Explore the World of Cilium, Tetragon & eBPF

Come explore the World of Cilium with us!

In this workshop, you'll have the opportunity to discover about Cilium and Tetragon, and the kernel technology that makes them possible, eBPF.

Through a collection of hands-on labs (available at https://labs-map.isovalent.com/) and the presenter's support, you'll be able to explore many topics covering Cloud Native Networking, Security, and Observability. In this gamified approach, you'll also be able to earn badges for completing labs.

Whether you're a Platform Engineer, SRE, Network Engineer, SecOps Professional, Cloud Architect, and more, you'll certainly find subjects to explore in this session!

Transcript

1. Raphaël Pinson | @raphink | @raphink@mastodon.social 🧪 Cilium Alchemist, Isovalent Explore the World of Cilium, Tetragon & eBPF
2. ⬢ Principles Cilium & eBPF Cloud Native Networking & Security
3. ⬢ Principles ⬢ Networking Cilium & eBPF Cloud Native Networking & Security
4. ⬢ Principles ⬢ Networking ⬢ Cluster Mesh Cilium & eBPF Cloud Native Networking & Security
5. ⬢ Principles ⬢ Networking ⬢ Cluster Mesh ⬢ Security Cilium & eBPF Cloud Native Networking & Security
6. ⬢ Principles ⬢ Networking ⬢ Cluster Mesh ⬢ Security ⬢ Observability Cilium & eBPF Cloud Native Networking & Security
7. ⬢ Principles ⬢ Networking ⬢ Cluster Mesh ⬢ Security ⬢ Observability ⬢ Service Mesh Cilium & eBPF Cloud Native Networking & Security
8. ⬢ Principles ⬢ Networking ⬢ Cluster Mesh ⬢ Security ⬢ Observability ⬢ Service Mesh ⬢ Tetragon Cilium & eBPF Cloud Native Networking & Security
9. Who am I Raphaël Pinson Cilium Alchemist @ Isovalent CNCF Ambassador
10. ⬢ Principles ⬢ Networking ⬢ Cluster Mesh ⬢ Security ⬢ Observability ⬢ Service Mesh ⬢ Tetragon Cilium & eBPF Cloud Native Networking & Security
11. • Open Source Projects • Company behind Cilium • Provides Cilium Enterprise
13. Makes the Linux kernel programmable in a secure and efficient way. “What JavaScript is to the browser, eBPF is to the Linux Kernel”
14. Run eBPF programs on events Attachment points • Kernel functions (kprobes) • Userspace functions (uprobe) • System calls • Tracepoints • Sockets (data level) • Network devices (packet level) • Network device (DMA level) [XDP] • ...
15. eBPF documentary https://isogo.to/ebpf-documentary
16. What is Cilium? At the foundation of Cilium is the new Linux kernel technology eBPF, which enables the dynamic insertion of powerful security, visibility, and networking control logic within Linux itself. Besides providing traditional network level security, the flexibility of BPF enables security on API and process level to secure communication within a container or pod. Read More • Networking & Load-Balancing ◦ CNI, Kubernetes Services, Multi-cluster, VM Gateway • Network Security ◦ Network Policy, Identity-based, Encryption • Observability ◦ Metrics, Flow Visibility, Service Dependency
18. - Networking - Security - Observability - Service Mesh & Ingress -based: Foundation Created by Technology
19. Cilium has Graduated!
20. ⬢ Principles ⬢ Networking ⬢ Cluster Mesh ⬢ Security ⬢ Observability ⬢ Service Mesh ⬢ Tetragon Cilium & eBPF Cloud Native Networking & Security
21. Kubernetes Networking Networking plugin • Network devices • IP Address Management • Intra-node connectivity • Inter-node connectivity Kube Proxy • Services • iptables or ipvs • Service discovery
22. Kubernetes Networking • Agent on each node • Tunneling or Direct Routing • eBPF native dataplane • kube-proxy replacement.
23. Kubernetes Services East-west connectivity • Durable abstraction • Connect applications • Ephemeral addresses • High churn • Iptables or ipvs
24. Kubernetes Services kube-proxy / iptables • Linear list / sieve • All rules have to be replaced as a whole eBPF based • Per-CPU hash table ⇒ more performant • Native metadata => Cloud Native routing
25. Egress Gateway
26. Platform Integration
27. node1 30 pod 192.168.1.1 pod 192.168.1.4 CiliumNode CRD metadata: name: node1 spec: eni: instance-id: i-123 instance-type: m4.large preallocate: “8” security-groups: - sg1 - sg2 ipam: available: - 192.168.1.1 - 192.168.1.2 - 192.168.1.3 - 192.168.1.4 status: ipam: used: - 192.168.1.1 - 192.168.1.4 Agent Report used IPs Use IPs Operator Make IPs available Init Read ENI parameters Native Cloud Support Alibaba, AWS, Azure, Google
28. ⬢ Principles ⬢ Networking ⬢ Cluster Mesh ⬢ Security ⬢ Observability ⬢ Service Mesh ⬢ Tetragon Cilium & eBPF Cloud Native Networking & Security
29. Cluster Mesh - Introduction
30. Cluster Mesh - High Availability
31. Cluster Mesh - Shared Services
32. Cluster Mesh - Splitting Services
33. Cluster Mesh - Local Service Affinity
34. Cluster Mesh - Remote Service Affinity
