با استفاده از Cilium no WSL – DEV Community

sudo apt update && sudo apt install build-essential flex bison libssl-dev libelf-dev bc python3 pahole

## baixando do repositorio
git clone --depth 1 --branch linux-6.8.y https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
### Entre na pasta
cd linux

wget https://raw.githubusercontent.com/microsoft/WSL2-Linux-Kernel/linux-msft-wsl-6.1.y/arch/x86/configs/config-wsl -O .config

sed -i 's/microsoft-standard-WSL2/generic/' ./.config

## linux/cilium_modules
## Base requirements
CONFIG_BPF=y
CONFIG_BPF_SYSCALL=y
CONFIG_NET_CLS_BPF=y
CONFIG_BPF_JIT=y
CONFIG_NET_CLS_ACT=y
CONFIG_NET_SCH_INGRESS=y
CONFIG_CRYPTO_SHA1=y
CONFIG_CRYPTO_USER_API_HASH=y
CONFIG_CGROUPS=y
CONFIG_CGROUP_BPF=y

## Iptables-based Masquerading
CONFIG_NETFILTER_XT_SET=m
CONFIG_IP_SET=m
CONFIG_IP_SET_HASH_IP=m

## L7 and FQDN Policies
CONFIG_NETFILTER_XT_TARGET_TPROXY=m
CONFIG_NETFILTER_XT_TARGET_CT=m
CONFIG_NETFILTER_XT_MATCH_MARK=m
CONFIG_NETFILTER_XT_MATCH_SOCKET=m

## IPsec
CONFIG_XFRM=y
CONFIG_XFRM_OFFLOAD=y
CONFIG_XFRM_STATISTICS=y
CONFIG_XFRM_ALGO=m
CONFIG_XFRM_USER=m
CONFIG_INET_ESP=m
CONFIG_INET_IPCOMP=m
CONFIG_INET_XFRM_TUNNEL=m
CONFIG_INET_TUNNEL=m
CONFIG_INET6_ESP=m
CONFIG_INET6_IPCOMP=m
CONFIG_INET6_XFRM_TUNNEL=m
CONFIG_INET6_TUNNEL=m
CONFIG_INET_XFRM_MODE_TUNNEL=m
CONFIG_CRYPTO_AEAD=m
CONFIG_CRYPTO_AEAD2=m
CONFIG_CRYPTO_GCM=m
CONFIG_CRYPTO_SEQIV=m
CONFIG_CRYPTO_CBC=m
CONFIG_CRYPTO_HMAC=m
CONFIG_CRYPTO_SHA256=m
CONFIG_CRYPTO_AES=m

import re
# Lê o conteúdo do arquivo 'cilium_modules
config_replacements = {}
with open('cilium_modules', 'r', encoding='utf-8') as file1:
    for line in file1:
        line = line.strip()
        # Ignora linhas vazias e comentários
        if not line or line.startswith('##'):
            continue
        key, value = line.split('=')
        config_replacements[key] = value
# Lê o conteúdo do arquivo '.config'
with open('.config', 'r') as file2:
    file2_lines = file2.readlines() 
# Mantém um conjunto para controle das chaves que foram atualizadas
updated_keys = set()
# Substitui linhas correspondentes em '.config'
with open('.config', 'w', encoding='utf-8') as file2:
    for line in file2_lines:
        # Verifica se a linha contém alguma chave de 'cilium_modules' usando regex
        for key, value in config_replacements.items():
            if re.search(r'\b' + re.escape(key) + r'\b', line):
                # Se a linha estiver comentada, remove o símbolo de comentário e atualiza
                if line.startswith('# ' + key):
                    line = f"{key}={value}\n"
                # Atualiza o valor da linha
                elif re.search(r'^\s*' + re.escape(key) + r'\b', line):
                    line = f"{key}={value}\n"
                updated_keys.add(key)
                break
        file2.write(line)
    # Adiciona as chaves que não foram encontradas ao '.config'
    for key, value in config_replacements.items():
        if key not in updated_keys:
            file2.write(f"{key}={value}\n")

python3 enable_conf.py

make -j $(nproc)

sudo make modules_install

mkdir /mnt/c/wslkernel

cp arch/x86/boot/bzImage /mnt/c/wslkernel/kernelcilium

[wsl2]
kernel = C:\\wslkernel\\kernelnoble

wsl --shutdown

uname -r

awk '(NR>1) { print $2 }' /usr/lib/modules/$(uname -r)/modules.alias | sudo tee /etc/modules-load.d/cilium.conf

sudo systemctl daemon-reload

sudo systemctl restart systemd-modules-load

$cris /kind ❱❱ sudo systemctl status systemd-modules-load
● systemd-modules-load.service - Load Kernel Modules
     Loaded: loaded (/usr/lib/systemd/system/systemd-modules-load.service; static)
     Active: active (exited) since Tue 2024-06-11 11:23:40 -03; 4h 59min ago
       Docs: man:systemd-modules-load.service(8)
             man:modules-load.d(5)
    Process: 56 ExecStart=/usr/lib/systemd/systemd-modules-load (code=exited, status=0/SUCCESS)
   Main PID: 56 (code=exited, status=0/SUCCESS)

