Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add cilium_enable_bbr flag for cilium #11730

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
+22 −2
Open

Add cilium_enable_bbr flag for cilium #11730

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 10 additions & 1 deletion docs/CNI/cilium.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -313,12 +313,21 @@ Bandwidth Manager requires a v5.1.x or more recent Linux kernel.

For further information, make sure to check the official [Cilium documentation](https://docs.cilium.io/en/latest/network/kubernetes/bandwidth-manager/)

To use this function, set the following parameters
To use this feature, set the following parameters:

```yml
cilium_enable_bandwidth_manager: true
```

The base infrastructure around MQ/FQ setup provided by Cilium’s bandwidth manager also allows for use of TCP BBR congestion control for Pods. BBR achieves higher bandwidths and lower latencies for Internet traffic. you can enable it by setting the following parameters:

```yaml
cilium_enable_bandwidth_manager: true
cilium_enable_bbr: true
```

> BBR for Pods requires a v5.18.x or more recent Linux kernel.

## Host Firewall

Host Firewall enforces security policies for Kubernetes nodes. It is disable by default, since it can break the cluster connectivity.
Expand Down
8 changes: 7 additions & 1 deletion roles/network_plugin/cilium/defaults/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,9 @@ cilium_enable_prometheus: false
cilium_enable_portmap: false
# Monitor aggregation level (none/low/medium/maximum)
cilium_monitor_aggregation: medium
# Kube Proxy Replacement mode (strict/partial)
# Kube Proxy Replacement mode
# cilium_version < 1.14.0: strict/partial/disabled
# cilium_version >= 1.14.0: true/false
cilium_kube_proxy_replacement: partial

# If upgrading from Cilium < 1.5, you may want to override some of these options
Expand Down Expand Up @@ -120,6 +122,10 @@ cilium_wireguard_userspace_fallback: false
# Bandwidth Manager requires a v5.1.x or more recent Linux kernel.
cilium_enable_bandwidth_manager: false

# Enable BBR for the bandwidth manager
# Requires cilium_enable_bandwidth_manager to be enabled
cilium_enable_bbr: false

# IP Masquerade Agent
# https://docs.cilium.io/en/stable/concepts/networking/masquerading/
# By default, all packets from a pod destined to an IP address outside of the cilium_native_routing_cidr range are masqueraded
Expand Down
5 changes: 5 additions & 0 deletions roles/network_plugin/cilium/templates/cilium/config.yml.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -144,6 +144,11 @@ data:
# Bandwidth Manager requires a v5.1.x or more recent Linux kernel.
{% if cilium_enable_bandwidth_manager %}
enable-bandwidth-manager: "true"
# Enable BBR for the bandwidth manager
# BBR for Pods requires a v5.18.x or more recent Linux kernel.
{% if cilium_enable_bbr %}
enable-bbr: "true"
{% endif %}
Comment on lines +149 to +151
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
{% if cilium_enable_bbr %}
enable-bbr: "true"
{% endif %}
enable-bbr: "{{ cilium_enable_bbr | lower }}"

Unless there is a downside to explicitly set if to false ?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I prefer the current change, which prevents cilium from failing to start if the user-configured value is not true or false.

{% endif %}

# Host Firewall and Policy Audit Mode
Expand Down