Cilium Service Mesh：eBPFベースのサイドカーレスサービスメッシュ構築・運用ガイド

# カーネルバージョン確認（5.10以上必須、6.1以上推奨）
uname -r

# eBPFサポート確認
cat /boot/config-$(uname -r) | grep CONFIG_BPF
# CONFIG_BPF=y
# CONFIG_BPF_SYSCALL=y
# CONFIG_BPF_JIT=y

# Cilium CLIインストール
CILIUM_CLI_VERSION=$(curl -s https://raw.githubusercontent.com/cilium/cilium-cli/main/stable.txt)
curl -L --fail --remote-name-all \
  https://github.com/cilium/cilium-cli/releases/download/${CILIUM_CLI_VERSION}/cilium-linux-amd64.tar.gz
sudo tar xzvf cilium-linux-amd64.tar.gz -C /usr/local/bin

# Helm repoの追加
helm repo add cilium https://helm.cilium.io/
helm repo update

# Cilium Service Meshインストール（kube-proxy置換 + サービスメッシュ有効化）
helm install cilium cilium/cilium --version 1.19.0 \
  --namespace kube-system \
  --set kubeProxyReplacement=true \
  --set k8sServiceHost="API_SERVER_IP" \
  --set k8sServicePort=6443 \
  --set envoyConfig.enabled=true \
  --set ingressController.enabled=true \
  --set ingressController.loadbalancerMode=shared \
  --set hubble.enabled=true \
  --set hubble.relay.enabled=true \
  --set hubble.ui.enabled=true \
  --set encryption.enabled=true \
  --set encryption.type=wireguard \
  --set authentication.mutual.spire.enabled=true \
  --set authentication.mutual.spire.install.enabled=true

# Cilium全体ステータス確認
cilium status --wait

# 期待される出力：
#     /¯¯\
#  /¯¯\__/¯¯\    Cilium:             OK
#  \__/¯¯\__/    Operator:           OK
#  /¯¯\__/¯¯\    Envoy DaemonSet:    OK
#  \__/¯¯\__/    Hubble Relay:       OK
#     \__/        ClusterMesh:        disabled
#                 SPIRE Server:       OK
#                 SPIRE Agent:        OK

# サービスメッシュ機能の確認
cilium config view | grep -E "envoy|mesh|mutual"

# 接続テスト（サービスメッシュを含む）
cilium connectivity test

# mtls-authentication-policy.yaml
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: require-mutual-auth
  namespace: production
spec:
  endpointSelector:
    matchLabels:
      app: payment-service
  ingress:
    - fromEndpoints:
        - matchLabels:
            app: order-service
      authentication:
        mode: required # mTLS認証必須
      toPorts:
        - ports:
            - port: '8080'
              protocol: TCP

# cluster-wide-mtls.yaml
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
  name: enforce-mtls-cluster-wide
spec:
  endpointSelector:
    matchExpressions:
      - key: io.kubernetes.pod.namespace
        operator: NotIn
        values:
          - kube-system
  ingress:
    - fromEndpoints:
        - {}
      authentication:
        mode: required

# SPIREに登録されたワークロードの確認
kubectl exec -n kube-system spire-server-0 -- \
  /opt/spire/bin/spire-server entry show

# mTLS認証ステータスの確認
cilium-dbg identity list | grep -i auth
hubble observe --namespace production --verdict DROPPED -o json | \
  jq 'select(.drop_reason_desc == "Authentication required")'

# l7-traffic-split.yaml
apiVersion: cilium.io/v2
kind: CiliumEnvoyConfig
metadata:
  name: api-traffic-split
  namespace: production
spec:
  services:
    - name: api-service
      namespace: production
  backendServices:
    - name: api-service-v1
      namespace: production
    - name: api-service-v2
      namespace: production
  resources:
    - '@type': type.googleapis.com/envoy.config.listener.v3.Listener
      name: api-listener
      filter_chains:
        - filters:
            - name: envoy.filters.network.http_connection_manager
              typed_config:
                '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
                stat_prefix: api-traffic
                route_config:
                  name: api-routes
                  virtual_hosts:
                    - name: api-host
                      domains: ['*']
                      routes:
                        - match:
                            prefix: '/'
                            headers:
                              - name: 'x-canary'
                                exact_match: 'true'
                          route:
                            cluster: 'production/api-service-v2'
                        - match:
                            prefix: '/'
                          route:
                            weighted_clusters:
                              clusters:
                                - name: 'production/api-service-v1'
                                  weight: 90
                                - name: 'production/api-service-v2'
                                  weight: 10
                http_filters:
                  - name: envoy.filters.http.router
                    typed_config:
                      '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router

