With Azure CNI Powered by Cilium, AKS is now natively powered by Cilium. Azure CNI Powered by Cilium combines the robust control plane of Azure CNI with the dataplane of Cilium to provide high-performance networking and security.
AKS customers will also benefit from a seamless one-click upgrade experience from Azure CNI Powered by Cilium to the full Isovalent Enterprise for Cilium platform. The enterprise platform will be available in the Azure Container Marketplace and makes the full set of advanced Cilium features available to Azure customers. This includes security and governance controls, extended network capabilities, Timescape, the full set of Isovalent Tetragon Enterprise features, and more!
The tight integration into the Azure platform simplifies operations by enabling auto-upgrades and natively integrating into the Azure ecosystem for SIEM export, monitoring, and governance control. The unified billing experience will eliminate management overhead. Finally, the support collaboration will maximize the reliability and customer experience of the platform.
Azure Marketplace is an online store that contains thousands of IT software applications and services built by industry-leading technology companies. In Azure Marketplace, you can find, try, buy, and deploy the software and services that you need to build new solutions and manage your cloud infrastructure. The catalog includes solutions for different industries and technical areas, free trials, and consulting services from Microsoft partners.
Included among these solutions are Kubernetes application-based container offers. These offers contain applications that are meant to run on Kubernetes clusters such as Azure Kubernetes Service (AKS).
In this tutorial, users will learn how to deploy Isovalent Enterprise for Cilium on your AKS cluster from Azure Marketplace on a new cluster and also upgrade an existing cluster from an AKS cluster running Azure CNI powered by Cilium to Isovalent Enterprise for Cilium.
What is Isovalent Enterprise for Cilium
Isovalent Cilium Enterprise is an enterprise-grade, hardened distribution of open-source projects Cilium, Hubble, and Tetragon, built and supported by the Cilium creators. Cilium enhances networking and security at the network layer, while Hubble ensures thorough network observability and tracing. Tetragon ties it all together with runtime enforcement and security observability, offering a well-rounded solution for connectivity, compliance, multi-cloud, and security concerns.
Why Isovalent Enterprise for Cilium
For enterprise customers requiring support and/or usage of Advanced Networking, Security, and Observability features, “Isovalent Enterprise for Cilium” is recommended.
This offering brings complete flexibility in terms of access to Cilium features while retaining the advantageous ease of use and integration with Azure seamlessly.
Prerequisites
- AKS Cluster is up and running with Azure CNI powered by Cilium
- Azure CLI version 2.41.0 or later. Run
az --versionto see the currently installed version. If you need to install or upgrade, see Install Azure CLI. - If using ARM templates or the REST API, the AKS API version must be 2022-09-02-preview or later.
- The kubectl command line tool is installed on your device. The version can be the same as or up to one minor version earlier or later than the Kubernetes version of your cluster. For example, if your cluster version is 1.26, you can use kubectl version 1.25, 1.26, or 1.27 with it. To install or upgrade kubectl, see Installing or updating kubectl.
Register resource providers
Before you deploy a container offer, you must register the Microsoft.ContainerService and Microsoft.KubernetesConfiguration providers on your subscription by using the az provider register command:
Select and deploy a Kubernetes offer
Note- There are three ways to deploy a Kubernetes offer:
This tutorial will discuss the method to deploy the Isovalent Enterprise for Cilium Kubernetes offering from the Azure Marketplace.
- In the Azure portal, search for Marketplace on the top search bar. In the results, under Services, select Marketplace.
- You can search for an offer or publisher directly by name, or you can browse all offers. To find Kubernetes application offers, on the left side under Categories select Containers.
- In the search window type “Isovalent” and select the offer.
- On the Plans + Pricing tab, select an option. Ensure that the terms are acceptable, and then select Create.
- Select the respective subscription in which the new AKS cluster needs to be created.
- Select the resource group to deploy the cluster in. If a resource group doesn’t exist, click on “Create New”.
- Click on Create New Dev Cluster, select “Yes” and click on Next: Cluster Details.
- Provide a name for the AKS cluster and click on “Next: Review + Create”
- Once Final validation is complete, click on “Create”
- When the application is deployed, the portal will show “Your deployment is complete”, along with details of the deployment.
- End users can also check the extensions installed on the cluster from Azure Portal. On the AKS cluster, users can navigate to “Extensions + applications” menu to verify the same.
