首先我們新創一個GKE cluster來實驗 cilium吧。

export CLUSTER_NAME=test
export CLUSTER_ZONE=asia-east1

gcloud container clusters create $CLUSTER_NAME --image-type COS --num-nodes 3 --machine-type n1-standard-4 --zone $CLUSTER_ZONE

建好cluster後，我們要取的cluster 的 ip cidr

NATIVE_CIDR="$(gcloud container clusters describe "${CLUSTER_NAME}" --zone "${CLUSTER_ZONE}" --format 'value(clusterIpv4Cidr)')"
echo $NATIVE_CIDR

然後要確保使用的helm 3 官方文件有提到不支援helm 2了

helm repo add cilium https://helm.cilium.io/
helm install cilium cilium/cilium --version 1.12.2 \
  --namespace kube-system \
  --set nodeinit.enabled=true \
  --set nodeinit.reconfigureKubelet=true \
  --set nodeinit.removeCbrBridge=true \
  --set cni.binPath=/home/kubernetes/bin \
  --set gke.enabled=true \
  --set ipam.mode=kubernetes \
  --set ipv4NativeRoutingCIDR=$NATIVE_CIDR

裝好之後，我們必須把一些kube-system的pod重啟讓cilium來manage

kubectl get pods --all-namespaces -o custom-columns=NAMESPACE:.metadata.namespace,NAME:.metadata.name,HOSTNETWORK:.spec.hostNetwork --no-headers=true | grep '<none>' | awk '{print "-n "$1" "$2}' | xargs -L 1 -r kubectl delete pod
pod "event-exporter-gke-5479fd58c8-wbz7c" deleted
pod "konnectivity-agent-855c9647b8-9xrp8" deleted
pod "konnectivity-agent-855c9647b8-bkf2p" deleted
pod "konnectivity-agent-855c9647b8-gn2p6" deleted
pod "konnectivity-agent-855c9647b8-gwhfd" deleted
pod "konnectivity-agent-855c9647b8-njrmj" deleted
pod "konnectivity-agent-855c9647b8-shcrj" deleted
pod "konnectivity-agent-autoscaler-6dfb4f9cfb-8qszz" deleted
pod "kube-dns-autoscaler-f4d55555-7zzvn" deleted
pod "kube-dns-b99c7865d-ncwwg" deleted
pod "kube-dns-b99c7865d-rwsvf" deleted
pod "l7-default-backend-69fb9fd9f9-z65qh" deleted
pod "metrics-server-v0.4.5-788d9b568b-lrxm9" deleted

接下來我們可以下載cilium 的cli

CILIUM_CLI_VERSION=$(curl -s https://raw.githubusercontent.com/cilium/cilium-cli/master/stable.txt)
CLI_ARCH=amd64
if [ "$(uname -m)" = "arm64" ]; then CLI_ARCH=arm64; fi
curl -L --fail --remote-name-all https://github.com/cilium/cilium-cli/releases/download/${CILIUM_CLI_VERSION}/cilium-darwin-${CLI_ARCH}.tar.gz{,.sha256sum}
shasum -a 256 -c cilium-darwin-${CLI_ARCH}.tar.gz.sha256sum
sudo tar xzvfC cilium-darwin-${CLI_ARCH}.tar.gz /usr/local/bin
rm cilium-darwin-${CLI_ARCH}.tar.gz{,.sha256sum}

下載完就可以下指令看cilium的狀態了

cilium status --wait

另外也可以用下面這個指令測試

cilium connectivity test

到此cilium CNI已經裝好了，明天就來測試一下cilium service mesh吧