Using eBPF for High-Performance Networking in Cilium

Using eBPF for High-Performance Networking in Cilium

• 1.
  Brought to youby Using eBPF for High-Performance Networking in Cilium Liz Rice @lizrice Chief Open Source Officer at Isovalent
• 2.
  Hi, I’m Liz👋 Chief Open Source Officer at Isovalent ■ Previously chair of CNCF’s Technical Oversight Committee ■ Early career: writing networking code ■ Containers / security / eBPF / cloud native ■ Often found on a bike or playing music
• 3.
  eBPF-based high-performance networking: XDP
• 4.
  @lizrice host eth0 Bad packet ��
• 5.
  @lizrice host eth0 Bad packet Discard? XDP
• 6.
  @lizrice host eth0 Bad packet Discard? XDP
• 7.
  eBPF Packet Drop SEC("xdp") intgoodbye_ping(struct xdp_md *ctx) { ... if (iph->protocol == IPPROTO_ICMP) return XDP_DROP; return XDP_PASS; }
• 8.
  Cilium - eBPF-basednetworking for distributed systems
• 9.
  https://www.reddit.com/r/networkingmemes/comments/8u7jyz/container_networking/
• 10.
  iptables Todo! Example iptablesoutput - possibly live as demo
• 11.
  $ kubectl -nkube-system delete ds kube-proxy
• 12.
  host pod app socket veth veth eth0 iptables conntrack iptables INPUT Linuxrouting iptables PREROUTING mangle iptables conntrack iptables FORWARD Linux routing iptables PREROUTING nat iptables POSTROUTING mangle iptables PREROUTING mangle iptables POSTROUTING nat Network Path
• 13.
  host pod app socket veth veth eth0 iptables conntrack iptables INPUT Linuxrouting iptables PREROUTING mangle Network Path Linux routing
• 14.
  host pod app socket veth veth eth0 iptables conntrack iptables INPUT Linuxrouting iptables PREROUTING mangle Network Security Linux routing Policy checks
• 15.
  userspace kernel JIT native code eth0 eBPF verifier bpf(BPF_PROG_LOAD,…) eBPF loader SEC(“to_netdev”) int handle(struct sk_buff *skb) { … if (tcp->dport == 80) redirect(lxc0); return DROP_PACKET; } foo.o clang -target bpf [...] agent BPF maps lxc0
• 16.
  @lizrice https://cilium.io/blog/2021/05/11/cni-benchmark Cilium eBPF (receivepath)
• 17.
  @lizrice kube-proxy replacement performance
• 18.
  Brought to youby Liz Rice @lizrice | cilium.io | ebpf.io Thank you