Over 14,000 GitHub stars! Cilium's popularity keeps on growing. If you're new to the world of Cilium - like I was myself a year ago - the first thing you'll want to do is install it. What I've discovered over the past 12 months is that there are many different ways to deploy Cilium! Whether you're a newcomer to Cilium or an experienced user, I hope you'll learn in this post some valuable tips and tricks to help you on your Cilium journey. A privilege of my job is that I get to work closely with the engineers that are building and improving Cilium on a day-to-day basis. And when they release a new feature, well, I often want to be amongst the first ones to test it out. Which means I often have to install the very latest Cilium version: not necessarily a mainline version (i.e 1.12.0), or even a release candidate (i.e 1.13.0-RC1). Release candidates are released on a regular basis in the run-up to the main release, to let users test some of the new features. Sometimes I have to test and deploy a Cilium version that has only just been pushed, either because it includes a bug fix or because it has a feature I really want to play with. I learned a few things along the way and wanted to share some of my learnings on this post. Let's go through the options at our disposal. The "Easy" Way Of course, you should always start with the official documentation when installing Cilium and this post doesn't intend to replace the official docs: it's rather a collection of tips and tricks. The docs focus primarily on the two most commonly used installation tools for Cilium: cilium-cli and helm. We will cover both tools in this post. Helm is the popular Kubernetes package manager, while cilium-cli is a purpose-built tool to install and manage Cilium. We'll start with cilium-cli first. You will see how we can use either tool, or even both of them together. I would recommend most first-time users to install Cilium with the cilium-cli tool and its command cilium install. It would install the latest stable release by default: Some configuration options can be specified with cilium install. For example, cilium install --encryption wireguard can be used to enable transparent encryption with WireGuard, as described in this tutorial and this lab. But if you want to fully customize your installation, you should use cilium-cli with helm-set (to specify configuration values on the command line based on Helm values) or helm-values to pull these values out of a YAML file. For example, this is what we use to install Cilium with BGP enabled in our BGP lab: You can see in the code snippet above that we are enabling features that are disabled by default (like BGP Control Plane). The "Specific Release" Way The examples shown so far install the latest stable release but the cilium-cli also lets you install a specific Cilium release. You can even check which Cilium version the cilium-cli supports with this command: By default, Cilium will install the stable release (at time of writing, v1.12.5). I can specify another version from that list, for example v1.11.1: You will notice that cilium-cli auto-detected the type of environment (kind in the example above) but it also works with AKS, EKS, etc... Cilium is indeed deployed differently depending on the type of underlying platform it's built upon. Detecting the environment is certainly a great benefit of cilium-cli and is useful even if you would rather use Helm: as you can see above, cilium-cli uses helm template in its backend to generate the manifests. If you look at the terminal snippets above and below, cilium-cli even gives the user the helm template command to use if they just want to use cilium-cli to auto-detect the right flags for their clusters. In other words - you can use cilium-cli for its ease, helm because it's commonly used for app deployment, or finally you can use both, by using cilium-cli to auto-detect the environment values and to help you set the adequate Helm values. In addition, cilium-cli also includes a way to auto-generate Helm values in a file, with --helm-auto-gen-values. This flag effectively gives you a dry-run option: it generates the values, but doesn't actually install it (you can refer to these values when deploying Cilium with Helm later on): I can then install Cilium with Helm by referring to the Helm value file created by cilium-cli: Here is another example where I install Cilium by referring to them in the command-line instead of in a separate YAML file. This is what I used to install one of the recent release candidates version to test SCTP support on Cilium. As you can see, I use helm instead of cilium-cli to install the specific version. Note I specify the version 1.13.0-rc3 (SCTP support was introduced in RC1) and I also enabled SCTP and other additional features that are disabled by default, such as Hubble. The "CI Build Image" Way Where it gets more complex is working out how to install a version of Cilium that includes a particular fix or a new feature, but that is not yet available as an official release. For example, I wanted to test a Gateway API feature that lets us load-balance traffic across backends. During my tests, I identified a bug which was quickly resolved by Tam, one of our rock-star developers working on Cilium. Once Tam got his PR merged, I was able to use the images generated during the CI process and published on the container image repository quay.io (with the Cilium images published on quay.io/cilium). First, I had to get the details of the images generated during the build process: What I copied at the end of this short video was this image location and its digest: quay.io/cilium/cilium-ci:db5b10436fa730de83275655d8f00e2e64db5e45. To install this version, all I need is to reference these specific images for both the Cilium agent and the Cilium operator. Note that in my case, I also had to make sure the Helm chart was correct, which is why I had to clone the repo locally to use the latest Helm chart: The end result was a demo I posted on LinkedIn - you can also see it below: Using cilium-cli and the helm-set flags, we can apply the same configuration with cilium install instead: You don't always have to use the Helm flag options with the cilium-cli: you can instead use some of the built-in options. For example, instead of using the --helm-set=operator.image, we can use the simpler --operator-image flag instead. Check out the full list of options with cilium install -h. The "Latest" Way If you don't want a specific image build but rather the very latest version, you can simply use the -version=latest. Here is a quick demo: That's a really useful command and one I wish I had discovered earlier! There is another obvious method to run the latest Cilium version: build it from the source code. The "Compiled from Source" Way Finally, let's cover what might look like the most intimidating method on paper: compiling and installing Cilium from source. It turned out to be easier than expected, with a little help. As soon as the most recent BGP feature was released (covered at length in this eCHO episode), I wanted to try it out for myself. I leveraged some scripts from the Cilium repo to simplify it. Once I had installed Go and Make on my machine, I was able to successfully deploy the latest version of Cilium on a Kind cluster, using this very handy script: It only took 5 minutes from start to finish, as you can see in the video below: Summary In this tutorial, I shared some tips and tricks I learned over the course of the past year deploying many different Cilium versions across different environments for very different use cases. I shared a few different options on how Cilium can be installed and why you might want to use a method over another or why you might use them together! If you'd like to learn more, we let use different installation methods in many of the Isovalent labs. Check out the Getting Started with Cilium lab, the Cluster Mesh lab, the Transparent Encryption lab or the Egress Gateway lab. I hope you found this blog post helpful. Thanks for reading. Learn More Join our community on Slack Cilium Open Source Project eBPF Community Resources