Notice: journal has been rotated since unit was started, output may be incomplete.
$cris /kind ❱❱ lsmod
Module                  Size  Used by
ipcomp6                12288  0
xfrm6_tunnel           12288  1 ipcomp6
tunnel6                12288  1 xfrm6_tunnel
esp6                   24576  0
xfrm_user              53248  4
xfrm4_tunnel           12288  0
ipcomp                 12288  0
xfrm_ipcomp            12288  2 ipcomp6,ipcomp
esp4                   24576  0
xfrm_algo              16384  4 esp6,esp4,xfrm_ipcomp,xfrm_user
ip_set_hash_netportnet    49152  0
ip_set_hash_netnet     49152  0
ip_set_hash_netiface    45056  0
ip_set_hash_netport    45056  0
ip_set_hash_net        45056  0
ip_set_hash_mac        24576  0
ip_set_hash_ipportnet    45056  0
ip_set_hash_ipportip    40960  0
ip_set_hash_ipport     40960  0
ip_set_hash_ipmark     40960  0
ip_set_hash_ipmac      40960  0
....

kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
nodes:
- role: control-plane
  extraPortMappings:
  # localhost.run proxy
  - containerPort: 32042
    hostPort: 32042
  # Hubble relay
  - containerPort: 31234
    hostPort: 31234
  # Hubble UI
  - containerPort: 31235
    hostPort: 31235
- role: worker
- role: worker
networking:
  disableDefaultCNI: true
  kubeProxyMode: "none"

## Baixando
aria2c https://github.com/cilium/cilium-cli/releases/download/v0.16.10/cilium-windows-amd64.zip

## descompactando
unzip.exe .\cilium-windows-amd64.zip

{
  "bin": "cilium.exe",
  "version": "v0.16.10",
  "url": https://github.com/cilium/ciliumcli/releases/download/v0.16.10/cilium-windows-amd64.zip"
}

scoop install cilium.json

cilium install

$cris /kind ❱❱ cilium install
🔮 Auto-detected Kubernetes kind: kind
✨ Running "kind" validation checks
✅ Detected kind version "0.23.0"
ℹ️  Using Cilium version 1.15.5
🔮 Auto-detected cluster name: kind-kind
ℹ️  Detecting real Kubernetes API server addr and port on Kind
🔮 Auto-detected kube-proxy has not been installed
ℹ️  Cilium will fully replace all functionalities of kube-proxy

cris /kind ❱❱ cilium status
    /¯¯\
 /¯¯\__/¯¯\    Cilium:             OK
 \__/¯¯\__/    Operator:           OK
 /¯¯\__/¯¯\    Envoy DaemonSet:    disabled (using embedded mode)
 \__/¯¯\__/    Hubble Relay:       disabled
    \__/       ClusterMesh:        disabled

Deployment             cilium-operator    Desired: 1, Ready: 1/1, Available: 1/1
DaemonSet              cilium             Desired: 3, Ready: 3/3, Available: 3/3
Containers:            cilium             Running: 3
                       cilium-operator    Running: 1
Cluster Pods:          3/3 managed by Cilium
Helm chart version:
Image versions         cilium             quay.io/cilium/cilium:v1.15.5@sha256:4ce1666a73815101ec9a4d360af6c5b7f1193ab00d89b7124f8505dee147ca40: 3
                       cilium-operator    quay.io/cilium/operator-generic:v1.15.5@sha256:f5d3d19754074ca052be6aac5d1ffb1de1eb5f2d947222b5f10f6d97ad4383e8: 1

$cris /kind ❱❱ k get daemonsets -n kube-system
Events:
  Type    Reason            Age    From                  Message
  ----    ------            ----   ----                  -------
  Normal  SuccessfulCreate  6m47s  daemonset-controller  Created pod: cilium-c74rc
  Normal  SuccessfulCreate  6m47s  daemonset-controller  Created pod: cilium-b7rrn
  Normal  SuccessfulCreate  6m47s  daemonset-controller  Created pod: cilium-wmxlx

k get pods -l k8s-app=cilium -n kube-**system**
k logs -l k8s-app=cilium -n kube-system

sudo modprobe xt_TPROXY

k apply -f https://raw.githubusercontent.com/cilium/cilium/HEAD/examples/minikube/http-sw-app.yaml

