There is no shortage of approaches to securely connecting different services in the cloud. For a growing number of organizations the best approach is to use the open source Cilium technology.

Cilium got its start in 2015 and has been steadily growing its usage and capabilities in the years since. At the CiliumCon conference this week in Amsterdam –  co-located with the Cloud Native Computing Foundation (CNCF's) Kubecon conference (and streamed virtually) – advocates and users of Cilium including IKEA, the New York Times and Bloomberg, outlined the history, use cases and future direction for the open source networking technology.  Cilium is an open source project hosted by the CNCF that benefits from the contributions of multiple vendors and has commercial support from startup Isovalent (formerly known as Covalent).

"Cilium is an eBPF(extended Berkeley Packet Filter) based networking security and observability technology that is widely deployed today and we're a CNCF project," Thomas Graf, founder of Cilium and CTO of Isovalent said during a CiliumCon session. "In the beginning when we started Cilium, we really focused on the core networking problem of Kubernetes networking on all the cloud providers as well as on premises."

The eBPF technology is part of the Linux operating system and provides a programmable interface that Cilium uses to enable cloud native networking as well as a host of other capabilities.

[caption id="attachment_128848" align="alignnone" width="624"] Cilium founder Thomas Graf[/caption]

In the modern world, simply moving data packets from one location to another isn't enough. Graf noted that the Cilium project realized that fact early on and added network policy, network segmentation as well as transparent encryption. Cilium also provides observability via its Hubble project that can provide insight into logs and metrics for network and application performance.

The project has also added a series of mesh capabilities for connecting different environments together. With the Cluster Mesh capability, Cilium supports the ability to connect multiple Kubernetes clusters together. Going a step further, the Cilium Mesh project provides a service mesh capability, enabling advanced microservices traffic managed in Kubernetes deployments. Rounding out the extensive set of capabilities that Cilium already has is Tetragon, which provides security for Cilium connected deployments.

While a lot has been done to enable Cilium to date, Graf said that there is more coming. New features will include integration with the SPIFFE (Secure Production Identity Framework for Everyone) open source project for identity management. There will also be a focus on improving the day-to-day operations of Cilium-based networking deployment.

A big push in 2023 will also be to extend the Cilium Mesh capability to be able to support more than just Kubernetes, but also to be able to run in virtual machines and even regular servers.

Among the users that spoke at CiliumCon was Karsten Nielsen, senior digital technology engineer at global retailer Ikea .

Ikea uses Cilium as part of its cloud native networking infrastructure that helps to support its operations as well as its Ikea.com online platform. Cilium provides a series of capabilities including load balancing, security policies and observability that IKEA relies on.

[caption id="attachment_128847" align="alignnone" width="624"] Ikea’s how-to-build-with-Cilium manual[/caption]

"Networking is one of the key things you have to get right," NIelsen said. "If you cannot get the bits across the wire then what's the point?"

Ahmed Bebars, staff software engineer at the New York Times also spoke at CiliumCon about his organization's use of Cilium. The New York Times runs Kubernetes clusters across multiple regions to help ensure availability and for disaster recovery. Cilium fills a critical role by being the networking tool to support the Kubernetes network, with the right amount of security and observability.

"Observability is very important to us to understand all of the traffic that we get from our clusters and platform end to end," Bebars said.

At financial service giant Bloomberg, Cilium is also playing a strong role as part of the company's  BQuant Bloomberg's quant analytics platform. Anne Zepecki, engineering team lead at Bloomberg explained that her team uses Cilium as its container networking interface.

She explained that Bloomberg wanted to have host based policies to be able to control what clients are able to access in an approach she referred to as a data sandbox. Using the network control policies in Cilium, Bloomberg has been able to build out its data sandbox.

Observability is also a key attribute for Bloomberg. Zepecki said that  Cilium Hubble  provides a lot of observability which is helpful for several reasons. Hubble provides  application and network visibility and she noted it's also a beneficial learning tool for people on the Bloomberg team to be able to see the network flows and  what's happening with the traffic as it's coming in and out of workloads.

For new users to Cilium, Zepecki suggests that they not be afraid to start with small projects and expand usage over time.

"Don't be afraid to start small and keep building out which I think is a kind of a good attitude that already exists within the open source community as well,” she said.