Unleashing the kernel with eBPF

Unleashing the kernel with eBPF Liz Rice | @lizrice Chief
Open Source Officer, Isovalent Emeritus Chair, CNCF Technical Oversight Committee | CNCF & OpenUK boards

@lizrice What is ? extended Berkeley Packet Filter

@lizrice What is ? eBPF is a kernel technology enabling
high-performance, low overhead tools for networking, security and observability

@lizrice What is ? Makes the kernel programmable

@lizrice userspace kernel app event system calls eBPF program Run
custom code in the kernel

@lizrice SEC("kprobe/sys_execve") int hello(void *ctx) { bpf_printk("Hello!"); return 0; }
$ sudo ./hello bash-20241 [004] d... 84210.752785: 0: I'm alive! bash-20242 [004] d... 84216.321993: 0: I'm alive! bash-20243 [004] d... 84225.858880: 0: I'm alive! Info about process that called execve syscall + userspace code to load eBPF program eBPF Hello World

@lizrice Packet of Death mitigation

@lizrice host eth0 Packet of Death

@lizrice host eth0 Packet of Death Discard?

@lizrice SEC("xdp/bye") int goodbye_ping(struct xdp_md *ctx) { ... if (iph->protocol
== IPPROTO_ICMP) return XDP_DROP; return XDP_PASS; } eBPF Packet Drop

@lizrice Dynamically change kernel behaviour

@lizrice

@lizrice eBPF code has to be safe userspace kernel app
event system calls eBPF program 🔍 verifier

@lizrice eBPF code runs as native instructions userspace kernel app
event system calls eBPF program ✍ JIT compiler

@lizrice Custom behaviour without transitions

@lizrice userspace kernel app XDP event system calls eBPF program
eXpress Data path - ingress, before network stack network packet XDP_DROP network stack XDP_TX XDP_PASS

@lizrice userspace kernel app event system calls eBPF program Run
custom code on network packets network packet Program triggered by packet No polling from user space Packet in kernel memory Per CPU eBPF maps

@lizrice Improved network performance (eBPF) (eBPF) (eBPF) (not eBPF) Miano
et al: A Framework for eBPF-Based Network Functions in an Era of Microservices

@lizrice cilium.io/blog/2022/04/12/cilium-standalone-L4LB-XDP/ - Seznam case study Improved network performance

@lizrice Improved performance for container networking

@lizrice host pod app socket veth veth eth0 iptables conntrack
iptables INPUT Linux routing iptables PREROUTING mangle iptables conntrack iptables FORWARD Linux routing iptables PREROUTING nat iptables POSTROUTING mangle iptables PREROUTING mangle iptables POSTROUTING nat

@lizrice host pod app socket veth veth eth0 iptables conntrack
iptables INPUT Linux routing iptables PREROUTING mangle Linux routing

@lizrice cilium.io/blog/2021/05/11/cni-benchmark TCP RR (higher is better) legacy host-routing

@lizrice cilium.io/blog/2020/06/22/cilium-18/#kubeproxy-removal

@lizrice Unleashing the Power of Cilium CNI to Propel Trendyol’s
Performance Up to 40%! 20 July 2023

@lizrice eBPF for performance tracing

@lizrice Measure anything (?) with eBPF

@lizrice Brendan Gregg on performance improvements

@lizrice Brendan Gregg on performance improvements “eBPF is essential for
such fast in-situ production analysis”

@lizrice Programmable kernel in Kubernetes

@lizrice userspace kernel networking access files create containers One kernel
per host pod container pod container container

@lizrice userspace kernel app app pods networking access files create
containers Kernel aware of everything on the host

@lizrice userspace app kernel app pods networking access files create
containers eBPF programs can be aware of everything

@lizrice eBPF tools work without any app or config changes

@lizrice - Nathan LeClaire @dotpem

@lizrice A sidecar has a view across one pod userspace
pod container sidecar container

@lizrice Sidecars need YAML userspace pod container sidecar container userspace
pod container sidecar container my-app.yaml containers: - name: my-app ... - name: my-app-init … - name: my-sidecar ...

@lizrice eBPF does not need any app changes userspace pod
container container my-app.yaml containers: - name: my-app ... - name: my-app-init … kernel

@lizrice eBPF can see ALL activity on the node userspace
pod container container my-app.yaml containers: - name: my-app ... - name: my-app-init … kernel 👿

@lizrice Reduce resource usage of per-pod sidecar Avoid sidecar config
in every pod Avoid updating sidecar config in every pod

@lizrice eBPF enables efficient sidecarless Service Mesh

@lizrice Network path with sidecar

@lizrice Network path for L3/4 traffic

@lizrice Envoy for Layer 7 terminations when needed

@lizrice “[Moving to a proxy-per-node model can] reduce costs up
to 90% while simplifying operations and improving performance for applications” - Tetrate Sidecarless service mesh improves performance

@lizrice eBPF enables high performance security tools

@lizrice userspace kernel app event eBPF program Run custom code
in the kernel Interesting for security system calls

@lizrice Security observability

@lizrice Security observability - Falco Event filtering in user space

@lizrice kernel userspace Security observability - Falco

@lizrice Security observability - Cilium Tetragon kernel userspace Tetragon

@lizrice 🚀 process default/xwing /usr/bin/vi /etc/passwd 📬 open default/xwing /usr/bin/vi
/etc/passwd 📪 close default/xwing /usr/bin/vi 📬 open default/xwing /usr/bin/vi /etc/passwd 📝 write default/xwing /usr/bin/vi /etc/passwd 1275 bytes 📪 close default/xwing /usr/bin/vi 💥 exit default/xwing /usr/bin/vi /etc/passwd 0 Cilium Tetragon observe security events Policy events Kubernetes info

@lizrice “Traditional solution” = eBPF event collection, filtered in user
space In-kernel event filtering Tetragon

@lizrice Runtime security enforcement in eBPF

@lizrice Traditional preventative actions from user space

@lizrice Tetragon runtime security - synchronous Tetragon

@lizrice 🚀 process default/xwing /usr/bin/vi /etc/passwd 📬 open default/xwing /usr/bin/vi
/etc/passwd 📪 close default/xwing /usr/bin/vi 📬 open default/xwing /usr/bin/vi /etc/passwd 📝 write default/xwing /usr/bin/vi /etc/passwd 1269 bytes 💥 exit default/xwing /usr/bin/vi /etc/passwd SIGKILL Cilium Tetragon enforce sensitive file access Killed before write

@lizrice 🚀 process default/xwing /usr/bin/curl deathstar/v1 💥 exit default/xwing /usr/bin/curl
deathstar/v1 0 🚀 process default/xwing /usr/bin/curl example.com 🔌 connect default/xwing /usr/bin/curl tcp 10.244.1.124:49874 -> 93.184.216.34:80 💥 exit default/xwing /usr/bin/curl example.com SIGKILL Cilium Tetragon enforce network access Killed before write Policy allows in-cluster traffic

@lizrice eBPF makes the kernel programmable enabling a new generation
of powerful & efficient Cloud Native tools

@lizrice Thank you ebpf.io cilium.io @lizrice Download from isovalent.com isovalent.com/labs

Remember to vote and share feedback on the InfoQ App
or online. Please vote and leave feedback! Any questions?

Unleashing the kernel with eBPF

Unleashing the kernel with eBPF

More Decks by Liz Rice

Featured

Transcript