni_latency.webp 575w"\n sizes="(max-width: 575px) 100vw, 575px"\n type="image/webp"\n />\n <source\n srcset="/static/d990e5366d1f2fb7e7a3b13aae93061e/019e0/cni_latency.png 252w,\n/static/d990e5366d1f2fb7e7a3b13aae93061e/0dcb2/cni_latency.png 504w,\n/static/d990e5366d1f2fb7e7a3b13aae93061e/facd4/cni_latency.png 575w"\n sizes="(max-width: 575px) 100vw, 575px"\n type="image/png"\n />\n <img\n class="gatsby-resp-image-image"\n src="/static/d990e5366d1f2fb7e7a3b13aae93061e/facd4/cni_latency.png"\n alt="CNI latency"\n title=""\n loading="lazy"\n decoding="async"\n style="width:100%;height:100%;margin:0;vertical-align:middle;position:absolute;top:0;left:0;"\n />\n </picture>\n </a>\n </span>'}}),"\n",s.createElement(n.p,null,"The above numbers show the various latency measurement when two containers\nexchange as many 1 byte request and response messages over a single connection\nas possible. This test primarily shows whether a particular forwarding path is\nheavily favoring throughput over latency."),"\n",s.createElement(n.ul,null,"\n",s.createElement(n.li,null,"\n",s.createElement(n.p,null,"Cilium Sockmap is heavily exploiting its advantage of being able to operate\non socket level. This only works on connections within the node."),"\n"),"\n",s.createElement(n.li,null,"\n",s.createElement(n.p,null,"The next best category is Cilium operating in IPVLAN mode with\nnetfilter/iptables completely removed. There is a difference whether\nCilium is operating with security policy rules loaded or not, but that\ndifference is minor. This is due to the efficient per-CPU hash tables used\nfor policy enforcement which minimize the overhead. Note that this number\nalready includes a load balancing BPF map lookup so this mode allows to\nreplace kube-proxy which other tests are not accounting for."),"\n"),"\n",s.createElement(n.li,null,"\n",s.createElement(n.p,null,"Next is Flannel and Cilium operating in veth mode. Flannel is a minimal\nnetworking plugin using the Linux routing tables. The minimalism pays off but\nit also means that Flannel can not perform any policy enforcement and has to\nrely on kube-proxy in either iptables or IPVS mode. Cilium is doing slightly\nworse due to performing some work to enable policy enforcement in the middle\nof a connection even if no policy rule was previously loaded."),"\n"),"\n",s.createElement(n.li,null,"\n",s.createElement(n.p,null,"Calico showed slightly more overhead in our tests. Likely due to more iptables\nrules being added and more netfilter chains being utilized. We have not\nloaded any policy rules into Calico for this particular test but assume that\nthe use of ipset will allow to scale OK. Not quite as good as the per CPU\nhash tables."),"\n"),"\n"),"\n",s.createElement(n.p,null,"Typical enemies of these benchmarks are:"),"\n",s.createElement(n.ul,null,"\n",s.createElement(n.li,null,"Context switches between kernel and user space. These numbers will get\n",s.createElement(n.strong,null,"much")," worse when an L4/L7 proxy gets involved."),"\n",s.createElement(n.li,null,"Any per-packet overhead has dramatic effects. Cold caches and data\nstructures can negative impact as well. The less code that has to