Liz Rice Chief Open Source Officer, Isovalent Chair, CNCF Technical Oversight Committee @lizrice eBPF  Superpowers for Networking, Observability & Security

@lizrice extended Berkeley Packet Filter What is eBPF?

@lizrice Makes the kernel programmable What is eBPF?

@lizrice userspace kernel app eBPF program event Run custom code in the kernel

@lizrice demo github.com/lizrice/ebpf-beginners

@lizrice SEC("kprobe/sys_execve") int hello(void *ctx) { bpf_printk("I'm alive!"); return 0; } eBPF Hello World $ sudo ./hello bash-20241 [004] d... 84210.752785: 0: I'm alive! bash-20242 [004] d... 84216.321993: 0: I'm alive! bash-20243 [004] d... 84225.858880: 0: I'm alive! Info about process that called execve syscall + userspace code to load eBPF program

@lizrice Programmable kernel in Kubernetes land

@lizrice userspace kernel pod container pod container container One kernel per host

@lizrice userspace kernel app app pods networking access files create containers One kernel per host

@lizrice userspace kernel app app pods networking access files create containers Kernel aware of everything on the host

@lizrice userspace app kernel app pods networking access files create containers eBPF programs can be aware of everything

@lizrice demo Kubernetes-aware network flows

@lizrice

@lizrice eBPF apps have a view across the entire node

@lizrice eBPF apps have a view across the entire node enabling network efficiency

@lizrice host pod app socket veth veth eth0 iptables conntrack iptables INPUT Linux routing iptables PREROUTING mangle iptables conntrack iptables FORWARD Linux routing iptables PREROUTING nat iptables POSTROUTING mangle iptables PREROUTING mangle iptables POSTROUTING nat

@lizrice host pod app socket veth veth eth0 iptables conntrack iptables INPUT Linux routing iptables PREROUTING mangle Linux routing

@lizrice Cilium eBPF Receive path) https://cilium.io/blog/2021/05/11/cni-benchmark

@lizrice TCP RR  higher is better https://cilium.io/blog/2021/05/11/cni-benchmark

@lizrice eBPF apps have a view across the entire node

@lizrice eBPF apps have a view across the entire node without any app or config changes

@lizrice - Nathan LeClaire @dotpem

@lizrice userspace pod container sidecar container A sidecar has a view across one pod

@lizrice userspace pod container sidecar container my-app.yaml containers: - name: my-app ... - name: my-app-init … - name: my-sidecar ... Sidecars need YAML

@lizrice userspace pod container container my-app.yaml containers: - name: my-app ... - name: my-app-init … eBPF does not need any app changes kernel

@lizrice eBPF in cloud native

@lizrice Process visibility

@lizrice eBPF makes the Linux kernel programmable

@lizrice Not just for Linux... Not just for Linux...

ebpf.io | cilium.io | isovalent.com @lizrice Thank you