$cris /kind ❱❱ k get pod,deploy,svc
NAME                             READY   STATUS    RESTARTS   AGE
pod/deathstar-689f66b57d-9c92f   1/1     Running   0          29m
pod/deathstar-689f66b57d-b4ps7   1/1     Running   0          29m
pod/tiefighter                   1/1     Running   0          29m
pod/xwing                        1/1     Running   0          29m

NAME                        READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/deathstar   2/2     2            2           29m

NAME                 TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)   AGE
service/deathstar    ClusterIP   10.96.120.87   <none>        80/TCP    29m
service/kubernetes   ClusterIP   10.96.0.1      <none>        443/TCP   130m

k exec tiefighter -- curl -s -XPOST deathstar.default.svc.cluster.local/v1/request-landing

k exec xwing -- curl -s -XPOST deathstar.default.svc.cluster.local/v1/request-landing

apiVersion: "cilium.io/v2"
kind: CiliumNetworkPolicy
metadata:
  name: "rule1"
spec:
  description: "L3-L4 policy to restrict deathstar access to empire ships only"
  # definindo o pod que vai receber a requisição (No caso a DeathStar)
  endpointSelector:
    matchLabels:
      org: empire
      class: deathstar
  ingress:
  # definindo a origem da conexão, somente permitindo o pod com o label org = empire de acessar na porta 80.
  - fromEndpoints:
    - matchLabels:
        org: empire
    toPorts:  
    - ports:
      - port: "80"
        protocol: TCP

k apply -f https://raw.githubusercontent.com/cilium/cilium/HEAD/examples/minikube/sw_l3_l4_policy.yaml

k exec xwing  -- curl -s -XPOST deathstar.default.svc.cluster.local/v1/request-landing

k exec tiefighter -- curl -s -XPOST deathstar.default.svc.cluster.local/v1/request-landing

$cris /kind ❱❱ k exec tiefighter -- curl -s -get deathstar.default.svc.cluster.local/v1
{
        "name": "Death Star",
        "hostname": "deathstar-689f66b57d-9c92f",
        "model": "DS-1 Orbital Battle Station",
        "manufacturer": "Imperial Department of Military Research, Sienar Fleet Systems",
        "cost_in_credits": "1000000000000",
        "length": "120000",
        "crew": "342953",
        "passengers": "843342",
        "cargo_capacity": "1000000000000",
        "hyperdrive_rating": "4.0",
        "starship_class": "Deep Space Mobile Battlestation",
        "api": [
                "GET   /v1",
                "GET   /v1/healthz",
                "POST  /v1/request-landing",
                "PUT   /v1/cargobay",
                "GET   /v1/hyper-matter-reactor/status",
                "PUT   /v1/exhaust-port"
        ]
}

apiVersion: "cilium.io/v2"
kind: CiliumNetworkPolicy
metadata:
  name: "rule1"
spec:
  description: "L7 policy to restrict access to specific HTTP call"
  endpointSelector:
    matchLabels:
      org: empire
      class: deathstar
  ingress:
  - fromEndpoints:
    - matchLabels:
        org: empire
    toPorts:
    - ports:
      - port: "80"
        protocol: TCP
      rules:
        http:
        - method: "POST"
          path: "/v1/request-landing"

$cris /kind ❱❱ k exec tiefighter -- curl -s -XPUT deathstar.default.svc.cluster.local/v1/exhaust-port
Panic: deathstar exploded

goroutine 1 [running]:
main.HandleGarbage(0x2080c3f50, 0x2, 0x4, 0x425c0, 0x5, 0xa)
        /code/src/github.com/empire/deathstar/
        temp/main.go:9 +0x64
main.main()
        /code/src/github.com/empire/deathstar/
        temp/main.go:5 +0x85

k apply -f https://raw.githubusercontent.com/cilium/cilium/HEAD/examples/minikube/sw_l3_l4_l7_policy.yaml

k exec tiefighter -- curl -s -XPOST deathstar.default.svc.cluster.local/v1/request-landing

k exec tiefighter -- curl -s -XPUT deathstar.default.svc.cluster.local/v1/exhaust-port

$cris /kind ❱❱ k exec tiefighter -- curl -s -XPOST deathstar.default.svc.cluster.local/v1/request-landing
Ship landed

$cris /kind ❱❱ k exec tiefighter -- curl -s -XPUT deathstar.default.svc.cluster.local/v1/exhaust-port
Access denied