<commit_before>.. only:: not (epub or latex or html)

    WARNING: You are looking at unreleased Cilium documentation.
    Please use the official rendered version released here:
    https://docs.cilium.io

.. _external_workloads:

.. _gs_external_workloads:

*************************************************
Setting up Support for External Workloads (beta)
*************************************************

This is a step-by-step guide on how to add external workloads (such as
VMs) in to your Kubernetes cluster and to enforce security policies to
restrict access.

.. include:: ../beta.rst

Prerequisites
#############

* Cilium must be configured to use Kubernetes for identity allocation
  (``identityAllocationMode`` set to ``crd``). This is the default
  for new installations.

* External workloads must run a recent enough kernel (>= 4.17) for k8s
  service access from the external host to work, see
  :ref:`host-services` for details.

* External workloads must have Docker 20.10 or newer installed on the
  system (a version which supports ``--cgroupns`` CLI option).

* External workloads must have IP connectivity with the nodes in your
  cluster. This requirement is typically met by running your VMs in
  the same cloud provider virtual network (e.g., GCP VPC) as your k8s
  cluster, or establishing peering or VPN tunnels between the networks
  of the nodes of your cluster and your external workloads. Note that
  this precludes any VMs running behind NATs.

* All external workloads must have a unique IP address assigned
  them. Node IPs of such nodes and your clusters must not conflict with
  each other.

* The network between the external workloads and your cluster must
  allow the node-cluster communication. The exact ports are documented
  in the :ref:`firewall_requirements` section.

* This guide assumes your external workload manages domain name
  resolution service by a stand-alone ``/etc/resolv.conf``, or via
  systemd (e.g., Ubuntu).

* So far this functionality is only tested with the vxlan tunneling
  datapath mode (default for most installations).

Prepare your cluster
####################

Enable support for external workloads
=====================================

Your cluster must be configured with support for external workloads
enabled. This can be done with the cilium CLI tool by issuing ``cilium<commit_msg>Add a 'Limitations' section to 'External Workloads'.<commit_after>.. only:: not (epub or latex or html)

    WARNING: You are looking at unreleased Cilium documentation.
    Please use the official rendered version released here:
    https://docs.cilium.io

.. _external_workloads:

.. _gs_external_workloads:

*************************************************
Setting up Support for External Workloads (beta)
*************************************************

This is a step-by-step guide on how to add external workloads (such as
VMs) in to your Kubernetes cluster and to enforce security policies to
restrict access.

.. include:: ../beta.rst

Prerequisites
#############

* Cilium must be configured to use Kubernetes for identity allocation
  (``identityAllocationMode`` set to ``crd``). This is the default
  for new installations.

* External workloads must run a recent enough kernel (>= 4.17) for k8s
  service access from the external host to work, see
  :ref:`host-services` for details.

* External workloads must have Docker 20.10 or newer installed on the
  system (a version which supports ``--cgroupns`` CLI option).

* External workloads must have IP connectivity with the nodes in your
  cluster. This requirement is typically met by running your VMs in
  the same cloud provider virtual network (e.g., GCP VPC) as your k8s
  cluster, or establishing peering or VPN tunnels between the networks
  of the nodes of your cluster and your external workloads. Note that
  this precludes any VMs running behind NATs.

* All external workloads must have a unique IP address assigned
  them. Node IPs of such nodes and your clusters must not conflict with
  each other.

* The network between the external workloads and your cluster must
  allow the node-cluster communication. The exact ports are documented
  in the :ref:`firewall_requirements` section.

* This guide assumes your external workload manages domain name
  resolution service by a stand-alone ``/etc/resolv.conf``, or via
  systemd (e.g., Ubuntu).

* So far this functionality is only tested with the vxlan tunneling
  datapath mode (default for most installations).

Limitations
###########

* Transparent encryption of traffic to/from external workloads is currently not
  supported.

Prepare your cluster
####################

Enable support for external workloads
=====================================

Your cluster must be configured with support for external workloads
enabled. This can be done with the cilium CLI tool by issuing ``cilium
{'fraction_non_alphanumeric': 0.12141687141687142, 'fraction_numerical': 0.0036855036855036856, 'mean_word_length': 4.452008928571429, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 5, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6265799', 'n_tokens_mistral': 1265, 'n_tokens_neox': 1195, 'n_words': 629}