35. Cluster Mesh - Local Service Affinity
36. Cluster Mesh - Remote Service Affinity
37. Cluster Mesh with Service Mesh Canary Rollout to other Cluster
38. ⬢ Principles ⬢ Networking ⬢ Cluster Mesh ⬢ Security ⬢ Observability ⬢ Service Mesh ⬢ Tetragon Cilium & eBPF Cloud Native Networking & Security
39. Identity-based Security
40. API-aware Authorization
41. Cassandra Cilium Network Policy Example
42. DNS-aware Cilium Network Policy
43. L3 Matching Capabilities Kubernetes • Pod labels • Namespace name & labels • ServiceAccount name • Service names • Cluster names DNS Names • FQDN and regular expression CIDR • CIDR blocks with exceptions Cloud Providers • Instance labels • VPC/Subnet name/tags • Security group name Logical Entities • Everything inside cluster • Everything outside cluster • Local host • ...
44. ⬢ Principles ⬢ Networking ⬢ Cluster Mesh ⬢ Security ⬢ Observability ⬢ Service Mesh ⬢ Tetragon Cilium & eBPF Cloud Native Networking & Security
45. What is Hubble?
46. Flow Visibility $ kubectl get pods NAME READY STATUS RESTARTS AGE tiefighter 1/1 Running 0 2m34s xwing 1/1 Running 0 2m34s deathstar-5b7489bc84-crlxh 1/1 Running 0 2m34s deathstar-5b7489bc84-j7qwq 1/1 Running 0 2m34s $ hubble observe --follow -l class=xwing # DNS lookup to coredns default/xwing:41391 (ID:16092) -> kube-system/coredns-66bff467f8-28dgp:53 (ID:453) to-proxy FORWARDED (UDP) kube-system/coredns-66bff467f8-28dgp:53 (ID:453) -> default/xwing:41391 (ID:16092) to-endpoint FORWARDED (UDP) # ... # Successful HTTPS request to www.disney.com default/xwing:37836 (ID:16092) -> www.disney.com:443 (world) to-stack FORWARDED (TCP Flags: SYN) www.disney.com:443 (world) -> default/xwing:37836 (ID:16092) to-endpoint FORWARDED (TCP Flags: SYN, ACK) www.disney.com:443 (world) -> default/xwing:37836 (ID:16092) to-endpoint FORWARDED (TCP Flags: ACK, FIN) default/xwing:37836 (ID:16092) -> www.disney.com:443 (world) to-stack FORWARDED (TCP Flags: RST) # ... # Blocked HTTP request to deathstar backend default/xwing:49610 (ID:16092) -> default/deathstar:80 (ID:16081) Policy denied DROPPED (TCP Flags: SYN) Flow Metadata ‒ Ethernet headers ‒ IP & ICMP headers ‒ UDP/TCP ports, TCP flags ‒ HTTP, DNS, Kafka, ... Kubernetes ‒ Pod names and labels ‒ Service names ‒ Worker node names DNS (if available) ‒ FQDN for source and destination Cilium ‒ Security identities and endpoints ‒ Drop reasons ‒ Policy verdict matches
47. Service Map
48. Cilium & Grafana Integration
49. ⬢ Principles ⬢ Networking ⬢ Cluster Mesh ⬢ Security ⬢ Observability ⬢ Service Mesh ⬢ Tetragon Cilium & eBPF Cloud Native Networking & Security
50. Introduction
51. Bring your own Control Plane
52. Service Mesh Evolution
53. Sidecar vs per-Node Proxy Total number of proxies required
54. Traffic Management - L3/L4 forwarding & Load-balancing - Canary, Topology Aware Routing - Multi-cluster Security - Network Policy - mTLS Observability - Tracing, OpenTelemetry, & Metrics - HTTP, TLS, DNS, TCP, UDP, … eBPF Native (no sidecar) Proxy Traffic Management - L7 Load-balancing & Ingress Resilience - Retries, L7 Rate Limiting Security - TLS Termination & Origination When eBPF cannot do it Whenever possible
55. Performance Impact of a Sidecar
56. ⬢ Principles ⬢ Networking ⬢ Cluster Mesh ⬢ Security ⬢ Observability ⬢ Service Mesh ⬢ Tetragon Cilium & eBPF Cloud Native Networking & Security
57. @lizrice Cilium Tetragon • New open source project in Cilium • eBPF based = high performance and zero modifications required to app • Hooks into kernel functions after parameters are copied • Adds contextual information about Kubernetes objects • Preventative capabilities github.com/cilium/tetragon
58. Tetragon
59. Process Tree View
60. OSS Community eBPF-based Networking, Observability, Security cilium.io cilium.slack.com Regular news Learn more! Base technology The revolution in the Linux kernel, safely and efficiently extending the capabilities of the kernel. ebpf.io What is eBPF? - ebook For the Enterprise Hardened, enterprise-grade eBPF-powered networking, observability, and security. isovalent.com/product isovalent.com/labs
62. Practical Labs … to become a Cilium & eBPF Jedi Get badges 🏅 @raphink | @raphink@mastodon.social
63. Which eBee are you? @raphink | @raphink@mastodon.social Cloud Network Engineer Platform Engineer SecOps Engineer https://isogo.to/cfgmgmtcamp24
64. All major cloud providers have picked -based Networking & Security for their Kubernetes platforms @raphink | @raphink@mastodon.social How about you?
65. eBPF resources eCHO eBPF YouTube podcast: https://www.youtube.com/channel/UCJFUxkVQTBJh3LD1wYB WvuQ eBPF & Cilium Slack http://slack.cilium.io/ eCHO News Bi-weekly eBPF newsletter: https://cilium.io/newsletter/ @raphink | @raphink@mastodon.social
66. Thank you!