Cilium breadcrumbs 4

Last week I posted IPAM modes in Cilium. This week's breadcrumbs we continue with Cilium and is about Load Balancing, or in other words, how Cilium can replace your MetalLB.

In Cilium you can create Load Balancers and for them to work you just need to manage to assign it an IP that is reachable from the outside world. If you think about it, when you create an ingress for example, normally your cloud provider is gonna create a load balancer as well and it wires them up. Then you can send stuff to your load balancer which ends up in your ingress. However, if you are self-hosting for example, there is no cloud creating load balancers, though you still need one.

There are three main ways to get an IP reachable from the outside:

1. Use BGP protocol: This is the convoluted option and it's required that you control your network. Basically you need to make your routers aware of your cluster by using the BGP protocol. BGP is a titan on its own so I won't go into details here.
2. L2 Announcement: This is far easier than using BGP protocol. With this method, your cluster will respond to ARP requests regarding your load balancer IP. You need also certain degree of control in your network as ARP is level 2. For example, in a VPS this is not gonna work because providers normally block ARP queries for security.
3. Node IPAM Load Balancer: This is used when you cannot use L2 Announcements nor BGP protocol. Basically you advertise your Node's IP to the public, so essentially your load balancer address becomes your node's address. This is what I'm using right now on my VPS as I don't have a fancy network configuration.

You might be wondering, why choosing Cilium instead of MetalLB or standard load balancing? The answer is iptables and DSR (Direct Server Return).

When you have a big network setup, iptables becomes sluggish as it works by checking the rules one by one. With Cilium, it uses eBPF and the lookup is O(1) as it uses a hashtable.

DSR allows your backend to talk to the client directly as the client's IP is preserved. Without it, your load balancer is a middleman in the conversation and it might become a bottleneck.

I'm creating these breadcrumbs about what I know with the goal of teaching stuff quickly, kind of a knowledge snack. If you like this kind of information, consider to give the post some love by reacting or commenting on it or even sharing with your people. Feel free to follow or connect with me!