kldload 1.0.4: From Racked to 6-Node Kubernetes in Under 20 Minutes | Cilium eBPF + ZFS + WireGuard

What if Cilium + eBPF had its own Linux distribution?

What if you stopped bolting Kubernetes onto someone else's OS and built the entire stack assuming eBPF is the kernel's native control plane?

No kube-proxy.
No sidecar containers.
No iptables.
No separate CNI plugin.
No separate service mesh.
No separate ingress controller.
No userspace network stack.

The kernel IS the network.

One USB stick. One command. Six nodes. Under twenty minutes.

A single command:
kube-cluster bootstrap --workers 5

This video is a single uncut take — bare metal to a fully encrypted, production-grade Kubernetes cluster running Cilium eBPF, dual WireGuard backplanes, Hubble observability, MetalLB, Gateway API, and ZFS instant-cloned nodes. No cloud. No internet required. Everything ships on a 9GB bootable ISO.

WHAT GETS ELIMINATED
• kube-proxy — never installed. eBPF replaces it entirely
• Sidecar proxies — no Envoy/Istio sidecars. L7 policy lives in the kernel
• iptables — gone. eBPF maps replace the entire netfilter chain
• Separate CNI — no Calico, Flannel, Weave. Cilium IS the kernel networking
• Separate service mesh — no Linkerd, no Istio control plane
• Separate ingress controller — Gateway API is Cilium-native
• Separate network observability agents — Hubble captures everything at eBPF level
• Disk-copy provisioning — ZFS copy-on-write clones nodes in 100ms

WHAT'S INSTALLED FROM A SINGLE USB
• Debian 13 (Trixie) — native ZFS on root, no workarounds
• KVM hypervisor — libvirt + QEMU, ZFS zvol-backed VMs
• Kubernetes v1.32 — kubeadm, kubelet, containerd, Helm
• Cilium v1.16.5 — eBPF CNI, full kube-proxy replacement
• Hubble — real-time eBPF flow observability (DNS, TCP, HTTP, L7)
• WireGuard — dual encrypted backplanes (management + data plane)
• MetalLB v0.14.9 — bare-metal LoadBalancer, no cloud required
• Gateway API — Cilium-backed ingress controller
• OpenEBS ZFS CSI — Kubernetes persistent volumes on ZFS
• ZFSBootMenu — native boot environments, GRUB eliminated
• Sanoid — automated ZFS snapshots (hourly/daily/weekly/monthly)
• Secure Boot — MOK-signed ZFS kernel modules
• NVIDIA GPU — auto-detected, driver ready from first boot
• eBPF stack — bpftrace, bpftool, execsnoop, perf, BTF CO-RE
• Podman — rootless containers with ZFS storage driver
• nftables — per-node firewall, locked down by default
• 20+ management tools — kst, ksnap, kbe, kclone, kpkg, kupgrade, krecovery
• Complete offline install — RPM + APT darksites baked into ISO
• 8 distros supported — Debian, Ubuntu, CentOS, Rocky, Fedora, RHEL, Arch

KEY CAPABILITIES
• Golden image workflow — build once, clone infinite nodes in 100ms
• Zero-second provisioning — ZFS copy-on-write, no disk copies, no wait
• Dual encrypted backplanes — every hop encrypted, host to API to pod
• Destroy and rebuild entire cluster in under 60 seconds
• Image export — qcow2, vmdk, vhd, ova — cloud-init ready templates
• 9GB USB — zero internet required — complete darksite deployment

Видео kldload 1.0.4: From Racked to 6-Node Kubernetes in Under 20 Minutes | Cilium eBPF + ZFS + WireGuard канала kldloadOS