be\ntraversed, the better."),"\n"),"\n",s.createElement(n.span,{dangerouslySetInnerHTML:{__html:'<span\n class="gatsby-resp-image-wrapper"\n style="position: relative; display: block; margin-left: auto; margin-right: auto; max-width: 581px; "\n >\n <a\n class="gatsby-resp-image-link"\n href="/static/03ff4f4b4af7d4fdf4c74b0b080adbae/13a45/cni_rr2.png"\n style="display: block"\n target="_blank"\n rel="noopener"\n >\n <span\n class="gatsby-resp-image-background-image"\n style="padding-bottom: 61.11111111111111%; position: relative; bottom: 0; left: 0; background-image: url(\'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAMCAYAAABiDJ37AAAACXBIWXMAAAsTAAALEwEAmpwYAAACAklEQVR42pVS3WrUQBTeB+mNlz5AEW/7Ft55US1KH0AoCr
10o0oogetEbKRSKrS2oLFWpZeliVSz9RXDbbqG12t1kk002m91M/mbyOWeS7LqCogdOEiYz33w/p9DpdGCaJprNJhhjMAwDrZYDTdPku4X/rQI9CNR1XSRJgiiKIQRHHEey6VsMNOdCnkigGTH0houO24Zt2wjDsA+Yl8RTVdUEarYYWPt9E69X4dTOYDsuLMtShDjnKSChU3ORqNuffQxRrsTpQZ4o5v1OL2J+DZp+Ktm10O124XmeVBf1AYMg6AGubIXYPCQJQq39CigywAZr48LUYUnvKQMCVJLJlySXke7F8ucIm0c5Q5GpTL3reWCfw6l/Q8NsqgB1XVeyC3kgRJvk0cHnWxyl0jEQnIArmJS5CkU2gRoysHM5EY1sGshHUlogIwcZCiwfAG9vjGG7eBXvyjNYW9lF5UVZ/munRGV1dQarbqMtU2YeU/71Us49jBVijMU9oHTzNpYWLmH64RVMTb7G6r0x+OIryEK6njk/YJsXcnYDBUbEeoC00E+ZK4alW+N4uXgZT2ZH8OjBGtan7yBANbNR/H2w88olz+9IydeuY2luCPdnhjF5dxXFiVGEqGSj+A+AxJL5PpLYx8F3juqrIr7sP8aHT0/xvlzB4cYbeEFdWsOVPX8C/AmHfImBgd7SdQAAAABJRU5ErkJggg==\'); background-size: cover; display: block;"\n ></span>\n <picture>\n <source\n srcset="/static/03ff4f4b4af7d4fdf4c74b0b080adbae/2ff5b/cni_rr2.webp 252w,\n/static/03ff4f4b4af7d4fdf4c74b0b080adbae/4d583/cni_rr2.webp 504w,\n/static/03ff4f4b4af7d4fdf4c74b0b080adbae/1cac8/cni_rr2.webp 581w"\n sizes="(max-width: 581px) 100vw, 581px"\n type="image/webp"\n />\n <source\n srcset="/static/03ff4f4b4af7d4fdf4c74b0b080adbae/019e0/cni_rr2.png 252w,\n/static/03ff4f4b4af7d4fdf4c74b0b080adbae/0dcb2/cni_rr2.png 504w,\n/static/03ff4f4b4af7d4fdf4c74b0b080adbae/13a45/cni_rr2.png 581w"\n sizes="(max-width: 581px) 100vw, 581px"\n type="image/png"\n />\n <img\n class="gatsby-resp-image-image"\n src="/static/03ff4f4b4af7d4fdf4c74b0b080adbae/13a45/cni_rr2.png"\n alt="CNI RR"\n title=""\n loading="lazy"\n decoding="async"\n style="width:100%;height:100%;margin:0;vertical-align:middle;position:absolute;top:0;left:0;"\n />\n </picture>\n </a>\n </span>'}}),"\n",s.createElement(n.p,null,"The above graph shows the requests per second for the same benchmark being\nperformed. The requests per second overlap with the latency pretty well. As for\nthe previous tests, these numbers are measured per CPU core."),"\n",s.createElement(n.span,{dangerouslySetInnerHTML:{__html:'<span\n class="gatsby-resp-image-wrapper"\n style="position: relative; display: block; margin-left: auto; margin-right: auto; max-width: 604px; "\n >\n <a\n class="gatsby-resp-image-link"\n href="/static/b9688d675ecb704588427e750412470d/0a218/cni_stream.png"\n style="display: block"\n target="_blank"\n rel="noopener"\n >\n <span\n class="gatsby-resp-image-background-image"\n style="padding-bottom: 61.50793650793651%; position: relative; bottom: 0; left: 0; background-image: