From c1971aa30b6c64a3335a16981bb151923f272f3d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=A9r=C3=B4me=20Petazzoni?= Date: Mon, 8 Jun 2026 15:33:00 +0200 Subject: [PATCH] =?UTF-8?q?=F0=9F=8F=AD=EF=B8=8F=20Replace=20Weave=20with?= =?UTF-8?q?=20Cilium?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Initially we were using Weave because it was super easy to install (single kubectl apply -f command), but we now have multiple problems: - it is not maintained anymore - its network policy controller seems to have subtle bugs (I had multiple classes in 2026 where we ran into policies that didn't work as intended, but worked fine when trying on another cluster that used Cilium) - it doesn't support IPV6 We did a test run with Cilium on a few IPv6-only clusters. It worked fine. Then a test run on dual stack clusters. Now we're using Cilium on all kubeadm clusters (removing support for Weave) and we've updated all materials to either remove or update mentions to Weave. --- prepare-labs/lib/commands.sh | 71 +++++++++++++++++++++--------------- slides/k8s/cni.md | 2 +- slides/k8s/daemonset.md | 4 +- slides/k8s/kubectlget.md | 6 +-- slides/k8s/logs-cli.md | 6 +-- slides/k8s/netpol.md | 4 +- slides/k8s/setup-managed.md | 6 +-- slides/k8s/setup-overview.md | 2 +- 8 files changed, 58 insertions(+), 43 deletions(-) diff --git a/prepare-labs/lib/commands.sh b/prepare-labs/lib/commands.sh index 3e1546ba..178ef164 100644 --- a/prepare-labs/lib/commands.sh +++ b/prepare-labs/lib/commands.sh @@ -602,18 +602,41 @@ _cmd_kubeadm() { # Initialize kube control plane pssh --timeout 200 " - IPV6=\$(ip -json a | jq -r '.[].addr_info[] | select(.scope==\"global\" and .family==\"inet6\") | .local' | head -n1) - if [ \"\$IPV6\" ]; then - ADVERTISE=\"advertiseAddress: \$IPV6\" - SERVICE_SUBNET=\"serviceSubnet: fdff::/112\" - touch /tmp/install-cilium-ipv6-only - touch /tmp/ipv6-only + IPV4=\$(ip -json route get 1.1.1.1 | jq -r .[0].prefsrc) + IPV6=\$(ip -json route get 2600:: | jq -r .[0].prefsrc) + if [ \"\$IPV4\" ] && [ \"\$IPV6\" ]; then + KUBEADM_ADVERTISE= + SERVICE_SUBNET=10.96.0.0/12,fdff::/112 + CILIUM_IPV6_ENABLED=true + CILIUM_IPV4_ENABLED=true + CILIUM_UNDERLAYPROTOCOL=ipv4 + elif [ \"\$IPV6\" ]; then + KUBEADM_ADVERTISE=\"advertiseAddress: \$IPV6\" + SERVICE_SUBNET=fdff::/112 + CILIUM_IPV6_ENABLED=true + CILIUM_IPV4_ENABLED=false + CILIUM_UNDERLAYPROTOCOL=ipv6 + # Hack to skip krew and ngrok install + # (krew is broken on IPV6-only hosts, as it relies on GitHub) + sudo -u $USER_LOGIN mkdir /home/$USER_LOGIN/.krew + # (in 2025, Ngrok didn't install cleanly on IPV6-only hosts) + sudo ln -s /bin/false /usr/local/bin/ngrok else - ADVERTISE= - SERVICE_SUBNET= - touch /tmp/install-weave + KUBEADM_ADVERTISE= + KUBEADM_SERVICE_SUBNET=10.96.0.0/12 + CILIUM_IPV6_ENABLED=false + CILIUM_IPV4_ENABLED=true + CILIUM_UNDERLAYPROTOCOL=ipv4 fi - echo IPV6=\$IPV6 ADVERTISE=\$ADVERTISE + cat >/tmp/cilium.yaml < /tmp/token && cat >/tmp/kubeadm-config.yaml < diff --git a/slides/k8s/netpol.md b/slides/k8s/netpol.md index 2d4a1ae9..a64b1b9d 100644 --- a/slides/k8s/netpol.md +++ b/slides/k8s/netpol.md @@ -240,7 +240,9 @@ The second command will fail and time out after 3 seconds. - For instance, Weave added support for egress rules [in version 2.4](https://github.com/weaveworks/weave/pull/3313) (released in July 2018) -- But only recently added support for ipBlock [in version 2.5](https://github.com/weaveworks/weave/pull/3367) (released in Nov 2018) +- And added support for ipBlock [in version 2.5](https://github.com/weaveworks/weave/pull/3367) (released in Nov 2018) + +- Before 2023, AWS EKS didn't install a network policy controller at all - Unsupported features might be silently ignored diff --git a/slides/k8s/setup-managed.md b/slides/k8s/setup-managed.md index d2793bc9..58b506da 100644 --- a/slides/k8s/setup-managed.md +++ b/slides/k8s/setup-managed.md @@ -367,11 +367,11 @@ class: extra-details - To see available versions and CNI plugins, run `scw k8s version list` -- As of May 2020, Kapsule supports: +- As of May 2026, Kapsule supports: - - multiple CNI plugins, including: cilium, calico, weave, flannel + - multiple CNI plugins, including: calico, cilium, kilo - - Kubernetes versions 1.15 to 1.18 + - Kubernetes versions 1.32 to 1.35 - multiple container runtimes, including: Docker, containerd, CRI-O diff --git a/slides/k8s/setup-overview.md b/slides/k8s/setup-overview.md index a6edc313..16f27f3d 100644 --- a/slides/k8s/setup-overview.md +++ b/slides/k8s/setup-overview.md @@ -293,7 +293,7 @@ Don't hesitate to hire help before going to production with your first K8S app! 3. Run `kubeadm init` on the first node (it deploys the control plane on that node) - 4. Set up Weave (the overlay network) with a single `kubectl apply` command + 4. Set up Cilium (the overlay network) with a single `helm install` command 5. Run `kubeadm join` on the other nodes (with the token produced by `kubeadm init`)