We are pleased to announce that Isovalent Enterprise for Cilium is now available in the AWS marketplace. In this blog, you will learn how to deploy Isovalent Enterprise for Cilium on EKS, and EKS-A clusters from the AWS marketplace. This new availability in AWS Marketplace allows customers to:
- Consume Kubernetes networking, security, and observability as services.
- Easily find, test, and deploy Cilium.
- Get started in minutes instead of lengthy deployment cycles.
- Only pay for services consumed upfront investment commitments.
Cilium is the default CNI for EKS-Anywhere and has been widely adopted by users and customers for EKS.
What is Isovalent Enterprise for Cilium?
Isovalent Cilium Enterprise is an enterprise-grade, hardened distribution of open-source projects Cilium, Hubble, and Tetragon, built and supported by the Cilium creators. Cilium enhances networking and security at the network layer, while Hubble enables thorough network observability and tracing. Tetragon ties it all together with runtime enforcement and security observability, offering a well-rounded solution for connectivity, compliance, multi-cloud, and security concerns.
Why Isovalent Enterprise for Cilium?
For enterprise customers requiring support and/or usage of Advanced Networking, Security, and Observability features, “Isovalent Enterprise for Cilium” is recommended. This offering brings complete flexibility in terms of access to Cilium features while retaining the advantageous ease of use and integration with AWS seamlessly.
What are the benefits of Cilium in AWS?
When running in the context of AWS, Cilium can natively integrate with the cloud provider’s SDN (Software Defined Networking). Cilium can speak BGP, route traffic on the network, and represent existing network endpoints with cloud-native identities in an on-premises environment. To the application team using Kubernetes daily, the user experience will be the same regardless of whether the workload runs in Kubernetes clusters backed by public or private cloud infrastructure. Entire application stacks or even entire clusters become portable across clouds.
Cilium has several differentiators that set it apart from other networking and security solutions in the cloud native ecosystem, including:
- eBPF-based technology: Cilium leverages eBPF technology to provide deep visibility into network traffic and granular control over network connections.
- Micro-segmentation: Cilium enables micro-segmentation at the network level, allowing organizations to enforce policies that limit communication between different services or workloads.
- Encryption and authentication: Cilium provides encryption and authentication of all network traffic, ensuring that only authorized parties can access data and resources.
- Application-aware network security: Cilium provides network firewalling on L3-L7, with support for HTTP, gRPC, Kafka, and other protocols. This enables application-aware network security and protects against attacks that target specific applications or services.
- Observability: Cilium provides rich observability of Kubernetes and cloud-native infrastructure, allowing security teams to gain security-relevant observability and feed network activity into an SIEM (Security Information and Event Management) solution such as Splunk or Elastic.
Prerequisites
The following prerequisites need to be taken into account before you proceed with this tutorial:
- Access to AWS marketplace. Create a new account for free.
- The following EC2 privileges are required by the Cilium operator in order to perform ENI creation and IP allocation.
- Install kubectl
- Install Helm
- Install eksctl
- Install awscli
- Cilium CLI: Cilium Enterprise provides Cilium CLI tool that automatically collects all the logs and debug information needed to troubleshoot your Cilium Enterprise installation. You can install Cilium CLI for Linux, macOS, or other distributions on their local machine(s) or server(s).
- Hubble CLI: To access the observability data collected by Hubble, you can install the Hubble CLI. You can install Hubble CLI for Linux, macOS, or other distributions on their local machine (s) or server (s).
Where can I deploy Isovalent Enterprise for Cilium?
Isovalent Enterprise from the AWS marketplace can be deployed on:
- An existing EKS cluster
- A new EKS cluster using QuickLaunch
- A new EKS-A cluster
1. Installing Isovalent Enterprise for Cilium on an EKS cluster
You can install Isovalent Enterprise for Cilium on an existing EKS cluster or create a new EKS cluster for this tutorial as well.
- Login to AWS marketplace.
- Type “Isovalent” in the search window and select the application.
