Back to blog

Cilium Mesh – One Mesh to Connect Them All

Thomas Graf
Thomas Graf
Published: Updated: Cilium
Cilium Mesh marketechture overview

We have exciting news to share. Cilium has rapidly become the standard in Kubernetes networking thanks due to its advanced security, performance, and exceptional scalability. With the increase in the adoption of Cilium, more and more customers have requested to bring Cilium to the world of virtual machines and servers.

Today, we are excited to announce Cilium Mesh. Cilium Mesh connects Kubernetes workloads, virtual machines, and physical servers running in the cloud, on-premises, or at the edge. It is a natural evolution of Cilium. It builds on the strong Kubernetes networking foundation with identity-based security and deep observability and combines it with the highly scalable multi-cluster control plane Cilium Cluster Mesh. A new transit gateway that can be deployed as a virtual appliance into any network to connect workloads in existing networks with Kubernetes or workloads behind other transit gateways.

What is Cilium Mesh?

Cilium Mesh is a new universal networking layer to connect workloads and machines across cloud, on-prem, and edge. It consists of a Kubernetes networking component (CNI), a multi-cluster connectivity plane (Cluster Mesh), and a transit gateway to connect with existing networks.

Cilium Mesh Architecture

Cilium Mesh combines all of the existing Cilium components into a single, functional mesh to connect workloads across cloud, on-prem, and edge:

  • Kubernetes Networking (CNI): The CNI plugin of Cilium runs on any Kubernetes worker node and is compatible with Kubernetes running in the cloud, on-prem, and at the edge. A Cilium-enriched Kubernetes node automatically gains connectivity to all other Kubernetes nodes and any gateway in the mesh.
  • Cluster Mesh: The Cilium Cluster Mesh functions as the control plane and provides the ability to mesh multiple clusters together. It provides the functionality to span network security, encryption, service discovery, load-balancing, and observability services across all clusters.
  • Ingress & Egress Gateway: The ingress and egress functionality of Cilium is compatible with Cilium Mesh. Cilium-enriched Kubernetes nodes can act as Ingress or Gateway API nodes for outside traffic to enter the mesh. Similarly, Cilium-enriched Kubernetes nodes can act as egress gateways for traffic to leave the mesh via particular nodes and defined source IP addresses.
  • Service Mesh: All Cilium nodes and gateways have the capability to perform L7 services to provide service mesh functionality including L7 load-balancing, Canary Rollouts, mTLS (Cilium 1.14), and Tracing. Service mesh functionality can be configured using the APIs: Ingress, Gateway API, Kubernetes Services, and Envoy CRD.

As part of Isovalent Cilium Enterprise, the following additional components are included:

  • Isovalent Transit Gateway: A new component that allows the deployment of a virtual appliance with a Cilium Gateway installed. The Isovalent Transit Gateway can automatically attract traffic in on-prem networks using BGP and in VPCs using VPC routing. It is also equipped with its own control plane to be able to run outside of Kubernetes while hooking into Cilium Mesh.
  • Isovalent Cluster Mesh: An enhanced version of Cilium Cluster Mesh. The enhanced version supports connecting clusters and gateways with overlapping IP addresses. Additionally, the overlay can be served using SRv6 to build a segment routing mesh using IPv6.
  • Isovalent Egress Gateway HA: An enhanced version of the Cilium Egress Gateway with the ability to be deployed in a highly available (HA) version. This allows egress nodes to fail without impacting the performance, uptime, and reliability of the mesh.
  • Isovalent Ingress & LoadBalancer: An enhanced version of the Cilium Standalone Ingress & LoadBalancer at L3-L7 with the capability of running outside of Kubernetes. The shipped control plane supports hooking into Cilium Mesh to implement Kubernetes services of type LoadBalancer including the announcement of service IPs using BGPs as well as full Gateway API support.

Why Cilium Mesh?

