Install and configure Cilium CNI for Kubernetes with eBPF networking and security policies

#!/usr/bin/env bash
set -euo pipefail

# Cilium CNI Installation Script for Kubernetes
# Supports Ubuntu, Debian, AlmaLinux, Rocky Linux, CentOS, RHEL, Fedora

# Colors for output
readonly RED='\033[0;31m'
readonly GREEN='\033[0;32m'
readonly YELLOW='\033[1;33m'
readonly NC='\033[0m' # No Color

# Default values
K8S_SERVICE_HOST=""
K8S_SERVICE_PORT="6443"
CILIUM_VERSION="1.15.1"
CLEANUP_EXISTING_CNI=false

# Usage function
usage() {
    cat << EOF
Usage: $0 -a <api-server-ip> [OPTIONS]

Required:
  -a, --api-server    Kubernetes API server IP address

Options:
  -p, --port          Kubernetes API server port (default: 6443)
  -v, --version       Cilium version (default: 1.15.1)
  -c, --cleanup       Remove existing CNI plugins (default: false)
  -h, --help          Show this help message

Example:
  $0 -a 192.168.1.100 -p 6443 -c
EOF
    exit 1
}

# Logging functions
log_info() { echo -e "${GREEN}[INFO]${NC} $1"; }
log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
log_error() { echo -e "${RED}[ERROR]${NC} $1"; }

# Error handling and cleanup
cleanup_on_error() {
    local exit_code=$?
    if [ $exit_code -ne 0 ]; then
        log_error "Installation failed. Cleaning up..."
        rm -f /tmp/cilium-linux-amd64.tar.gz* /tmp/hubble-linux-amd64.tar.gz*
        if command -v cilium >/dev/null 2>&1; then
            cilium uninstall --wait >/dev/null 2>&1 || true
        fi
    fi
    exit $exit_code
}

trap cleanup_on_error ERR

# Parse command line arguments
while [[ $# -gt 0 ]]; do
    case $1 in
        -a|--api-server)
            K8S_SERVICE_HOST="$2"
            shift 2
            ;;
        -p|--port)
            K8S_SERVICE_PORT="$2"
            shift 2
            ;;
        -v|--version)
            CILIUM_VERSION="$2"
            shift 2
            ;;
        -c|--cleanup)
            CLEANUP_EXISTING_CNI=true
            shift
            ;;
        -h|--help)
            usage
            ;;
        *)
            log_error "Unknown option $1"
            usage
            ;;
    esac
done

# Validate required arguments
if [[ -z "$K8S_SERVICE_HOST" ]]; then
    log_error "Kubernetes API server IP is required"
    usage
fi

# Check if running as root or with sudo
if [[ $EUID -eq 0 ]]; then
    SUDO=""
else
    SUDO="sudo"
    if ! command -v sudo >/dev/null 2>&1; then
        log_error "This script requires sudo privileges"
        exit 1
    fi
fi

# Auto-detect distribution
echo "[1/10] Detecting operating system..."
if [ -f /etc/os-release ]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian)
            PKG_MGR="apt"
            PKG_UPDATE="apt update"
            PKG_INSTALL="apt install -y"
            PKG_UPGRADE="apt upgrade -y"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora)
            PKG_MGR="dnf"
            PKG_UPDATE="dnf check-update || true"
            PKG_INSTALL="dnf install -y"
            PKG_UPGRADE="dnf update -y"
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_UPDATE="yum check-update || true"
            PKG_INSTALL="yum install -y"
            PKG_UPGRADE="yum update -y"
            ;;
        *)
            log_error "Unsupported distribution: $ID"
            exit 1
            ;;
    esac
    log_info "Detected distribution: $PRETTY_NAME"
else
    log_error "Cannot detect distribution - /etc/os-release not found"
    exit 1
fi

# Update system packages
echo "[2/10] Updating system packages..."
$SUDO $PKG_UPDATE
$SUDO $PKG_UPGRADE
$SUDO $PKG_INSTALL curl wget gnupg2 tar

if [[ "$PKG_MGR" == "apt" ]]; then
    $SUDO $PKG_INSTALL software-properties-common
fi

# Check prerequisites
echo "[3/10] Checking prerequisites..."
if ! command -v kubectl >/dev/null 2>&1; then
    log_error "kubectl is not installed or not in PATH"
    exit 1
fi

