[Network/K8s] Crossing Kubernetes Borders: The Complete Guide to Cilium and BGP 🌐

Aug 11, 2026

—

Hello everyone! Today, we’re going to delve deep into how Kubernetes clusters in a cloud-native environment, especially those using Cilium, communicate with the outside world.

When studying Kubernetes networking, you’ll eventually encounter the ultimate boss: BGP (Border Gateway Protocol). If you’ve ever wondered, “Why do I need to use complex BGP?”, today’s post will provide the answer. 🚀

1. Basic Terminology: Egress and AS 📝

Before diving into the main content, let’s clarify two fundamental networking concepts.

🚦 What is Egress Traffic? Network traffic is divided into Ingress and Egress based on direction.

Ingress: Guests entering our home (network) from outside.
Egress: All traffic leaving our home to the outside. That is, when a Pod inside the cluster tries to access the internet or an external DB, that’s Egress.

🗺️ What is AS (Autonomous System)? To understand BGP, you need to know about AS. An AS refers to a ‘group of networks under a single administrative policy’. Simply put, you can think of it as a vast territory, like a single company or an ISP (Internet Service Provider).

In BGP configuration, an AS represents not just a single IP address, but the entire network’s administrative unit.

2. BGP: The Diplomat of Networks 🤝

What is the main purpose of BGP? Internal network management is typically handled by protocols like OSPF or EIGRP. BGP, on the other hand, was created to exchange routing information between different ASes. In other words, it acts as a ‘diplomat’ connecting our company’s network with the external internet.

Prerequisites for BGP Connection To successfully establish an Egress connection via BGP, simply plugging in a cable is not enough.

Physical connection is fundamental!
The most crucial aspect is correctly configured BGP Peers and Policies. Communication begins only after you configure them to “be friends (Peers)” and define the policies for exchanging information.

3. BGP’s Perfect Partner, OSPF 👫

BGP knows external routes well, but sometimes it doesn’t know where to send packets within our internal network. This is where OSPF comes in to help BGP.

Division of Roles: If BGP tells you, “The way to America is over there,” OSPF will tell you, “Then the fastest internal path to that ‘over there’ router is here.”
Therefore, when configuring external connectivity (Egress Connectivity) using BGP, OSPF is very often used internally alongside it.

4. When Cilium Meets BGP 🐝

Cilium is a powerful eBPF-based CNI plugin. When connecting a Cilium-managed cluster to an external network, using BGP offers remarkable advantages.

💡 Connectivity Method Cilium connects to external networks using Dynamic Routing, specifically BGP.

How? Cilium itself acts as a BGP speaker, advertising Pod IPs or Service IPs to external routers.

✅ Advantages of using BGP The biggest advantage is ‘Dynamic route updates’.

Even if a network cable breaks or a router fails, BGP detects it and automatically reroutes traffic through other paths. It handles what would otherwise require manual intervention in static routing.

🚫 What is NOT a Connectivity Method (Caution!) Technologies for ‘connecting (Routing)’ Cilium with external networks include BGP, MPLS, and Static Routing.

However, HTTP/HTTPS are application protocols for web communication, not connectivity methods that establish network paths. This distinction must be clearly understood!

5. Service Discovery and Operational Challenges 🧩

Service Discovery How do external clients find services within our cluster?

BGP advertises the Service IP (LoadBalancer IP) externally, paving the way.
This IP is then integrated with an external DNS service to allow access via domain names. In other words, the integration of BGP and external DNS is key.

Operational Challenges While BGP is powerful, it comes with high ‘Complexity’. There are many things to configure, such as AS number management, filtering policies, and peering state management, making it challenging for beginners to handle.

6. Troubleshooting: Status Check Command 🔍

Troubleshooting is essential for network engineers. After configuring BGP, what is the first command you should use to check if the connection is properly established?

show ip route: This shows the entire routing table. It’s too comprehensive.
show ip bgp summary: This is the correct answer! ⭐ By entering this command, you can see a summary of the current BGP peer’s status, such as whether the connection is established and how long it has been connected.

Summary

BGP Purpose: Exchange routes between different ASes.
Cilium Connectivity: Uses dynamic routing via BGP. (HTTP is not a connectivity protocol)
Companion Protocol: Often used with OSPF for internal connectivity.
Advantage: Automatic route updates in response to network changes.
Verification: Check peer status with the `show ip bgp summary` command.

I hope this article helps you understand Kubernetes networking better! 🚀