From 30a0c5c07f8be2da7d76819f5d903e143cdaf487 Mon Sep 17 00:00:00 2001
From: Cyclinder Kuo <kuocyclinder@gmail.com>
Date: Thu, 21 Nov 2024 11:49:27 +0800
Subject: [PATCH] Add cilium_enable_bbr flag for cilium

Signed-off-by: cyclinder <qifeng.guo@daocloud.io>
---
 docs/CNI/cilium.md                                    | 11 ++++++++++-
 roles/network_plugin/cilium/defaults/main.yml         |  8 +++++++-
 .../cilium/templates/cilium/config.yml.j2             |  5 +++++
 3 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/docs/CNI/cilium.md b/docs/CNI/cilium.md
index fed25ddb5..6523caa8f 100644
--- a/docs/CNI/cilium.md
+++ b/docs/CNI/cilium.md
@@ -313,12 +313,21 @@ Bandwidth Manager requires a v5.1.x or more recent Linux kernel.
 
 For further information, make sure to check the official [Cilium documentation](https://docs.cilium.io/en/latest/network/kubernetes/bandwidth-manager/)
 
-To use this function, set the following parameters
+To use this feature, set the following parameters:
 
 ```yml
 cilium_enable_bandwidth_manager: true
 ```
 
+The base infrastructure around MQ/FQ setup provided by Cilium’s bandwidth manager also allows for use of TCP BBR congestion control for Pods. BBR achieves higher bandwidths and lower latencies for Internet traffic. you can enable it by setting the following parameters:
+
+```yaml
+cilium_enable_bandwidth_manager: true
+cilium_enable_bbr: true
+```
+
+> BBR for Pods requires a v5.18.x or more recent Linux kernel.
+
 ## Host Firewall
 
 Host Firewall enforces security policies for Kubernetes nodes. It is disable by default, since it can break the cluster connectivity.
diff --git a/roles/network_plugin/cilium/defaults/main.yml b/roles/network_plugin/cilium/defaults/main.yml
index 9de2d331c..c0917976e 100644
--- a/roles/network_plugin/cilium/defaults/main.yml
+++ b/roles/network_plugin/cilium/defaults/main.yml
@@ -55,7 +55,9 @@ cilium_enable_prometheus: false
 cilium_enable_portmap: false
 # Monitor aggregation level (none/low/medium/maximum)
 cilium_monitor_aggregation: medium
-# Kube Proxy Replacement mode (strict/partial)
+# Kube Proxy Replacement mode 
+# cilium_version < 1.14.0: strict/partial/disabled
+# cilium_version >= 1.14.0: true/false
 cilium_kube_proxy_replacement: partial
 
 # If upgrading from Cilium < 1.5, you may want to override some of these options
@@ -120,6 +122,10 @@ cilium_wireguard_userspace_fallback: false
 # Bandwidth Manager requires a v5.1.x or more recent Linux kernel.
 cilium_enable_bandwidth_manager: false
 
+# Enable BBR for the bandwidth manager
+# Requires cilium_enable_bandwidth_manager to be enabled
+cilium_enable_bbr: false
+
 # IP Masquerade Agent
 # https://docs.cilium.io/en/stable/concepts/networking/masquerading/
 # By default, all packets from a pod destined to an IP address outside of the cilium_native_routing_cidr range are masqueraded
diff --git a/roles/network_plugin/cilium/templates/cilium/config.yml.j2 b/roles/network_plugin/cilium/templates/cilium/config.yml.j2
index 9cae26795..076fbc541 100644
--- a/roles/network_plugin/cilium/templates/cilium/config.yml.j2
+++ b/roles/network_plugin/cilium/templates/cilium/config.yml.j2
@@ -144,6 +144,11 @@ data:
   # Bandwidth Manager requires a v5.1.x or more recent Linux kernel.
 {% if cilium_enable_bandwidth_manager %}
   enable-bandwidth-manager: "true"
+  # Enable BBR for the bandwidth manager
+  # BBR for Pods requires a v5.18.x or more recent Linux kernel.
+{% if cilium_enable_bbr %}
+  enable-bbr: "true"
+{% endif %}
 {% endif %}
 
   # Host Firewall and Policy Audit Mode