# l4-lb-policy.yaml
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: backend-l4-policy
  namespace: production
spec:
  endpointSelector:
    matchLabels:
      app: backend-service
  ingress:
    - fromEndpoints:
        - matchLabels:
            app: api-gateway
      toPorts:
        - ports:
            - port: '8080'
              protocol: TCP
            - port: '9090'
              protocol: TCP
  egress:
    - toEndpoints:
        - matchLabels:
            app: database
      toPorts:
        - ports:
            - port: '5432'
              protocol: TCP
    - toEndpoints:
        - matchLabels:
            app: cache
      toPorts:
        - ports:
            - port: '6379'
              protocol: TCP

# l7-rate-limiting.yaml
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: api-l7-with-ratelimit
  namespace: production
spec:
  endpointSelector:
    matchLabels:
      app: public-api
  ingress:
    - fromEndpoints:
        - matchLabels:
            app: frontend
      toPorts:
        - ports:
            - port: '8080'
              protocol: TCP
          rules:
            http:
              - method: GET
                path: '/api/v1/products.*'
              - method: GET
                path: '/api/v1/categories.*'
              - method: POST
                path: '/api/v1/orders'
                headers:
                  - 'Content-Type: application/json'

# fortioを使った性能測定
kubectl run fortio-client --rm -it --image=fortio/fortio -- \
  load -c 50 -qps 1000 -t 60s -json - \
  http://api-service.production:8080/api/v1/health

# 分析のポイント：
# - P50、P90、P99レイテンシ
# - 最大QPS（Queries Per Second）
# - エラー率
# - CPU/メモリ使用量（kubectl top podsで別途測定）

# HubbleメトリクスでL7レイテンシを確認
hubble observe --namespace production --protocol http -o json | \
  jq '.l7.latency_ns / 1000000'

# 認証失敗トラフィックの確認
hubble observe --namespace production --verdict DROPPED -o compact

# SPIREエージェントステータスの確認
kubectl get pods -n kube-system -l app=spire-agent
kubectl logs -n kube-system -l app=spire-agent --tail=50

# 特定ワークロードのSVID（証明書）ステータス確認
kubectl exec -n kube-system spire-server-0 -- \
  /opt/spire/bin/spire-server entry show -selector k8s:ns:production

# Ciliumエンドポイントの認証ステータス確認
kubectl exec -n kube-system ds/cilium -- \
  cilium-dbg endpoint list -o json | jq '.[].status.policy.realized.auth'

# Envoy DaemonSetステータスの確認
kubectl get ds -n kube-system cilium-envoy
kubectl describe ds -n kube-system cilium-envoy

# 特定ノードのEnvoyログ確認
kubectl logs -n kube-system -l k8s-app=cilium-envoy --tail=100

# Cilium AgentとEnvoy間の接続確認
kubectl exec -n kube-system ds/cilium -- \
  cilium-dbg status --verbose | grep -A5 "Envoy"

# CiliumEnvoyConfigステータスの確認
kubectl get cec -n production -o yaml

# Cilium Agentローリングリスタートステータスの確認
kubectl rollout status ds/cilium -n kube-system

# eBPFマップ同期ステータスの確認
kubectl exec -n kube-system ds/cilium -- \
  cilium-dbg bpf endpoint list

# エンドポイント復旧待ち
kubectl exec -n kube-system ds/cilium -- \
  cilium-dbg endpoint list | grep -v ready

# Hubble Relayステータスの確認
kubectl get pods -n kube-system -l k8s-app=hubble-relay
kubectl logs -n kube-system -l k8s-app=hubble-relay --tail=50

# Hubble接続テスト
cilium hubble port-forward &
hubble status

# Cilium AgentのHubbleモニタリングステータス
kubectl exec -n kube-system ds/cilium -- \
  cilium-dbg monitor --type drop --type trace

# ネームスペースごとにIstioサイドカー注入を無効化
kubectl label namespace staging istio-injection-
kubectl rollout restart deployment -n staging

# Cilium mTLSポリシーの適用
kubectl apply -f cilium-mtls-policy-staging.yaml

# 切り替え後の確認
hubble observe --namespace staging --protocol http

# Prometheusで収集すべき主要メトリクス

# 1. Cilium Agentステータス
# cilium_agent_api_process_time_seconds - API処理時間
# cilium_agent_bootstrap_seconds - Agent起動時間
# cilium_bpf_map_ops_total - BPFマップ操作数

# 2. サービスメッシュ関連
# cilium_proxy_upstream_reply_seconds - L7プロキシアップストリーム応答時間
# cilium_proxy_redirects - L7プロキシにリダイレクトされた接続数
# cilium_auth_map_entries - mTLS認証マップエントリ数

# 3. Hubbleオブザーバビリティ
# hubble_flows_processed_total - 処理済みフロー数
# hubble_tcp_flags_total - TCPフラグ別カウント

# Grafanaダッシュボードのインポート
# Cilium公式ダッシュボード：https://grafana.com/grafana/dashboards/16611