Multi-Cloud Networking: Cilium 1.17 vs. Calico 3.28 for Cross-Cloud Connectivity

#!/bin/bash
# Cilium 1.17 ClusterMesh Deployment Script for AWS EKS + GCP GKE
# Prerequisites: kubectl, helm 3.14+, aws-cli 2.15+, gcloud 450+, jq 1.6+
set -euo pipefail

# Configuration variables
CILIUM_VERSION="1.17.0"
AWS_EKS_CLUSTER="cilium-aws-cluster"
AWS_REGION="us-east-1"
GCP_GKE_CLUSTER="cilium-gcp-cluster"
GCP_ZONE="us-central1-a"
GCP_PROJECT="multi-cloud-prod-123"

# Error handling function
error_exit() {
  echo "ERROR: $1" >&2
  exit 1
}

# Check prerequisites
check_prereq() {
  local cmd="$1"
  if ! command -v "$cmd" &> /dev/null; then
    error_exit "Prerequisite $cmd not installed. Please install and retry."
  fi
}

echo "Checking prerequisites..."
check_prereq kubectl
check_prereq helm
check_prereq aws
check_prereq gcloud
check_prereq jq

# Deploy Cilium to AWS EKS
echo "Deploying Cilium $CILIUM_VERSION to AWS EKS cluster $AWS_EKS_CLUSTER..."
aws eks update-kubeconfig --region "$AWS_REGION" --name "$AWS_EKS_CLUSTER" || error_exit "Failed to update kubeconfig for EKS cluster"
helm repo add cilium https://helm.cilium.io/ || error_exit "Failed to add Cilium Helm repo"
helm repo update
helm upgrade --install cilium cilium/cilium --version "$CILIUM_VERSION" \
  --namespace kube-system \
  --set cluster.name="$AWS_EKS_CLUSTER" \
  --set cluster.id=1 \
  --set clustermesh.enable=true \
  --set clustermesh.use-global-service=false \
  --set encryption.wireguard.enabled=false \
  --set ipam.mode=kubernetes \
  --wait || error_exit "Failed to deploy Cilium to EKS"

# Get AWS cluster CIDR and service CIDR
AWS_POD_CIDR=$(kubectl get cm kubeadm-config -n kube-system -o jsonpath='{.data.ClusterConfiguration}' | grep podSubnet | awk '{print $2}')
AWS_SVC_CIDR=$(kubectl get cm kubeadm-config -n kube-system -o jsonpath='{.data.ClusterConfiguration}' | grep serviceSubnet | awk '{print $2}')
echo "AWS EKS Pod CIDR: $AWS_POD_CIDR, Service CIDR: $AWS_SVC_CIDR"

# Deploy Cilium to GCP GKE
echo "Deploying Cilium $CILIUM_VERSION to GCP GKE cluster $GCP_GKE_CLUSTER..."
gcloud container clusters get-credentials "$GCP_GKE_CLUSTER" --zone "$GCP_ZONE" --project "$GCP_PROJECT" || error_exit "Failed to get GKE credentials"
helm upgrade --install cilium cilium/cilium --version "$CILIUM_VERSION" \
  --namespace kube-system \
  --set cluster.name="$GCP_GKE_CLUSTER" \
  --set cluster.id=2 \
  --set clustermesh.enable=true \
  --set clustermesh.use-global-service=false \
  --set encryption.wireguard.enabled=false \
  --set ipam.mode=kubernetes \
  --wait || error_exit "Failed to deploy Cilium to GKE"

# Get GCP cluster CIDR
GCP_POD_CIDR=$(gcloud container clusters describe "$GCP_GKE_CLUSTER" --zone "$GCP_ZONE" --project "$GCP_PROJECT" --format="json" | jq -r '.clusterIpv4Cidr')
GCP_SVC_CIDR=$(gcloud container clusters describe "$GCP_GKE_CLUSTER" --zone "$GCP_ZONE" --project "$GCP_PROJECT" --format="json" | jq -r '.servicesIpv4Cidr')
echo "GCP GKE Pod CIDR: $GCP_POD_CIDR, Service CIDR: $GCP_SVC_CIDR"

# Configure ClusterMesh peering
echo "Configuring ClusterMesh peering between AWS and GCP..."
cilium clustermesh enable --context "arn:aws:eks:us-east-1:123456789012:cluster/$AWS_EKS_CLUSTER" \
  --peer-context "gke_${GCP_PROJECT}_${GCP_ZONE}_${GCP_GKE_CLUSTER}" || error_exit "Failed to enable ClusterMesh"

# Verify ClusterMesh status
echo "Verifying ClusterMesh status..."
cilium clustermesh status --wait --context "arn:aws:eks:us-east-1:123456789012:cluster/$AWS_EKS_CLUSTER"
echo "Cilium ClusterMesh deployment complete. Cross-cloud connectivity is now live."