url(\'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAMCAYAAABiDJ37AAAACXBIWXMAAAsTAAALEwEAmpwYAAAB90lEQVR42nWTS08TURTH+1lYYoiEhMSEb8LCpcSFCbpwwQaCD1ygECutbtyy4BEgyhcgcSMxJg1hgUVrZR54Z6adTud9++ec217KEHqSM497Z37nf85/phSGIYQQcBwHlmXB8zzKFrxWGzLPIaUckTl6vV5hLUkSlHix0+nAdV34vo84jlWmSaxeuDsBsy3RoqJhtwsWlaYpchJQAoV+UIekSyfgNUmZKzW4sc/RuhCwLRvdAZBFZFnWB2q5XIHu4GfA8/d1/PtUhS6Yc1u6MLcq6hD/LxEEwTWUVSogg9QCVVBACTxdOUX9ySy6aRPB8Rb1eALW2CMwYXHp/4JhXFCaME2TzsZwhjr6lzRTAs6/bUI8Gsfa4Qw+L00j/L6PUG1LBTZcA4ZpqLZt2x62zEawOjaGK5BetEno/OpfuHPjeHEwhfLyfaxvlXHODQxmGlh1eK6DNr3PhvLYlCl80CoLClebcAi48mUaleVJfNzZQEP29/kk4gRhFKm5sSDmFFxWkrUp+RD4moAbpLCy/QF/8kHLtxzXUXA5ompZNgQ+e9eE+3gCb74+QPXlFKo7FTRuAO+CXgNvm8Iuz71qQDwcw+LeJNYW7mF9s4zfg5ZHCCwC+VtilQn9IUGU4NtP+nOOdvHj/AC14z3UzmpwoxRp3J/bKOAVQ619sfmSAaMAAAAASUVORK5CYII=\'); background-size: cover; display: block;"\n ></span>\n <picture>\n <source\n srcset="/static/b9688d675ecb704588427e750412470d/2ff5b/cni_stream.webp 252w,\n/static/b9688d675ecb704588427e750412470d/4d583/cni_stream.webp 504w,\n/static/b9688d675ecb704588427e750412470d/7c192/cni_stream.webp 604w"\n sizes="(max-width: 604px) 100vw, 604px"\n type="image/webp"\n />\n <source\n srcset="/static/b9688d675ecb704588427e750412470d/019e0/cni_stream.png 252w,\n/static/b9688d675ecb704588427e750412470d/0dcb2/cni_stream.png 504w,\n/static/b9688d675ecb704588427e750412470d/0a218/cni_stream.png 604w"\n sizes="(max-width: 604px) 100vw, 604px"\n type="image/png"\n />\n <img\n class="gatsby-resp-image-image"\n src="/static/b9688d675ecb704588427e750412470d/0a218/cni_stream.png"\n alt="CNI Stream"\n title=""\n loading="lazy"\n decoding="async"\n style="width:100%;height:100%;margin:0;vertical-align:middle;position:absolute;top:0;left:0;"\n />\n </picture>\n </a>\n </span>'}}),"\n",s.createElement(n.p,null,"The last graph illustrates the opposite of the spectrum. The TCP_STREAM test is\nattempting to pump as many bytes as possible over a single TCP connection. This\nis where memory bandwidth can come into play and where network hardware or\ncloud provider limits can often artificially limit the benchmark."),"\n",s.createElement(n.ul,null,"\n",s.createElement(n.li,null,"\n",s.createElement(n.p,null,"Leaving Sockmap aside for a second, we can see that the IPVLAN mode has\nclear advantage over all other modes."),"\n"),"\n",s.createElement(n.li,null,"\n",s.createElement(n.p,null,"We expected Calico to have similar numbers to Cilium so we have likely\nmisconfigured something. Any help is appreciated. Calico doing worse in the\nTCP_STREAM does not really make a lot of sense, as the iptables overhead in\nthis test is amortized across a larger amount of data."),"\n"),"\n"),"\n",s.createElement(n.span,{dangerouslySetInnerHTML:{__html:'<span\n class="gatsby-resp-image-wrapper"\n style="position: relative; display: block; margin-left: auto; margin-right: auto; max-width: 579px; "\n >\n <a\n class="gatsby-resp-image-link"\n href="/static/2716b58c40978d666396a9489b0fb068/bcc27/cni_stream_sockmap.png"\n style="display: block"\n target="_blank"\n rel="noopener"\n >\n <span\n class="gatsby-resp-image-background-image"\n style="padding-bottom: 59.12698412698413%; position: relative; bottom: 0; left: 0; background-image: url(\'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAMCAYAAABiDJ37AAAACXBIWXMAAAsTAAALEwEAmpwYAAACAUlEQVR42p2TzWoUQRSF+1lcuA++g659BF9AERIXCQSJoEYYdwruJJrBjYuMuHAhCurGjQtREALJOM50p6f/f6uqq+p4b/VMHAlmYUF1d1G3Tn3n3ttemqaIogi+72M6nSKOYyRJgiJP8T/D40dVVSiKAkopaK2hug5ZpWCMOTN5H7AIIwH/JEdZ5ASRoK7rP4I8rLUU1o9aWAxeSwi12Fsh4DgeMjxBeHyEOTnKcxIuS3QE4gT5g+mYgI+XrcG9A4FGWrc2fNnpNP0FykeZjpHlFZSUaNsWkt5OkBdsu3N2DMpGY3fUohG0JgF9xjIwqWMcBj8RhXOXd56cNm9pYdUaW37wSpDlntiu2l7E2yJAFowpjyFmsxmC
