Discovering Cilium: What eBPF Enabled in K8s Networking

28/07/2026 Slides for the presentation at Japan Community Day, a co-located event of KubeCon + CloudNativeCon Japan 2026.

Transcript

1. Discovering Cilium: What eBPF Enabled in K8s Networking Takuto Nagami @logica0419
2. Who have ever used Cilium before?
3. Who likes eBPF?
4. Do you know what eBPF programs actually do in Cilium?
5. We don’t know anything about Cilium internals! I didn’t either, until last year
6. Note: We skip these prerequisites • Kubernetes resource basics • Kubernetes core component basics • TCP/IP networking basics • Linux networking stack basics • eBPF (especially TC) basics
7. What is CNI? — CNI’s responsibility on K8s
8. CNI • Container Network Interface
9. “CNI” has three meanings • CNI spec (containernetworkinterface/cni) • Requirements for a platform • CNI plugin
10. “CNI” has three meanings • CNI spec (containernetworkinterface/cni) • Requirements for a platform • CNI plugin The most important point in this section
11. Requirements for a platform The Kubernetes network model • Each pod gets its own unique IP address. • All pods can communicate with all other pods, whether they are on the same or different nodes without proxies or NAT. • + Service, Gateway, NetworkPolicy https://kubernetes.io/docs/concepts/services-networking/
12. What actually makes Cilium special?
13. Two types of Pod communication • Inter-node: different node • Intra-node: same node
14. Inter-node comms on Cilium • Two modes, but nothing special ◦ Native Routing: same as Calico’s default ◦ Overlay: same as Flannel’s default • ex. GKE Dataplane V2 ◦ “implemented using Cilium” ◦ Original inter-node comms system
15. Inter-node comms on Cilium Intra-node is what makes Cilium unique ! • Two modes, but nothing special ◦ Native Routing: same as Calico’s default ◦ Overlay: same as Flannel’s default • ex. GKE Dataplane V2 ◦ “implemented using Cilium” ◦ Original inter-node comms system
16. How other CNI plugins implement intra-node communications
17. Flannel Preparation Node Host NS
18. Flannel Preparation: create a Linux bridge Node bridge Host NS
19. Flannel When Pod is created Node Pod bridge Host NS
20. Flannel When Pod is created: connect to Linux bridge Node Pod bridge Host NS
21. Flannel Pods have L2 connectivity via Linux bridge Node Pod bridge Pod Host NS
22. Flannel Flannel uses Node Linux bridge to Pod Host NS enable intra-node bridge Pod pod comms! Pods have L2 connectivity via Linux bridge
23. Calico Preparation: assign subnet to nodes Node1 - 10.1.1.0/24 Host NS
24. Calico When Pod is created Node1 - 10.1.1.0/24 Pod 10.1.1.1 Host NS
25. Calico When Pod is created: connect directly via veth Node1 - 10.1.1.0/24 10.1.1.1 NIC1 Pod Host NS
26. Calico When Pod is created: add entry to routing table Node1 - 10.1.1.0/24 10.1.1.1 NIC1 Pod Host NS destiation gateway 10.1.1.1/32 NIC1
27. Calico Pods have L3 connectivity with static routes Node1 - 10.1.1.0/24 10.1.1.1 10.1.1.2 NIC2 Pod NIC1 Pod Host NS destiation gateway 10.1.1.1/32 NIC1 10.1.1.2/32 NIC2
28. Calico Calico uses Node1 - 10.1.1.0/24 static routing to Pod 10.1.1.1 enable intra-nodeHost NS Pod pod comms! Pods have L3 connectivity with static routing NIC1 NIC2 10.1.1.2 destiation gateway 10.1.1.1/32 NIC1 10.1.1.2/32 NIC2
29. kube-proxy Service Node Pod A Pod Pod B
30. kube-proxy Service Node Pod A Pod src: Pod dst: Service Pod B
31. kube-proxy Service Actual machine doesn’t exist Node Pod A Pod src: Pod dst: Service Pod B
32. kube-proxy Service kube-proxy Node netfilter Pod A Pod src: Pod dst: Service Pod B
33. kube-proxy Service watch Node netfilter Pod A Pod src: Pod dst: Service Pod A Pod B
34. kube-proxy Service Node Pod A Pod src: Pod dst: Pod A Pod B
35. kube-proxy Service CNI does the rest of work Node Pod A Pod src: Pod dst: Pod A Pod B
36. kube-proxy Service Node src: Pod kube-proxy just dst: Pod B Pod A DNAT the packet Pod Pod B
37. kube-proxy with CNI Node Pod bridge Pod Host NS
38. kube-proxy with CNI Pass to the Host NS (default gateway) Node Pod bridge Pod Host NS