# Verify Kubernetes cluster access
if ! kubectl cluster-info >/dev/null 2>&1; then
    log_error "Cannot connect to Kubernetes cluster"
    exit 1
fi

if ! kubectl auth can-i '*' '*' --all-namespaces >/dev/null 2>&1; then
    log_error "Insufficient permissions - cluster-admin access required"
    exit 1
fi

log_info "Kubernetes cluster is accessible with proper permissions"

# Clean up existing CNI if requested
if [[ "$CLEANUP_EXISTING_CNI" == "true" ]]; then
    echo "[4/10] Removing existing CNI plugins..."
    log_warn "This will cause network connectivity loss for existing pods"
    
    # Remove Flannel
    kubectl delete -f https://raw.githubusercontent.com/flannel-io/flannel/master/Documentation/kube-flannel.yml --ignore-not-found=true || true
    
    # Remove Calico
    kubectl delete -f https://raw.githubusercontent.com/projectcalico/calico/master/manifests/calico.yaml --ignore-not-found=true || true
    
    # Remove CNI configuration files from local node
    $SUDO rm -rf /etc/cni/net.d/* || true
    $SUDO rm -rf /opt/cni/bin/* || true
    
    log_info "Existing CNI plugins removed"
else
    echo "[4/10] Skipping CNI cleanup (use -c flag to enable)"
fi

# Install Cilium CLI
echo "[5/10] Installing Cilium CLI..."
cd /tmp
CILIUM_CLI_VERSION=$(curl -s https://raw.githubusercontent.com/cilium/cilium-cli/main/stable.txt)
curl -L --fail --remote-name-all "https://github.com/cilium/cilium-cli/releases/download/${CILIUM_CLI_VERSION}/cilium-linux-amd64.tar.gz{,.sha256sum}"
sha256sum --check cilium-linux-amd64.tar.gz.sha256sum
$SUDO tar xzvfC cilium-linux-amd64.tar.gz /usr/local/bin
$SUDO chmod 755 /usr/local/bin/cilium
rm -f cilium-linux-amd64.tar.gz{,.sha256sum}
log_info "Cilium CLI installed successfully"

# Install Cilium CNI
echo "[6/10] Installing Cilium CNI with eBPF networking..."
cilium install \
    --version "$CILIUM_VERSION" \
    --set kubeProxyReplacement=true \
    --set k8sServiceHost="$K8S_SERVICE_HOST" \
    --set k8sServicePort="$K8S_SERVICE_PORT" \
    --set hubble.relay.enabled=true \
    --set hubble.ui.enabled=true \
    --set operator.replicas=2

log_info "Cilium installation initiated"

# Wait for Cilium deployment
echo "[7/10] Waiting for Cilium deployment to complete..."
cilium status --wait
kubectl get pods -n kube-system -l k8s-app=cilium
kubectl get pods -n kube-system -l name=cilium-operator
log_info "Cilium deployment completed successfully"

# Enable Hubble observability
echo "[8/10] Enabling Hubble observability..."
cilium hubble enable --ui
log_info "Hubble observability enabled"

# Install Hubble CLI
echo "[9/10] Installing Hubble CLI..."
HUBBLE_VERSION=$(curl -s https://raw.githubusercontent.com/cilium/hubble/master/stable.txt)
curl -L --fail --remote-name-all "https://github.com/cilium/hubble/releases/download/$HUBBLE_VERSION/hubble-linux-amd64.tar.gz{,.sha256sum}"
sha256sum --check hubble-linux-amd64.tar.gz.sha256sum
$SUDO tar xzvfC hubble-linux-amd64.tar.gz /usr/local/bin
$SUDO chmod 755 /usr/local/bin/hubble
rm -f hubble-linux-amd64.tar.gz{,.sha256sum}
log_info "Hubble CLI installed successfully"

# Verification
echo "[10/10] Verifying installation..."
if cilium status | grep -q "OK"; then
    log_info "Cilium is running successfully"
else
    log_error "Cilium installation verification failed"
    exit 1
fi

if cilium connectivity test --test-concurrency=1 >/dev/null 2>&1; then
    log_info "Cilium connectivity test passed"
else
    log_warn "Cilium connectivity test failed - manual verification may be required"
fi

log_info "Installation completed successfully!"
echo ""
echo "Next steps:"
echo "1. Access Hubble UI: kubectl port-forward -n kube-system svc/hubble-ui --address 0.0.0.0 --address :: 12345:80"
echo "2. View network flows: hubble observe --follow"
echo "3. Check Cilium status: cilium status"
echo "4. Run connectivity tests: cilium connectivity test"