terraform-provider-libvirt VS cilium

libvirt-terraform-provider ( based on https://github.com/dmacvicar/terraform-provider-libvirt )

Hi guys!I wanted to allotment with you a tool to provision a fully working OCP 4.x.y cluster in minutes using Ansible for automation, libvirt as virtualization provider and terraform as VMs templating and creation tool. https://github.com/kubealex/libvirt-ocp4-provisioner It will take care of all the infrastructure provisioning and OCP machines provisioning, starting and completing the UPI installation of a cluster. (IPI work in progress ;) ) To give a quick overview, this project will allow you to provision a fully working OCP stable environment, consisting of: * Bastion machine provisioned with: * dnsmasq (with SELinux module, compiled and activated) * dhcp based on dnsmasq * nginx (for ignition files and rhcos pxe-boot) * pxeboot * Loadbalancer machine provisioned with: * haproxy * OCP Bootstrap machine * OCP Master(s) VM(s) * OCP Worker(s) VM(s) From latest release, it also supports installing SNO on a single host! It also takes care of preparing the host machine with needed packages, configuring: * dedicated libvirt network (fully customizable) * dedicated libvirt storage pool (fully customizable) * terraform * libvirt-terraform-provider ( compiled and initialized based‏‏‎‏‏‎‏‏‎‏‏‎­on https://github.com/dmacvicar/terraform-provider-libvirt) PXE is automatic, based on MAC binding to different OCP nodes role, so no need of choosing it from the menus, this means you can just run the playbook, take a beer and have your fully running OCP 4.9.latest stable up and running. It has been tested on Fedora 3x and CentOS 7/8. Playing around with it and contributions to make it work even on different OSes is more than welcome, hope you enjoy it! Alex

I learned and got terraform to work with the KVM/Libvirt provider.

I saw Terraform with the dmacvicar/terraform-provider-libvirt provider, but sadly didn't get really warm with it. When some can explain to me how I can set up new images for every VM I would be very happy also there are more question in the pipeline. Sadly, the “Documentation” is not really that good. Maybe Terraform is also the wrong Application for me. I'm a little lost because I thought Terraform would be the big Solution I want and need, until now, not yet.

It looks like there was an issue dealing with "attaching an existing disk" to a terraform created VM. That's here: https://github.com/dmacvicar/terraform-provider-libvirt/issues/688

Nice. I’m straight KVM as it’s a mirror of work (my Lab) and I’m using the terraform-provider-libvirt provider. 20 minutes to fully build a site. Pretty cool.

libvirt-terraform-provider ( compiled and initialized based on https://github.com/dmacvicar/terraform-provider-libvirt)

They would have had to add a few externals to get to Graduated but it's definitely a minority:

https://github.com/cilium/cilium/blob/main/MAINTAINERS.md

Next-gen networking thanks to Cilium

Hello there, I recently have the need to proxy my pod traffic through WireGuard. I initially have my eyes on https://github.com/angelnu/pod-gateway but I just couldn't get it working. It turns out that Cilium made a CVE patch couple years ago that basically nuked ability to do inter-pod encapsulated traffic (https://github.com/cilium/cilium/issues/15991). I wonder if there is any other way that can let me do this without switching out of Cilium? Thank you guys in advance :)

I have used Cilium as CNI and installing it with helm.

I'm using the default RaspiOS Lite 64bits and as highlighted in this issue, the RaspiOS kernel does not support CONFIG_ARM64_VA_BITS_48, which makes cilium-envoy to fail building. As solution, I was told to use either Ubuntu as base OS or Traefik Ingress Controller, which is not configured in K3s.

Working on integrating cilium and loxilb as a hobby k8s project. Both are eBPF based and will be interesting to see what will be the final outcome.

Particularly in Cilium, Gateway API is very proof-of-concept. So much so that you can't even change the type of the underlying service (or anything else about the generated object) yet.

Authentication using mTLS was later merged into cilium (https://github.com/cilium/cilium/pull/24263). It uses mTLS between cilium agents to authorize flows, but do note that the mTLS auth is de-coupled from the datapath transport (i.e. you need to configure cilium to use ipsec or wireguard, as otherwise traffic won't be encrypted). As a consequence, there are some gaps in the implementation right now, like packet drops. see https://github.com/cilium/cilium/issues/23808

network plugin to be used, based on the documentation. (Project Calico ,Flannel, Cilium )