1IAAX2MuyzNFxHtj6kvD+iCxzDonQ6K4n1EyrnWbTZkQVYD6PEIahO89wXi+ySmjR0PPOo2NMH1+jk5/BEWIRt3TkBwKTX9ReRUZtljrB0yqzqBCiL4rV4Aa4vfsd4+sX8OTNVRy82MKzD4dAomFcChiRaJuO8t65vHJBHKFrAVpwH2ltnEUW3Bn8wGxrDevDS9gfXMb2rU+I3yaOgq2f29h/WzbO8ubdb5jcvIiN4RqeP7yCzfWPJNj/PdZYWHuOICNzYYSQkKJFITWGL4/gP72BvfcbeDfawXDvK+IvCRSo4VsB+w/F32JMjpbE2kcsAAAAAElFTkSuQmCC\'); background-size: cover; display: block;"\n ></span>\n <picture>\n <source\n srcset="/static/2716b58c40978d666396a9489b0fb068/2ff5b/cni_stream_sockmap.webp 252w,\n/static/2716b58c40978d666396a9489b0fb068/4d583/cni_stream_sockmap.webp 504w,\n/static/2716b58c40978d666396a9489b0fb068/82463/cni_stream_sockmap.webp 579w"\n sizes="(max-width: 579px) 100vw, 579px"\n type="image/webp"\n />\n <source\n srcset="/static/2716b58c40978d666396a9489b0fb068/019e0/cni_stream_sockmap.png 252w,\n/static/2716b58c40978d666396a9489b0fb068/0dcb2/cni_stream_sockmap.png 504w,\n/static/2716b58c40978d666396a9489b0fb068/bcc27/cni_stream_sockmap.png 579w"\n sizes="(max-width: 579px) 100vw, 579px"\n type="image/png"\n />\n <img\n class="gatsby-resp-image-image"\n src="/static/2716b58c40978d666396a9489b0fb068/bcc27/cni_stream_sockmap.png"\n alt="CNI Stream with SockMap"\n title=""\n loading="lazy"\n decoding="async"\n style="width:100%;height:100%;margin:0;vertical-align:middle;position:absolute;top:0;left:0;"\n />\n </picture>\n </a>\n </span>'}}),"\n",s.createElement(n.p,null,"Adding Sockmap back into the picture proves the performance benefit of doing\nnetworking at socket level. Again, this benefit is only gained between local\nprocesses as it occurs regularly when sidecar proxies are in effect or when\nservices are scheduled onto the same node for improved local communication."),"\n",s.createElement(n.h2,null,"GKE Support with COS"),"\n",s.createElement(n.p,null,"A completely new\n",s.createElement(n.a,{href:"https://docs.cilium.io/en/v1.4/gettingstarted/k8s-install-gke/"},"guide"),"\ndocuments how to run Cilium on GKE using COS. A brand new ",s.createElement(n.a,{href:"https://github.com/cilium/cilium/tree/master/examples/kubernetes/node-init"},"node-init\nDaemonSet"),"\nenables to prepare GKE nodes by mounting the BPF filesystem and reconfiguring\nkubelet to run in CNI mode. Use of the ",s.createElement(n.a,{href:"https://github.com/cilium/cilium-etcd-operator"},"cilium-etcd-operator")," provides the\nkvstore requirement while keeping the installation simple."),"\n",s.createElement(n.h2,null,"1.4 Release Highlights"),"\n",s.createElement(n.ul,null,"\n",s.createElement(n.li,null,s.createElement(n.strong,null,"Multi Cluster"),"\n",s.createElement(n.ul,null,"\n",s.createElement(n.li,null,"Addition of global services which enable spanning Kubernetes