package main

// Cross-Cloud Throughput Benchmark Tool for Cilium 1.17 vs Calico 3.28
// Compilation: go build -o bench-xcloud main.go
// Usage: ./bench-xcloud --server-host 10.0.0.1 --port 8080 --duration 60 --protocol tcp
import (
    "context"
    "flag"
    "fmt"
    "log"
    "net"
    "os"
    "os/signal"
    "sync"
    "time"
    "github.com/cheggaaa/pb/v3"
)

var (
    serverHost  = flag.String("server-host", "127.0.0.1", "Server host IP")
    port        = flag.Int("port", 8080, "Server port")
    duration    = flag.Int("duration", 60, "Test duration in seconds")
    protocol    = flag.String("protocol", "tcp", "Protocol: tcp or udp")
    bufferSize  = flag.Int("buffer-size", 1024*1024, "Buffer size in bytes (1MB default)")
)

// Server function to receive data and calculate throughput
func startServer(ctx context.Context, wg *sync.WaitGroup) {
    defer wg.Done()
    addr := fmt.Sprintf(":%d", *port)
    ln, err := net.Listen("tcp", addr)
    if err != nil {
        log.Fatalf("Failed to start server: %v", err)
    }
    defer ln.Close()
    fmt.Printf("Server listening on %s\n", addr)

    // Accept connections until context is cancelled
    for {
        select {
        case <-ctx.Done():
            fmt.Println("Server shutting down...")
            return
        default:
            conn, err := ln.Accept()
            if err != nil {
                log.Printf("Failed to accept connection: %v", err)
                continue
            }
            go handleConnection(conn)
        }
    }
}

func handleConnection(conn net.Conn) {
    defer conn.Close()
    buf := make([]byte, *bufferSize)
    start := time.Now()
    var totalBytes uint64 = 0

    for {
        n, err := conn.Read(buf)
        if err != nil {
            elapsed := time.Since(start).Seconds()
            throughput := float64(totalBytes) / elapsed / 1000000 // MB/s
            fmt.Printf("Connection closed. Total bytes: %d, Duration: %.2fs, Throughput: %.2f MB/s\n", totalBytes, elapsed, throughput)
            return
        }
        totalBytes += uint64(n)
    }
}

// Client function to send data and measure throughput
func startClient(ctx context.Context, wg *sync.WaitGroup) {
    defer wg.Done()
    addr := fmt.Sprintf("%s:%d", *serverHost, *port)
    conn, err := net.DialTimeout("tcp", addr, 5*time.Second)
    if err != nil {
        log.Fatalf("Failed to connect to server: %v", err)
    }
    defer conn.Close()
    fmt.Printf("Client connected to %s\n", addr)

    buf := make([]byte, *bufferSize)
    // Fill buffer with random data
    for i := range buf {
        buf[i] = byte(i % 256)
    }

    start := time.Now()
    var totalBytes uint64 = 0
    bar := pb.New64(0).SetTemplate(pb.Simple).Set("prefix", "Sending data: ")
    bar.Start()

    ticker := time.NewTicker(1 * time.Second)
    defer ticker.Stop()

    for {
        select {
        case <-ctx.Done():
            elapsed := time.Since(start).Seconds()
            throughput := float64(totalBytes) / elapsed / 1000000 // MB/s
            bar.Finish()
            fmt.Printf("\nTest complete. Total bytes: %d, Duration: %.2fs, Throughput: %.2f MB/s (%.2f Gbps)\n", 
                totalBytes, elapsed, throughput, throughput*8/1000)
            return
        case <-ticker.C:
            // Print progress every second
            elapsed := time.Since(start).Seconds()
            if elapsed > 0 {
                currentThroughput := float64(totalBytes) / elapsed / 1000000
                bar.SetCurrent(int64(totalBytes))
                fmt.Printf("\rProgress: %.1fs elapsed, %.2f MB/s", elapsed, currentThroughput)
            }
        default:
            n, err := conn.Write(buf)
            if err != nil {
                log.Printf("Failed to write data: %v", err)
                return
            }
            totalBytes += uint64(n)
        }
    }
}

func main() {
    flag.Parse()
    ctx, cancel := signal.NotifyContext(context.Background(), os.Interrupt)
    defer cancel()

    var wg sync.WaitGroup

    // Start server if --server-host is local
    if *serverHost == "127.0.0.1" || *serverHost == "localhost" {
        wg.Add(1)
        go startServer(ctx, &wg)
        // Wait for server to start
        time.Sleep(1 * time.Second)
    }

