opencost VS cilium

OpenCost is an open source implementation for Kubernetes cost monitoring and now cloud cost monitoring for AWS, Azure, and GCP. The project makes all of this data accessible via an API and user interface. While discussing the idea of running OpenCost on platforms besides Kubernetes we realized that with this new Cloud Costs feature there are users who want API access to their cloud billing data without needing to run on Kubernetes. I opened the Issue OpenCost without Kubernetes #2268 and as luck would have it, we had our internal Hackathon last week.

If you're not familiar with OpenCost, it's the open source CNCF project for monitoring Kubernetes and cloud spending. It's a Golang implementation of the OpenCost Specification for monitoring Kubernetes cloud costs. It has an optional web UI and you can also run it as a Prometheus metrics exporter. The code is all at https://github.com/opencost/opencost and you can learn more about the project at https://opencost.io

Original from source

OpenCost is an open source Cloud Native Computing Foundation project that provides monitoring for Kubernetes' cloud costs. We support AWS, Azure, GCP, and a few others. Always happy to help you get started, head to opencost.io and join us in #opencost on the CNCF Slack.

Here's the spec in case interested: https://github.com/kubecost/opencost/tree/develop/spec

They would have had to add a few externals to get to Graduated but it's definitely a minority:

https://github.com/cilium/cilium/blob/main/MAINTAINERS.md

Next-gen networking thanks to Cilium

Hello there, I recently have the need to proxy my pod traffic through WireGuard. I initially have my eyes on https://github.com/angelnu/pod-gateway but I just couldn't get it working. It turns out that Cilium made a CVE patch couple years ago that basically nuked ability to do inter-pod encapsulated traffic (https://github.com/cilium/cilium/issues/15991). I wonder if there is any other way that can let me do this without switching out of Cilium? Thank you guys in advance :)

I have used Cilium as CNI and installing it with helm.

I'm using the default RaspiOS Lite 64bits and as highlighted in this issue, the RaspiOS kernel does not support CONFIG_ARM64_VA_BITS_48, which makes cilium-envoy to fail building. As solution, I was told to use either Ubuntu as base OS or Traefik Ingress Controller, which is not configured in K3s.

Working on integrating cilium and loxilb as a hobby k8s project. Both are eBPF based and will be interesting to see what will be the final outcome.

Particularly in Cilium, Gateway API is very proof-of-concept. So much so that you can't even change the type of the underlying service (or anything else about the generated object) yet.

Authentication using mTLS was later merged into cilium (https://github.com/cilium/cilium/pull/24263). It uses mTLS between cilium agents to authorize flows, but do note that the mTLS auth is de-coupled from the datapath transport (i.e. you need to configure cilium to use ipsec or wireguard, as otherwise traffic won't be encrypted). As a consequence, there are some gaps in the implementation right now, like packet drops. see https://github.com/cilium/cilium/issues/23808

network plugin to be used, based on the documentation. (Project Calico ,Flannel, Cilium )