Improve performance and security for containers using Kuryr and Cilium

Cilium is on open source project which implements Kubernetes network policies and provides container network security by using eBPF and XDP packet filtering in the Linux kernel. Kuryr is the OpenStack project that enables native Neutron-based networking in Kubernetes. In this talk we will describe the work that we've done to provide Cilium as CNI plugin and how we used Kuryr to integrate it into OpenStack. We will demonstrate how to deploy and configure a Kubernetes cluster using the Cilium-Kuryr integration. We will explain how Cilium provides L7 network policies and its "native routing" mode, where it just allows any routing daemon to route the traffic. We will illustrate Cilium's features using concrete examples. Thanks to native packet filtering Cilium boosts performance, we will show tests results to measure how Cilium improves throughput compared to other CNI plugins.

Transcript

1. Improve Performance and Security for Containers using Kuryr and Cilium Michal Rostecki Software Engineer mrostecki@suse.com Rossella Sblendido Team Lead Networking rsblendido@suse.com
2. BPF From https://github.com/cilium/cilium
3. Cilium architecture From https://github.com/cilium/cilium
4. Introducing Kuryr From http://superuser.openstack.org/articles/networking-kubernetes-kuryr/
5. Packet traversal vanilla Kuryr
6. Why Cilium + Kuryr? • Support for Network Policies in Kubernetes • Using BPF as an underlying mechanism for Network Policies, to avoid using iptables
7. Integration: how it works in our experiment • Kuryr-kubernetes controller is running as a deployment • Kuryr-kubernetes CNI plugin is not used • Cilium CNI plugin is used instead • Direct routing mode is used in Cilium
8. Integration: challenges • Cilium CNI plugin had to be extended to: ◦ read the OVS bridge name and information about allocated IP from pod annotations ◦ create OVS VIFs
9. How the integration works in the experiment User Neutron Kuryr ctrl K8S API Kubelet Cilium CNI Create pod Create pod API object Add annotation with Neutron port data Create port Create pod sandbox and containers Call CNI plugin to set up netns Read pod annotation with Neutron port data Create OVS VIF Create Cilium endpoint Request port creation
10. New possibilities • Cilium in version 1.4 will have decoupled bits of: ◦ Networking ◦ Load balancing ◦ Policy • The goal of that decoupling is to be able to use i.e. load balancing and policy bits from Cilium and networking from any other plugin. There is an ongoing work on Cilium-Flannel integration. • Perfect opportunity for implementing Kuryr support upstream.
11. How the integration should look like User Neutron Kuryr ctrl K8S API Kubelet Kuryr CNI Create pod Create pod API object Add annotation with Neutron port data Create port Create pod sandbox and containers Call CNI plugin to set up netns Read pod annotation with Neutron port data Create OVS VIF Create Cilium policy Request port creation Cilium
12. Packet traversal with Cilium BPF prog 2 BPF prog 1
13. Demo time!
14. Demo • Applications simulating Star Wars (station and starfighters) on Kubernetes. • Tie Fighter (Empire) should have an access to Death Star. • X-Wing (Alliance) should not have an access to Death Star.
15. Demo From https://github.com/cilium/cilium
16. Future work • Provide support for Kubernetes Services • Provide support for load balancing • Gating upstream