    // Start client
    wg.Add(1)
    go startClient(ctx, &wg)

    wg.Wait()
}

# Terraform Configuration for Multi-Cloud Calico 3.28 Deployment (AWS + Azure)
# Prerequisites: terraform 1.7+, aws-cli, azure-cli
# Providers
terraform {
  required_version = ">= 1.7.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 3.0"
    }
    helm = {
      source  = "hashicorp/helm"
      version = "~> 2.0"
    }
  }
}

# Configure AWS Provider
provider "aws" {
  region = "us-east-1"
}

# Configure Azure Provider
provider "azurerm" {
  features {}
  subscription_id = var.azure_subscription_id
  tenant_id       = var.azure_tenant_id
}

# Variables
variable "azure_subscription_id" {
  type        = string
  description = "Azure Subscription ID"
}

variable "azure_tenant_id" {
  type        = string
  description = "Azure Tenant ID"
}

variable "cluster_name_aws" {
  type        = string
  default     = "calico-aws-cluster"
  description = "AWS EKS Cluster Name"
}

variable "cluster_name_azure" {
  type        = string
  default     = "calico-azure-cluster"
  description = "Azure AKS Cluster Name"
}

# Deploy AWS EKS Cluster
resource "aws_eks_cluster" "calico_aws" {
  name     = var.cluster_name_aws
  role_arn = aws_iam_role.eks_role.arn
  vpc_config {
    subnet_ids = aws_subnet.public[*].id
  }
}

resource "aws_iam_role" "eks_role" {
  name = "eks-role-calico"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Action = "sts:AssumeRole"
      Effect = "Allow"
      Principal = { Service = "eks.amazonaws.com" }
    }]
  })
}

# Deploy Azure AKS Cluster
resource "azurerm_kubernetes_cluster" "calico_azure" {
  name                = var.cluster_name_azure
  location            = "eastus"
  resource_group_name = azurerm_resource_group.calico_rg.name
  dns_prefix          = "calico-azure"

  default_node_pool {
    name       = "default"
    node_count = 3
    vm_size    = "Standard_D4s_v3"
  }

  identity {
    type = "SystemAssigned"
  }
}

resource "azurerm_resource_group" "calico_rg" {
  name     = "calico-multi-cloud-rg"
  location = "eastus"
}

# Install Calico 3.28 via Helm on AWS EKS
provider "helm" {
  kubernetes {
    host                   = aws_eks_cluster.calico_aws.endpoint
    cluster_ca_certificate = base64decode(aws_eks_cluster.calico_aws.certificate_authority[0].data)
    exec {
      api_version = "client.authentication.k8s.io/v1beta1"
      command     = "aws"
      args        = ["eks", "get-token", "--cluster-name", aws_eks_cluster.calico_aws.name]
    }
  }
}

resource "helm_release" "calico_aws" {
  name       = "calico"
  repository = "https://docs.tigera.io/calico/charts"
  chart      = "calico"
  version    = "3.28.0"
  namespace  = "kube-system"

  set {
    name  = "cluster.name"
    value = var.cluster_name_aws
  }

  set {
    name  = "bgp.enable"
    value = "true"
  }

  set {
    name  = "bgp.peerSelector"
    value = "all()"
  }
}

# Install Calico 3.28 via Helm on Azure AKS
provider "helm" {
  alias = "azure"
  kubernetes {
    host                   = azurerm_kubernetes_cluster.calico_azure.kube_config[0].host
    cluster_ca_certificate = base64decode(azurerm_kubernetes_cluster.calico_azure.kube_config[0].cluster_ca_certificate)
    exec {
      api_version = "client.authentication.k8s.io/v1beta1"
      command     = "kubelogin"
      args        = ["get-token", "--server-id", azurerm_kubernetes_cluster.calico_azure.identity[0].principal_id]
    }
  }
}

resource "helm_release" "calico_azure" {
  provider   = helm.azure
  name       = "calico"
  repository = "https://docs.tigera.io/calico/charts"
  chart      = "calico"
  version    = "3.28.0"
  namespace  = "kube-system"

  set {
    name  = "cluster.name"
    value = var.cluster_name_azure
  }

  set {
    name  = "bgp.enable"
    value = "true"
  }

  # Configure BGP peering with AWS EKS
  set {
    name  = "bgp.peers[0].address"
    value = aws_eks_cluster.calico_aws.vpc_config[0].endpoint_public_access_cidrs[0]
  }

  set {
    name  = "bgp.peers[0].asn"
    value = "64512"
  }
}

# Outputs
output "aws_eks_endpoint" {
  value = aws_eks_cluster.calico_aws.endpoint
}

output "azure_aks_endpoint" {
  value = azurerm_kubernetes_cluster.calico_azure.kube_config[0].host
}

output "calico_version" {
  value = "3.28.0"
}