Service Mesh: CCA practice questions

A service mesh takes connectivity, load balancing, security and observability out of application code and provides them as infrastructure. Cilium splits that work by layer. IP, TCP and UDP processing happens in the kernel with eBPF, while application protocols such as HTTP, gRPC and DNS are parsed by a proxy, Envoy. The Envoy instances are node-local: the layer 7 policy documentation describes traffic being proxied through a node-local Envoy, which can run as its own DaemonSet or embedded in the agent pod, and Ingress and Gateway API use these per-node proxies too. This is the basis of the sidecarless design, since workloads do not need a proxy container injected into each pod.

Ingress support uses the standard Kubernetes Ingress resource with ingressClassName: cilium. It is enabled with the Helm value ingressController.enabled=true and requires kubeProxyReplacement=true and the layer 7 proxy, which is on by default. The controller creates a LoadBalancer Service, so the environment must support one, though NodePort and host network mode are alternatives. The load balancer mode is either dedicated, one load balancer per Ingress, which avoids conflicts such as overlapping path prefixes, or shared, one load balancer for all Ingresses. Switching modes can drop active connections because the address changes.

Gateway API is the successor to Ingress and is enabled with gatewayAPI.enabled=true, again with kube-proxy replacement as a prerequisite and the Gateway API CRDs installed first. Cilium only programs Gateways whose class is cilium. A GatewayClass names the implementation, a Gateway defines listeners and receives an address from a LoadBalancer Service, and routes such as HTTPRoute, GRPCRoute and TLSRoute attach to it, with ReferenceGrant among the supported resources. kubectl get gateway shows the address and whether the Gateway is programmed, and the Accepted, Programmed and ResolvedRefs conditions are the first place to look when traffic does not arrive. Traffic splitting is among the documented Gateway API examples, and GAMMA support applies Gateway API to service-to-service traffic.

Beyond Ingress and Gateway API, the CiliumEnvoyConfig and CiliumClusterwideEnvoyConfig custom resources give direct control of Envoy for layer 7 traffic management such as load balancing, circuit breaking, path translation and traffic shifting. They are cluster-administrator resources, and envoyConfig.enabled=true turns them on without Ingress.

Mutual authentication is a beta feature. It uses SPIFFE identities issued through SPIRE, with a SPIRE server as the root of trust and an agent on each node, and Cilium performs the mutual TLS handshake out of band rather than inside each connection. It is enabled with authentication.mutual.spire.enabled=true. Authentication alone does not encrypt the traffic; the documentation tells users to enable WireGuard or IPsec transparent encryption for that. The listed limitations are that it is only validated with SPIRE, does not work across Cluster Mesh, and is incompatible with external mTLS solutions. For teams that want Istio instead, Cilium documents integration with both its ambient and sidecar modes.