diff --git a/docs/content/en/docs/clustermgmt/networking/networking-and-security.md b/docs/content/en/docs/clustermgmt/networking/networking-and-security.md index 85600f1c09f6..d1a6148c12f6 100755 --- a/docs/content/en/docs/clustermgmt/networking/networking-and-security.md +++ b/docs/content/en/docs/clustermgmt/networking/networking-and-security.md @@ -25,6 +25,26 @@ This section provides information about: * Using Cilium to securing workload connectivity using Kubernetes Network Policy. +## Cilium Features +The following table lists Cilium features and notes which of those features are built into EKS Anywhere's default Cilium version , upstream Open Source, and Cilium Enterprise. + +
Expand to see Cilium Features + +| Headline/Feature |   EKS Anywhere Default Cilium |   Cilium OSS |   Isovalent Cilium Enterprise | +| --------------- | ---------- | ---------- | -------------------- | +| Networking Routing (CNI) |         **✔** |     **✔** |     **✔** | +| Identity-Based Network Policy (Labels, CIDR) |         **✔** |     **✔** |     **✔** | +| Load-Balancing (L3/L4) |         **✔** |     **✔** |     **✔** | +| Advanced Network Policy & Encryption (DNS, L7, TLS/SNI, ...) |         **—** |     **✔** |     **✔** | +| Ingress, Gateway API, & Service Mesh |         **—** |     **✔** |     **✔** | +| Multi-Cluster, Egress Gateway, BGP |         **—** |     **—** |     **✔** | +| Hubble Network Observability (Metrics, Logs, Prometheus, Grafana, OpenTelemetry) |         **—** |     **✔** |     **✔** | +| SIEM Integration & Timescape Observability Storage |         **—** |     **—** |     **✔** | +| Tetragon Runtime Security |         **—** |     **—** |     **✔** | +| Enterprise-hardened Cilium Distribution, Training, 24x7 Enterprise Grade Support |         **—** |     **—** |     **✔** | + +
+ ## Cilium Components The primary Cilium Agent runs as a DaemonSet on each Kubernetes node. Each cluster also includes a Cilium Operator Deployment to handle certain cluster-wide operations. For EKS Anywhere, Cilium is configured to use the Kubernetes API server as the identity store, so no etcd cluster connectivity is required.