Cilium Breadcrumbs 3

Cilium breadcrumbs 3

Last week I posted routing modes of Cilium within Kubernetes and the previous one about the main components of Cilium. This week's breadcrumbs are about IP Allocation modes though correct name is IP Address Management (IPAM).

In Kubernetes when you create a pod, it gets assigned an IP, but someone needs to decide what IP, right? It cannot be a random one, otherwise it could be a used one or something like that. One of the jobs of the CNI is to decide and manage the IP addresses within the system. Cilium supports five different modes for this:

1. Kubernetes Host Scope mode: Kubernetes assigns an IP range (CIDR) to each node by using a v1.node definition and then each node manages the IPs needed there. Do you remember the Cilium agent that lives in each cluster? This guy now knows the IP range assigned to where is running, so it can handle the IPs. For example, a new pod is scheduled to run on Node 1, Node 1 Cilium Agent picks up one of the IP of the Node 1 CIDR and assigns that to the new pod. This mode is useful when you want to decouple from the CNI, maybe in future you want to use something different.
2. Cluster Scope mode: Very similar to Kubernetes Host Scope, however, is not Kubernetes the one assigning the IP ranges by using the node definition. It's the Cilium operator. This is the default behaviour because is the best in most scenarios.
3. Cloud-Specific mode: This basically delegates the allocation to your cloud provider, so it's useful when you want to assign IPs from your cloud network and things like that.
4. Multi-pool (beta) mode: This is when you want fancy stuff. Basically, each node gets a list of pools of different ranges, each range associated with labels and annotations. Then when a pod needs to be created, the Cilium operator will assign one IP or another depending on the labels and annotations it has. This mode is used when you need IP segregation, different workloads and so on.
5. CRD-backed mode: This one allows you to specify the available IPs in a CRD (Custom Resource Definition). The user or an external operator can update the CRD list and the Cilium agent picks up IPs from that list. This mode allows external control, so a different operator than Cilium could potentially control the IP allocation by modifying the CRD.

By the way I've used pods for the examples as IPAM primarily handles the IP for pods. Other elements like services can also get IPs through other means.

I'm creating these breadcrumbs about what I know with the goal of teaching stuff quickly, kind of a knowledge snack. If you like this kind of information, consider to give the post some love by reacting or commenting on it or even sharing with your people. Feel free to follow or connect with me!