Cilium

Mentors: Student: Gaurav Genani

<p>Currently, cilium-agent CLI exposes only a subset of daemon configurations. However, most of the applied configurations can be seen by viewing the ConifgMap in the Kubernetes cluster. The main issue is that ConfigMap does not stay reconciled with the active daemon configurations. This means that if we change any configuration in the ConfigMap, it is not immediately reflected in Cilium. Cilium needs to be restarted to apply those configurations. Depending on kernel configurations, It may happen that ConfigMap and daemon both show different active configurations. So, this project aims at improving the existing <code>cilium config</code> command to expose all active configurations.</p> <p>Add subcommand :</p> <ol> <li><code>cilium encrypt status,</code> which displays information on the current status of the IPSec configurations </li> <li><code>cilium encrypt flush,</code> which flushes the current XFRM States of the node.</li> </ol>

Mentors: Student: Tomoki Sugiura

<p>Cilium is a networking software which provides secure network connectivity and load-balancing between applications using eBPF. In addition, Cilium is a CNI plugin for Kubernetes. Cilium can manage network access control by using network policy functions, called “CiliumNetworkPolicy” (CNP). Users can allow or deny specific traffic by applying a CNP. However, currently, any traffic except for TCP/UDP (including ICMP) is denied if an L4 CNP is present, and there is no way for the user to explicitly allow ICMP traffic. Therefore, I propose to implement a CNP for explicitly allowing ICMP traffic.</p>

Mentors: Student: rgo3

<p>Currently <code>bpftool</code> as a userspace utility tool living in the linux kernel can do ebpf feature probing: <code>bpftool feature probe</code>. As the Go+ebpf user-base is growing, it would be useful to have the possibility to probe the kernel for available ebpf features from other userspace programs written in Go without having to shell out to <code>bpftool</code>. This proposal is about adding a feature probe API to cilium/ebpf that gives users a standardized interface to query the kernel for available ebpf features, furthermore encouraging the use of Go within a fast growing ebpf community.</p>

This project will focus on governance documentation for the Cilium project with two key parts. First, the governenace documentation should be moved out of the main docs and into the community repo. Second, we need to do an inventory of all of the repos under the project and come up with a lifecycle for them. Expected Outcome: Governance docs in community repo. All repos accounted for and with a lifecycle plan. Recommended Skills: enthusiasm for governance and basic markdown experience Upstream Issues: - https://github.com/cilium/community/issues/78 - https://github.com/cilium/community/issues/27 - https://github.com/cilium/community/issues/82

On the Cilium homepage (https://cilium.io/), we want to document technical outcomes from using Cilium. Think of these technical outcomes as aggregating some of cilium features to achieve a high level technical goal. These are the current ones we have in mind: Zero Trust Networking, Network Automation, Distributed Firewalling, Cost and Carbon Savings, Multi-cloud Connectivity. Expected Outcome: A section of the Cilium website detailing these technical outcomes. This section on the website can include any supporting materials from the Cilium community i.e blogs, videos, talks, illustrations, etc.