Cilium Mesh is a natural evolution of Cilium to extend the reach of Cilium-based networking and security. The datapath of Cilium has always been generic and applicable to use cases beyond Kubernetes. In fact, several users have been using Cilium as a pure vSwitch in environments such as OpenStack. With Cilium Mesh, we are officially enlarging the scope of Cilium to more than Kubernetes.

What does Cilium Mesh bring to Multi- & Hybrid-Cloud Networking?

Bringing a Kubernetes and cloud native networking solution to enterprise and cloud networking brings a wide range of advantages:

  • Modern Zero-Trust Security: Distributed firewalling and micro-segmentation, transparent encryption, and mTLS-based end-to-end authentication make up modern cloud native security principles to build zero-trust-based security. Cilium Mesh makes it trivial to establish these security principles not only in Kubernetes but extend them to existing infrastructure. In addition, the modern eBPF-based runtime security layer Tetragon enriches a SIEM with deep security observability data on networking and runtime.
  • Deep End-to-End Observability: Cilium’s Hubble has set new standards in network observability and monitoring. With Cilium Mesh, the eBPF-based observability stack of Cilium becomes available in existing networks. Observability data is made available using modern standards such as Prometheus and can be visualized using powerful tools such as Grafana. Traditional standards such as sFLow and NetFlow are still supported as needed.
  • Multi-Cloud Aligned: Cilium has been selected by all major cloud providers for at least one of their managed Kubernetes platforms. Because of this, Cilium is deeply integrated into all public cloud networking layers. At the same time, it is a logical abstraction and thus provides portability across all cloud providers and into on-prem networking. Cilium is aligned on open source standards and thus ideal as the foundational networking layer of the future.
  • DevOps & GitOps Alignment: All aspects of Cilium Mesh are optimized for modern platforming engineering and DevOps teams. All components can be deployed in a fully automated way and all aspects of the mesh can be configured using an API.
  • Highly Scalable Control Plane: The modern Cilium control plane is fully distributed and has been built for container workloads to easily scale horizontally.

How do I configure Cilium Mesh?

For those familiar with Cilium Cluster Mesh, Cilium Mesh is built on its foundation. It is using the Kubernetes API as its control plane which is well-proven, familiar to modern platform engineering teams, and provides ideal properties for a distributed control plane.

The API for the transit gateway is still in development. The following example shows an early example of how to expose nginx running in Kubernetes via a transit gateway. Afterwards, the pod can be accessed via a service VIP or a service DNS name:

apiVersion: v1
kind: Service
metadata:
  name: nginx
  annotations:
    io.cilium/global-service: "true"
    io.cilium/portal: "true"
spec:
  type: LoadBalancer
  ports:
  - port: 80
  selector:
    run: nginx

The traffic can be secured using network policies:

apiVersion: "cilium.io/v2"
kind: CiliumNetworkPolicy
metadata:
  name: "l3-rule"
spec:
  endpointSelector:
    matchLabels:
      run: nginx
  ingress:
  - fromEndpoints:
    - matchLabels:
      client: good

Observability across Infrastructure

Cilium provides extensive observability capabilities including the ability to stream observability data to Hubble UI, Prometheus & Grafana, and most SIEMs. This capability extends to Cilium Mesh to provide visibility into all workloads across cloud and on-prem infrastructure.

I want to see a Demo!

Great. If you are at KubeCon, stop by the Isovalent booth for a personal demo. If you can’t make it to KubeCon, reach out to us, and we are glad to schedule a personal demo with you.

We are also working with existing customers to test the preview of Cilium Mesh functionality. If you are interested to get involved in testing current versions of Cilium Mesh and provide feedback, get in touch with us by requesting a demo.

More Information

Thomas Graf
AuthorThomas GrafCTO & Co-Founder Isovalent, Co-Creator Cilium, Chair eBPF Governing Board
Thomas Graf is one of the creators of Cilium and the CTO & Co-Founder of Isovalent, the company behind Cilium. Before that, Thomas spent 15 years as a kernel developer working on the Linux kernel in networking, security, and eventually eBPF.
Share on social media

Industry insights you won’t delete. Delivered to your inbox weekly.