services\nacross multiple Kubernetes services via an annotation. (beta)"),"\n",s.createElement(n.li,null,"Much improved installation guide including tooling to automatically extract\nSSL certificates when the ",s.createElement(n.a,{href:"https://github.com/cilium/cilium-etcd-operator"},"cilium-etcd-operator")," is used."),"\n"),"\n"),"\n",s.createElement(n.li,null,s.createElement(n.strong,null,"Transparent encryption (beta)"),"\n",s.createElement(n.ul,null,"\n",s.createElement(n.li,null,"Encryption of all pod/host to pod/host communication using IPsec with a PSK."),"\n",s.createElement(n.li,null,"IPv4 and IPv6"),"\n",s.createElement(n.li,null,"PSK configured via Kubernetes secret"),"\n",s.createElement(n.li,null,"No app or pod modifications required."),"\n"),"\n"),"\n",s.createElement(n.li,null,s.createElement(n.strong,null,"IPVLAN support (beta)"),"\n",s.createElement(n.ul,null,"\n",s.createElement(n.li,null,"A new alternative datapath mode utilizing IPVLAN replaces the use of veth\npairs for improved latency and performance."),"\n"),"\n"),"\n",s.createElement(n.li,null,s.createElement(n.strong,null,"DNS Request/Response Authorization"),"\n",s.createElement(n.ul,null,"\n",s.createElement(n.li,null,"FQDN-based security policies are now enforced based on actual DNS requests\nand responses performed by each service."),"\n",s.createElement(n.li,null,"Ability to specify policy on what DNS requests can be performed by services."),"\n",s.createElement(n.li,null,"API and CLI to query FQDN host name lookups performed by individual\nendpoints"),"\n",s.createElement(n.li,null,"Ability to restore FQDN mapping on agent restore for persistent mapping"),"\n",s.createElement(n.li,null,"Configurable minimum TTL and maximum FQDN hosts per endpoint"),"\n"),"\n"),"\n",s.createElement(n.li,null,s.createElement(n.strong,null,"Flannel Integration (beta)"),"\n",s.createElement(n.ul,null,"\n",s.createElement(n.li,null,"Ability to run Cilium on top of Flannel. Flannel provides networking and\nCilium provides load-balancing and policy enforcement."),"\n",s.createElement(n.li,null,"Ability to hook onto an existing Flannel deployment without restarting any\npods."),"\n"),"\n"),"\n",s.createElement(n.li,null,s.createElement(n.strong,null,"AWS metadata-based policy enforcement (alpha)"),"\n",s.createElement(n.ul,null,"\n",s.createElement(n.li,null,"Ability to specify policy rules based on AWS metadata such as EC2 labels,\nsecurity group names, VPC names, Subnet names, etc."),"\n"),"\n"),"\n",s.createElement(n.li,null,s.createElement(n.strong,null,"Additional Metrics & Monitoring")),"\n",s.createElement(n.li,null,s.createElement(n.strong,null,"Networking"),"\n",s.createElement(n.ul,null,"\n",s.createElement(n.li,null,"New simple PodCIDR route propagation mode via the kvstore. Enable via\n``--auto-direct-node-routes```."),"\n",s.createElement(n.li,null,"IPv6 is now disabled by default for new installations. Existing ConfigMaps\nwill continue with current behavior. Enable via ",s.createElement(n.span,{dangerouslySetInnerHTML:{__html:'<code class="language-text">--enable-ipv6=true</code>'}}),"."),"\n",s.createElement(n.li,null,"Ability to run IPv6 only cluster without