39. kube-proxy with CNI Perform DNAT with kube-proxy Node Pod bridge Pod Host NS
40. kube-proxy with CNI Deliver the packet to the destination Pod Node Pod bridge Pod Host NS
41. How Cilium implements intra-node communications
42. Cilium When Pod is created Node1 Pod1 Host NS
43. Cilium When Pod is created: connect directly via veth Node1 NIC1 Pod1 Host NS
44. Cilium When Pod is created: attach eBPF on host-side NIC Node1 NIC1 Pod1 Host NS
45. Cilium When Pod is created: ditto Node1 NIC2 Pod2 NIC1 Pod1 Host NS
46. Cilium Sending packet from Pod1 to Pod2 Node1 NIC2 Pod2 NIC1 Pod1 Host NS
47. Cilium Pass to the Host NS (default gateway) Node1 NIC2 Pod2 NIC1 Pod1 Host NS
48. Cilium NIC triggers the eBPF program Node1 NIC2 Pod2 NIC1 Pod1 Host NS
49. Cilium NIC triggers the eBPF program Node1 NIC2 Pod2 NIC1 This eBPF program Pod1 does literally everything Host NS
50. Entrypoint Jump with tail call NIC triggers the eBPF program Node1 - 10.1.1.0/24 10.1.1.1 10.1.1.2 NIC2 Pod NIC1 Pod bpf/bpf_lxc.c Host NS
51. kube-proxy replacement NIC triggers the eBPF program Node1 - 10.1.1.0/24 10.1.1.1 NIC2 Pod2 NIC1 Pod Host NS bpf/bpf_lxc.c
52. kube-proxy replacement NIC triggers the eBPF program Node1 - 10.1.1.0/24 10.1.1.1 10.1.1.2 NIC2 Pod NIC1 Pod Lookup the Host NS dest Service bpf/bpf_lxc.c
53. kube-proxy replacement NIC triggers the eBPF program Node1 - 10.1.1.0/24 10.1.1.1 10.1.1.2 Hostthe NS Decide dest Pod NIC2 Pod NIC1 Pod bpf/bpf_lxc.c
54. kube-proxy replacement NIC triggers the eBPF program Node1 - 10.1.1.0/24 10.1.1.1 10.1.1.2 Host NS NIC2 Pod NIC1 Pod DNAT bpf/bpf_lxc.c
55. kube-proxy replacement NIC triggers the eBPF program Node1 - 10.1.1.0/24 10.1.1.1 10.1.1.2 NIC2 Pod Jump with Host NS tail call NIC1 Pod bpf/bpf_lxc.c
56. NetworkPolicy (Pod1 egress) NIC triggers the eBPF program Node1 - 10.1.1.0/24 10.1.1.1 10.1.1.2 Host NS NIC2 Pod NIC1 Pod bpf/bpf_lxc.c
57. Delivering the packet NIC triggers the eBPF program Node1 - 10.1.1.0/24 10.1.1.1 10.1.1.2 Host NS NIC2 Pod NIC1 Pod bpf/bpf_lxc.c
58. Want to use bpf_redirect_peer() Forwarding directly to dest Pod, going through NIC2 Node1 NIC2 Pod2 NIC1 Pod1 Host NS
59. Want to use bpf_redirect_peer() Forwarding directly to dest Pod, going through NIC2 Node1 NIC2 Pod2 NIC1 NIC2 can’t trigger Pod1 eBPF! Host NS
60. Want to use bpf_redirect_peer() Forwarding directly to dest Pod, going through NIC2 NIC2 Pod2 NIC1 NIC1 to Node1 -need 10.1.1.0/24 handle Pod2 Pod1 ingress policy too Host NS
61. NetworkPolicy (Pod2 ingress) NIC triggers the eBPF program Node1 NIC2 Pod2 NIC1 Pod1 bpf/bpf_lxc.c Host NS
62. Delivering the packet NIC triggers the eBPF program Node1 NIC2 Pod2 NIC1 Pod1 bpf/bpf_lxc.c Host NS
63. Delivering the packet NIC triggers the eBPF program Node1 NIC2 Pod2 NIC1 Pod1 bpf/lib/local_delivery.h Host NS bpf/include/bpf/ctx/skb.h
64. Delivering the packet NIC triggers the eBPF program Node1 This is bpf/lib/local_delivery.h NIC1 bpf_redirect_peer() Pod1 NIC2 Pod2 Host NS bpf/include/bpf/ctx/skb.h
65. Cilium eBPF delivers the packet with bpf_redirect_peer() Node1 NIC2 Pod2 NIC1 Pod1 Host NS
66. Cilium eBPF delivers the packet with bpf_redirect_peer() Node1 NIC2 Pod2 NIC1 Pod1 Host NS
67. Cilium eBPF delivers the packet with bpf_redirect_peer() Cilium handles packets entirely with Pod1 Host NS eBPF programs ! Node1 NIC1 NIC2 Pod2
68. What eBPF enabled in Kubernetes networking
69. Pros & cons of full eBPF • Pros: customizability ◦ Implemented in code = fine-grained control ◦ Enables very advanced optimization • Cons: complexity ◦ Cilium has to handle the full complexity of Kubernetes networking itself
70. kube-proxy replacement NIC triggers the eBPF program Node1 - 10.1.1.0/24 10.1.1.1 NIC2 Pod2 NIC1 Pod Host NS bpf/bpf_lxc.c
71. Delivery with bpf_redirect_peer() Forwarding directly to dest Pod Node1 NIC2 Pod2 NIC1 Pod1 Host NS
72. netkit device • eBPF-native alternative of veth
73. Cilium expands the optimization possibilities with eBPF! https://docs.cilium.io/en/stable/operations/performance/tuning/
74. Quick Shout-out: KubeAuto Day Meet Kelsey Hightower this evening!
75. Thank you! Let’s have a nice KubeCon!!