Save CPU cycles with eBPF

Transcript

1. Save CPU Cycles with eBPF DONIA CHAIEHLOUDJ SENIOR SOFTWARE ENGINEER, ISOVALENT@CISCO
2. What is ? Makes the Linux kernel programmable
3. Overview of Userspace App Events: • File is opening • Network packet is received syscalls Linux Kernel event Program
4. Different type of Networking hooks • • • • XDP: high-performance network packet processing TC: traffic control by redirecting, filtering, or shaping network traffic socket_filter: filter packets at the socket layer, enabling custom packet filtering and processing for specific applications and much more!
5. Packet Flow
6. TC: Traffic Control • • • • Packet filtering Ingress or Egress Attached to networking interface Local node processing: such as applying L3/L4 endpoint policy and redirecting traffic to endpoints.
7. TC Packet Drop
8. TC Demo
9. XDP (eXpress Data Path)
10. XDP (eXpress Data Path) • • • high-performance network packet processing framework in the Linux kernel Only ingress Runs on the packet data before any other processing can happen Filtering programs: drop malicious, unexpected traffic, DDOS protection mechanisms
11. XDP Packet Drop
12. XDP Demo
13. TC vs XDP: Saving CPU cycles Context: - virtio-net in a KVM guest (native XDP) - host over a tap: 1M UDP packets, plus a max-rate pktgen test
14. TC vs XDP: Saving CPU cycles Context: - virtio-net in a KVM guest (native XDP) - host over a tap: 1M UDP packets, plus a max-rate pktgen test The BPF programs cost the same. The saving is the kernel work XDP skips.
15. Cilium XDP Load Balancing
16. Cilium kube-proxy replacement https://cilium.io/blog/2020/06/22/cilium-18/
17. Thank you • Resources ◦ ◦ ◦ https://www.doniacld.com/blog/is-xdp-more-performant-than-tc/ https://cilium.io/blog/2022/04/12/cilium-standalone-L4LB-XDP/ https://www.datadoghq.com/blog/xdp-intro/