allocating any IPv4 addresses with\nthe ",s.createElement(n.span,{dangerouslySetInnerHTML:{__html:'<code class="language-text">--enable-ipv4=false</code>'}})," option."),"\n",s.createElement(n.li,null,"Improved persistent behavior of the load balancer"),"\n",s.createElement(n.li,null,"BPF sockmap support to accelerate local process communication. Available\nvia option ",s.createElement(n.span,{dangerouslySetInnerHTML:{__html:'<code class="language-text">--sockops-enable</code>'}})," (alpha)"),"\n",s.createElement(n.li,null,"Decoupled endpoint identified from IP addresses to
1support arbitrary IP\naddressing models."),"\n"),"\n"),"\n",s.createElement(n.li,null,s.createElement(n.strong,null,"Efficiency & Scale"),"\n",s.createElement(n.ul,null,"\n",s.createElement(n.li,null,"Heavily improved scalability of the CiliumEndpoint CRD. It is no longer\nrequired to disable CEP for large deployments."),"\n",s.createElement(n.li,null,"Introduction of per-node local identities for CIDR/DNS based rules\nwhich do not require cluster or global scope. A pod performing a DNS\nrequest on node-23 resulting in an IP being whitelisted for that pod no\nlonger has any impact on other nodes in clusters."),"\n",s.createElement(n.li,null,"IPv6 is now disabled by default to reduce the memory footprint in small\ndeployments."),"\n",s.createElement(n.li,null,"BPF map pre-allocation is now disabled by default to reduce the memory\nfootprint in small deployments."),"\n",s.createElement(n.li,null,"Single binary for agent and client command to reduce container image size."),"\n",s.createElement(n.li,null,"Compile bugtool as static binary"),"\n",s.createElement(n.li,null,"New cilium-operator to provide singleton tasks such as CEP garbage\ncollection."),"\n",s.createElement(n.li,null,"Synchronous pod label retrieval on CNI ADD. This can slow down the pod\nscheduling rate a bit but avoids policy drops on pod start without init\npolicies."),"\n",s.createElement(n.li,null,"The status probe now collects state concurrently for improved accuracy."),"\n",s.createElement(n.li,null,"Better signal handling on termination and new terminationGracePeriodSeconds\ndefault of 1 second to minimize downtime of agent"),"\n"),"\n"),"\n",s.createElement(n.li,null,s.createElement(n.strong,null,"Kubernetes"),"\n",s.createElement(n.ul,null,"\n",s.createElement(n.li,null,"Added support for Kubernetes 1.13"),"\n",s.createElement(n.li,null,"Support for new CRI-O versions which automatically mount the BPF fileystem"),"\n",s.createElement(n.li,null,"New NodeInit DaemonSet to automatically prepare GKE nodes for Cilium\ninstallation. This enables use of COS and auto-scaling."),"\n",s.createElement(n.li,null,"The cilium-operator now automatically restarts kube-dns when kube-dns is\nnot managed by Cilium. This simplifies the initial installation on managed\nKubernetes offerings."),"\n"),"\n"),"\n",s.createElement(n.li,null,s.createElement(n.strong,null,"Istio"),"\n",s.createElement(n.ul,null,"\n",s.createElement(n.li,null,"Improved Istio integration"),"\n"),"\n"),"\n",s.createElement(n.li,null,s.createElement(n.strong,null,"Observability"),"\n",s.createElement(n.ul,null,"\n",s.createElement(n.li,null,"New