Cilium Overlay Network Architecture

Cilium Overlay Network Architecture An architecture diagram generated by Archify. Container A · 10.0.0.1 · Host A Container A 10.0.0.1 eBPF · intercept + policy · Host A eBPF intercept + policy VTEP · 192.168.1.1 · Host A VTEP 192.168.1.1 Physical Network · VXLAN tunnel (bidirectional) · Architecture component Physical Network VXLAN tunnel (bidirectional) VTEP · 192.168.1.2 · Host B VTEP 192.168.1.2 eBPF · packet processing · Host B eBPF packet processing Container B · 10.0.0.2 · Host B Container B 10.0.0.2 packet sent policy applied VXLAN encapsulation transmission decapsulation delivery Host A Host B

Sending Host A

  • • Container A sends a packet to Container B
  • • eBPF program intercepts the packet and applies policies
  • • Identifies the destination VTEP and encapsulates with a VXLAN header

Physical Network

  • • Carries the encapsulated packet to the destination host over underlay IPs
  • • Cilium uses VXLAN by default and also supports Geneve encapsulation

Receiving Host B

  • • Removes the VXLAN header at the destination host
  • • eBPF program on the destination host processes the packet
  • • Delivers the packet to destination Container B