- Verify the deployment by using the following command to list the extensions that are running on your cluster:
- Log in to the Azure portal, browse to Kubernetes Services, select the respective Kubernetes service created ( AKS Cluster), and click on connect. This will help end users connect to their AKS cluster and set the individual Kubernetes context.
- Validating the version of Isovalent Enterprise for Cilium on your newly created cluster
Note– cee-indicates Cilium Enterprise Edition which is the Enterprise Version of Cilium offered by Isovalent that was installed on the cluster.
Upgrade an existing cluster
Note-
- An existing AKS cluster running Azure CNI powered by Cilium in the same region from where the upgrade is being attempted.
- The version on your cluster can be verified:
Preparing for the upgrade
This section will guide you through the steps required to upgrade an existing AKS cluster running Azure CNI powered by Cilium to Isovalent Enterprise for Cilium.
- In the Azure portal, search for Marketplace on the top search bar. In the results, under Services, select Marketplace.
- You can search for an offer or publisher directly by name, or you can browse all offers. To find Kubernetes application offers, on the left side under Categories select Containers.
- In the search window type “Isovalent” and select the offer.
- On the Plans + Pricing tab, select an option. Ensure that the terms are acceptable, and then select Create.
- Select the resource group in which the cluster is existing that we will be upgrading.
- Click on Create New Dev Cluster, select “No” and click on Next: Cluster Details.
- As “No” was selected, this will result in an upgrade of an already existing cluster in that region
- The name for the AKS cluster will be auto-populated by clicking on the drop-down selection.
- Click on “Next: Review + Create” Details.
- Once Final validation is complete, click on “Create”
- When the application is deployed, the portal will show “Your deployment is complete”, along with details of the deployment.
- End users can also check the extensions installed on the cluster from Azure Portal. On the AKS cluster, users can navigate to “Extensions + applications” menu to verify the same.
- Verify the deployment by using the following command to list the extensions that are running on your cluster:
- Log in to the Azure portal and browse to Kubernetes Services, select the respective Kubernetes service that was created ( AKS Cluster), and click on connect. This will help end users connect to their AKS cluster and set the respective Kubernetes context.
- Validating the version of Isovalent Enterprise for Cilium on your newly upgraded cluster
Note– cee-indicates Cilium Enterprise Edition which is the Enterprise Version of Cilium offered by Isovalent that the cluster was upgraded to.
Basic checks
- Let’s start by checking the status of the nodes.
- Let’s also check the node-to-node health with
cilium-health status
- We can even run a
cilium connectivity test(an automated test that checks that Cilium has been deployed correctly and tests intra-node connectivity, inter-node connectivity, and network policies) to verify that everything is working as expected.
Manage the offer lifecycle
For lifecycle management, an Azure Kubernetes offer is represented as a cluster extension for AKS. For more information, see Cluster extensions for AKS.
Purchasing an offer from Azure Marketplace creates a new instance of the extension on your AKS cluster. You can view the extension instance from the cluster by using the following command:
Note– extension-name in this case is cilium
Remove an offer
You can delete a purchased plan for an Azure container offer by deleting the extension instance on the cluster. For example:
Conclusion
Hopefully, this post gave you a good overview of how and why you would deploy Isovalent Enterprise for Cilium on your AKS clusters from the Azure marketplace.
If you have any feedback on the solution, please share it with us. You’ll find us on the Cilium Slack channel.
Further Reading
- Isovalent Enterprise for Cilium- General Availability
- Isovalent Enterprise for Cilium- Azure Marketplace
- Azure and Isovalent main partner page
- Isovalent Enterprise for Cilium now Available on Microsoft Azure Marketplace
- Microsoft and Isovalent partnership announcement about bringing eBPF-based Networking and Security to Azure
- You can also read more about Azure CNI powered by Cilium in our announcement blog post and don’t forget to follow our tutorial
- Isovalent Enterprise for Cilium on Microsoft Azure Marketplace
- Kubecon updates
Amit Gupta is a Senior Technical Marketing Engineer at Isovalent that is powering eBPF cloud-native networking and security. Amit has 20+ years of experience in Networking, Telecommunications, Cloud, Security, and Open-Source and has worked in the past with companies like Motorola, Juniper, Avi Networks (acquired by VMware), and Prosimo. He is keen to learn and try out new technologies that aid in solving day-to-day problems for operators and customers.
He has worked in the Indian start-up ecosystem for a long time and helps new folks in that area in his time outside of work. Amit is an avid runner and cyclist and also spends a considerable amount of time helping kids in orphanages.