metrics: kvstore operations, proxy upstream/processing latency,\nforwarded and dropped bytes, node events, number of nodes,"),"\n"),"\n"),"\n",s.createElement(n.li,null,s.createElement(n.strong,null,"Documentation"),"\n",s.createElement(n.ul,null,"\n",s.createElement(n.li,null,"The standard installation is now using the ",s.createElement(n.a,{href:"https://github.com/cilium/cilium-etcd-operator"},"cilium-etcd-operator")," and no\nlonger depends on the user providing an external kvstore."),"\n",s.createElement(n.li,null,"New GKE guide including COS support"),"\n",s.createElement(n.li,null,"Simplified EKS guide using eksctl"),"\n",s.createElement(n.li,null,"Improved cluster mesh guide using automated tooling"),"\n"),"\n"),"\n"),"\n",s.createElement(n.h2,null,"Upgrade Instructions"),"\n",s.createElement(n.p,null,"As usual, follow the ",s.createElement(n.a,{href:"https://cilium.readthedocs.io/en/v1.4/install/upgrade/#upgrading-minor-versions"},"upgrade guide"),"\nto upgrade your Cilium deployment. Feel free to ping us on\n",s.createElement(n.a,{href:"https://slack.cilium.io"},"Slack"),"."),"\n",s.createElement(n.h2,null,"Release"),"\n",s.createElement(n.ul,null,"\n",s.createElement(n.li,null,"Release Notes & Binaries: ",s.createElement(n.a,{href:"https://github.com/cilium/cilium/releases/tag/1.4.0"},"1.4.0")),"\n",s.createElement(n.li,null,"Container image: ",s.createElement(n.span,{dangerouslySetInnerHTML:{__html:'<code class="language-text">docker.io/cilium/cilium:v1.4.0</code>'}})),"\n"))}var l=function(e){void 0===e&&(e={});const{wrapper:n}=Object.assign({},(0,t.RP)(),e.components);return n?s.createElement(n,e,s.createElement(i,e)):i(e)},c=a(8125),r=a(5805),o=a(8838),p=a(2744);const d=e=>{const{data:{mdx:n},children:a}=e,{frontmatter:{path:t,title:i,date:l,tags:o,ogSummary:d}}=n;return s.createElement(p.A,{headerWithSearch:!0},s.createElement(c.A,{path:t,content:a,date:l,title:i,tags:o,summary:d}),s.createElement(r.A,{className:"my-10 md:my-20 lg:my-28"}))},u=e=>{var n,a;let{data:{mdx:t,site:i},location:{pathname:l}}=e;const{frontmatter:{title:c,ogImage:r,ogSummary:p,dateIso:d,tags:u,author:m}}=t,{siteUrl:g}=i.siteMetadata,b=`${p.slice(0,133)}...`,f=`${g}${l}`,h=null!=r&&null!==(n=r.childImageSharp)&&void 0!==n&&null!==(a=n.resize)&&void 0!==a&&a.src?`${g}${r.childImageSharp.resize.src}`:null,w={title:c,description:b,image:r||null,slug:l},y={"@context":"https://schema.org","@type":"BlogPosting",headline:c,description:b,url:f,datePublished:d,dateModified:d,author:m?{"@type":"Person",name:m}:{"@type":"Organization",name:"Cilium",url:g},publisher:{"@type":"Organization",name:"Cilium",url:g,logo:{"@type":"ImageObject",url:`${g}/images/social-preview.jpg`}},...h&&{image:{"@type":"ImageObject",url:h,width:1200,height:630}},...(null==u?void 0:u.length)>0&&{keywords:u.join(", ")}};return s.createElement(o.A,{data:w,type:"article",datePublished:d,jsonLd:y})};function m(e){return s.createElement(d,e,s.createElement(l,e))}}}]); 2//# sourceMappingURL=component---src-templates-blog-post-jsx-content-file-path-src-posts-2019-02-12-cilium-14-index-md-fcf177e34d9d4fa24623.js.map
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.