- Click> Isovalent Enterprise for Cilium
- Click> Continue to Subscribe
- Click> Continue to Configuration
- Click> Fulfillment Option and select “Helm Chart”
- Click> Choose a fulfillment option and select “Isovalent Enterprise for Cilium on EKS”
- Click> Software version> Select v1.12.8-awsmp.* (*-pick the latest version)
- The Launch method should be selected as “Launch on existing cluster” by default.
- You need to ensure that the IAM OIDC provider is associated with the cluster.
- To use AWS Identity and Access Management (IAM) roles for service accounts, an IAM OIDC provider must exist for your cluster’s OIDC issuer URL.
- Create an AWS IAM role and Kubernetes service account.
Output Truncated:
- Launch Isovalent Enterprise for Cilium by installing a Helm chart on your Amazon EKS cluster.
- The Helm CLI version in your launch environment must be 3.7.1.
- Note- username, password, and path for pulling the image have been hidden here but are available when the user is logged in.
Output Truncated:
2. Installing Isovalent Enterprise for Cilium on an EKS cluster using QuickLaunch
QuickLaunch helps you easily launch and explore container-based applications. QuickLaunch uses AWS CloudFormation to create an Amazon EKS cluster and Helm charts to launch the application on it.
- Login to AWS marketplace.
- Type “Isovalent” in the search window and select the application.
- Click> Isovalent Enterprise for Cilium
- Click> Continue to Subscribe
- Click> Continue to Configuration
- Click> Fulfillment Option and select “Helm Chart”
- Click> Choose a fulfillment option and select “Isovalent Enterprise for Cilium on EKS”
- Click> Software version> Select v1.12.8-awsmp.* (*-pick the latest version)
- Click> Continue to Launch
- Click> “Launch on a new EKS cluster with QuickLaunch”
- Click> QuickLaunch with Cloudformation
- This will redirect you to fill up details for creating a Cloudformation stack that will be used to create an EKS cluster running Isovalent Enterprise for Cilium.
- Enter a Stack Name
- Enter a name for your EKS cluster.
Note- The EKS cluster name should be less than 16 characters. This is a mandatory requirement.
- The Helm Chart parameters should be left to be set to the defaults that are populated from the pre-populated CloudFormation template.
- Select> I acknowledge that AWS CloudFormation might create IAM resources with customised names and Select> l acknowledge that AWS CloudFormation might require the following capability: CAPABILITY_AUTO_EXPAND
- Click> Create Stack
- This will redirect you to the stacks page and create a new CloudFormation Stack.
Accessing the Cluster
To access your EKS cluster created by Quicklaunch, you will need to update your kubectl config:
3. Installing Isovalent Enterprise for Cilium in an EKS-A cluster
EKS Anywhere creates a Kubernetes cluster on-premises for a chosen provider. Supported providers include Bare Metal (via Tinkerbell), CloudStack, and vSphere. To manage that cluster, you can run cluster create and delete commands from an Ubuntu or Mac Administrative machine.
Note-
- Refer to the Pre-requisites section to ensure that all dependencies are installed and the administrative machine is also configured.
- For EKS-Anywhere
- Refer to the “Preparing the Administrative Machine” section to create an administrative machine to run cluster operations
- EKS-A cluster infrastructure preparation (hardware and inventory management) is not in the scope of this document. This document assumes that you have already taken care of it prior to proceeding with creating a cluster on any of the provider types.
- The provider type chosen for this tutorial is docker which is a development-only version and not for production. You can choose from a list of providers and modify the commands accordingly.
- To install an EKS-A cluster on docker, follow these steps outlined.
- All EKS-A clusters are deployed with the base edition of Cilium that will need to be uninstalled before upgrading to Isovalent Enterprise for Cilium. An automatic upgrade from the default Cilium image to Isovalent Enterprise for Cilium will be supported in an upcoming release.
Steps:
- Login to AWS marketplace.
- Type “Isovalent” in the search window and select the application.
