Cilium Architecture and the Role of eBPF

Cilium Architecture and the Role of eBPF An architecture diagram generated by Archify. Cilium Operator · cluster-wide resources / CRDs · Kubernetes cluster › Cluster-level components Cilium Operator cluster-wide resources / CRDs Kubernetes API Server · control plane · Kubernetes cluster › Cluster-level components Kubernetes API Server control plane Cilium CLI · operator input · Kubernetes cluster › Cluster-level components Cilium CLI operator input Hubble · Observability platform · Kubernetes cluster › Cluster-level components Hubble Observability platform Cilium Agent · daemon running on each node · Kubernetes cluster › Worker node (identical on every node) Cilium Agent daemon running on each node eBPF Maps · endpoints / policy / LB · Kubernetes cluster › Worker node (identical on every node) eBPF Maps endpoints / policy / LB eBPF Programs · XDP/TC datapath / LB / policy · Kubernetes cluster › Worker node (identical on every node) eBPF Programs XDP/TC datapath / LB / policy Pods · Pod A / B / C / D · Kubernetes cluster › Worker node (identical on every node) Pods Pod A / B / C / D CRD management state sync cluster state manage metrics collection load manage data access packet processing Kubernetes cluster Cluster-level components Worker node (identical on every node) Legend Workload pods Cilium & K8s eBPF maps Observability Operator tooling

Cilium Agent

  • • Daemon running on each node
  • • eBPF program compilation and loading
  • • Endpoint management and policy application
  • • State monitoring and metrics collection

eBPF Programs

  • • Datapath programs attached to XDP and TC hooks
  • • Socket-level load balancing
  • • Connection tracking and network policy enforcement

eBPF Maps

  • • Endpoint information and policy rule storage
  • • Connection tracking state management
  • • Load balancing service information