Securing Networks with eBPF Magic

Au fur et à mesure que la complexité des architectures cloud natives augmente, de nouvelles approches en matière de sécurité sont nécessaires. eBPF et Cilium offrent un moyen révolutionnaire d'intégrer la sécurité dans l'infrastructure. Cette présentation explique comment eBPF permet au noyau Linux lui-même d'appliquer des politiques de sécurité. Donia donnera des démonstrations tout au long de la présentation pour comprendre l'utilisation par Cilium de l'eBPF en mantière de sécurité d’applications. Vous repartirez en comprenant comment eBPF et Cilium révolutionnent la sécurité dans le cloud-native.

Transcript

1. Securing Networks with eBPF Magic Donia Chaiehloudj | @doniacld Senior Software Engineer, Isovalent GDG Sophia-Antipolis organiser | Women Techmaker Ambassador | Co-author of the book “Learn Go with Pocket-Sized Projects”
2. • What is eBPF? • How eBPF works • Use cases for eBPF • Introducing Cilium • Securing networks with Cilium and eBPF • Cilium demo • Additional Cilium capabilities • Summary Agenda
3. What is ? @doniacld
4. What is ? extended Berkley Packet Filter @doniacld
5. What is ? extended Berkley Packet Filter @doniacld https://www.youtube.com/watch?v=Wb_vD3XZYOA
6. What is ? Makes the Linux kernel programmable @doniacld
7. Without @doniacld
8. With @doniacld
9. Run custom code in the kernel @doniacld https://ebpf.io/books/buzzing-across-space-illustrated-childrens-guide-to-ebpf.pdf
10. How works? @doniacld
11. How works? @doniacld
12. eBPF Demo @doniacld
13. github.com/cilium/ebpf @doniacld
14. Uses Cases for @doniacld
15. Uses Cases for @doniacld
16. in Kubernetes @doniacld
17. Introducing Cilium @doniacld
18. Introducing Cilium @doniacld
19. • Open source networking for Kubernetes • Leverages eBPF for security policies • Identity-based security model Introducing Cilium @doniacld
20. Securing networks with Cilium & eBPF • eBPF enables identity-aware policies • Apply security rules based on labels • Restrict access between entities @doniacld
21. Cilium Demo @doniacld
22. Gophers around the world @doniacld
23. Cilium Network Policy @doniacld apiVersion: "cilium.io/v2" kind: CiliumNetworkPolicy metadata: name: gopher-travel-policy-allow-only-eu-to-us spec: description: "Allow gophers to travel from EU to US" endpointSelector: matchLabels: app: gopher continent: eu egressDeny: - toEndpoints: - matchLabels: continent: au egress: - toEndpoints: - matchLabels: continent: us
24. github.com/doniacld/cilium-gophers-demo @doniacld
25. Kubernetes Network Policy vs Cilium Network Policy @doniacld
26. Thank you! ebpf.io @ciliumproject @isovalent Let’s connect @doniacld
27. Learn more! Hardened, enterprise-grade eBPF-powered networking, observability, and security. For the Enterprise isovalent.com/product isovalent.com/labs eBPF-based Networking, Observability, Security OSS Community cilium.io cilium.slack.com The revolution in the Linux kernel, safely and efficiently extending the capabilities of the kernel. Base technology ebpf.io What is eBPF? - ebook Regular news