helm安装Cilium(ebpf cni插件)

环境信息

1. Kubernetes：v1.20.6
2. Helm：v3.5.2
3. nginx-ingress: 0.47.0

本安装前准备工作

1. 申请域名证书

可以使用 https://keymanager.org/ 来申请 Let’s Encrypt 提供的免费泛域名证书

2. 创建域名证书 secret

kubectl create secret tls tls-ingress-hubble-ui \
--cert=onwalk.net.crt \
--key=onwalk.net.key \
-n kube-system

3. 同步海外源镜像

在国内环境部署应用，经常因为获取国外源站容器镜像超时，导致部署失败，可以提前将容器镜像同步到本地镜像仓库中，以自有镜像仓库uhub.service.ucloud.cn/ucloud_pts 为例，login仓库，执行命令： docker login uhub.service.ucloud.cn/ucloud_pts
需要同步镜像列表如下：

关于docker pull tag push 操作可以参考：

• https://docs.docker.com/engine/reference/commandline/pull/
• https://docs.docker.com/engine/reference/commandline/tag/
• https://docs.docker.com/engine/reference/commandline/push/

4. 创建 imagePullSecrets

创建容器集群访问仓库地址 uhub.service.ucloud.cn/ucloud_pts，拉取镜像需要的 secret

kubectl create namespace monitor
kubectl create secret docker-registry registry-prometheus-secret \
        --namespace=monitor \
        --docker-server=uhub.service.ucloud.cn/ucloud_pts \
        --docker-username='xxxxxx' \
        --docker-password='xxxxxx'

4. 添加 Helm仓库

这里选用 cilium 提供的chart仓库

helm repo add cilium https://helm.cilium.io/
helm repo update

5. 定义配置，完成部署

cat > cilium-values.yaml << EOF
k8sServiceHost: 10.0.195.25
k8sServicePort: 6443
kubeProxyReplacement: strict
hostServices:
  enabled: false
nodePort:
  enabled: true
externalIPs:
  enabled: true
hostPort:
  enabled: true
encryption:
  enabled: false
  nodeEncryption: false
installIptablesRules: false
l7Proxy:
  enabled: false
pathMode: ipvlan
ipvlan:
  enabled: true
  masterDevice: eth0
tunnel: disabled
autoDirectNodeRoutes: true
nativeRoutingCIDR: 172.16.0.0/12
ipam:
  mode: "cluster-pool"
  operator:
    clusterPoolIPv4PodCIDR: "172.16.0.0/12"
    clusterPoolIPv4MaskSize: 24
hubble:
  metrics:
    enabled:
    - dns:query;ignoreAAAA
    - drop
    - tcp
    - flow
    - icmp
    - http
  relay:
    enabled: true
  ui:
    enabled: true
    replicas: 1
    ingress:
      enabled: true
      hosts:
        - hubble.onwalk.net
      annotations:
        kubernetes.io/ingress.class: nginx
      tls:
      - secretName: tls-ingress-hubble-ui
        hosts:
        - hubble.onwalk.net
EOF

helm upgrade --install cilium cilium/cilium \
     --version 1.10.3 \
     -n kube-system \
      -f cilium-values.yaml