- Click> Isovalent Enterprise for Cilium
- Click> Continue to Subscribe
- Click> Continue to Configuration
- Click> Fulfillment Option and select “Helm Chart”
- Click> Choose a fulfillment option and select “Isovalent Enterprise for Cilium on EKS Anywhere”
- Click> Software version> Select v1.12.8-awsmp.* (*-pick the latest version)
- Click> Continue to Launch
- Launch target is set to “Self-Managed Kubernetes”
- Create a license token and IAM role. Choose Create token to generate a license token and AWS IAM role. These will be used to access the AWS License Manager APIs for billing and metering. You can use an existing token if you have one and make sure that the following permissions are granted to the token:
- To create the IAM role you will need to Grant Permission
- Save the token and IAM role as a Kubernetes secret
- Note- username, password, and path for pulling the image have been hidden here but are available when the user is logged in.
- Install Isovalent Enterprise for Cilium by installing a Helm chart from Amazon Elastic Container Registry (ECR).
- The Helm CLI version in your launch environment must be 3.7.1.
- Note- username, password, and path for pulling the image have been hidden here but are available when the user is logged in.
Output Truncated:
Validation- Isovalent Enterprise for Cilium
The validation part remains the same for an EKS or EKS-A cluster running Isovalent Enterprise for Cilium
Validate the Installation
To validate that Cilium has been properly installed with the correct version, run the following command cilium-status and you can observe that Cilium is managing all the pods and they are in “Ready” state and are “Available”.
Cluster and Cilium Health Check
Check the status of the nodes and make sure they are in a “Ready” state
cilium-health is a tool available in Cilium that provides visibility into the overall health of the cluster’s networking connectivity. Use cilium-health to get visibility into the overall health of the cluster’s networking connectivity.
Cilium Connectivity Test
The cilium connectivity test command deploys a series of services, deployments, and CiliumNetworkPolicy which will use various connectivity paths to connect to each other. Connectivity paths include with and without service load-balancing and various network policy combinations.
Output Truncated:
Validate Hubble API access
To get temporary access to the Hubble API, create a port forward to the Hubble service from your local machine or server. This will allow you to connect the Hubble client to the local port 4245 and access the Hubble Relay service in your Kubernetes cluster. For more information on this method, see Use Port Forwarding to Access Application in a Cluster.
Validate that you have access to the Hubble API via the installed CLI and notice that both the nodes are connected and flows are being accounted for.
Run hubble observe command in a different terminal against the local port to observe cluster-wide network events through Hubble Relay:
Accessing the Hubble UI
To get temporary access to the Hubble UI, create a port forward to the Hubble service from your local machine or server. This will allow you to connect to the local port 12000 and access the Hubble UI service in your Kubernetes cluster. For more information on this method, see Use Port Forwarding to Access Application in a Cluster.
- This will redirect you to http://localhost:12000 in your browser.
- You should see a screen with an invitation to select a namespace, use the namespace selector dropdown on the left top corner to select a namespace:
Troubleshooting
The default EKS-A cluster has Cilium installed/running by default and you must uninstall the default version of Cilium else you will be prompted with the error message below:
You need to make sure that your ~/.aws/config is pointing to the correct region else the describe operation will fail as below:
While following the instructions to create a cluster it’s mandatory to have an IAM OIDC provider enabled without which the iamserviceaccount cannot be enabled. If it’s not enabled, you will see an error message as below:
Conclusion
Hopefully, this post gave you a good overview of how to install Cilium in the AWS marketplace on EKS and EKS-A clusters. If you have any feedback on the solution, please share it with us. You’ll find us on the Cilium Slack channel.
Try it out
These learning tracks focus on features that are particularly important to engineers using Cilium in cloud environments. Given that Cilium comes in different flavors whether you are using GKE, AKS, or EKS, not all of these features will be applicable to each managed Kubernetes Service. However, it should give you a good idea of features that are particularly relevant to operating Cilium in cloud environments.
Suggested Reading
Amit Gupta is a Senior Technical Marketing Engineer at Isovalent that is powering eBPF cloud-native networking and security. Amit has 20+ years of experience in Networking, Telecommunications, Cloud, Security, and Open-Source and has worked in the past with companies like Motorola, Juniper, Avi Networks (acquired by VMware), and Prosimo. He is keen to learn and try out new technologies that aid in solving day-to-day problems for operators and customers.
He has worked in the Indian start-up ecosystem for a long time and helps new folks in that area in his time outside of work. Amit is an avid runner and cyclist and also spends a considerable amount of time helping kids in orphanages.
