Upgrade to Pro — share decks privately, control downloads, hide ads and more …

The Cilium Story - Why We Created Cilium

The Cilium Story - Why We Created Cilium

Cilium is well known today but why did we create it? This talk takes us back to the origins of Cilium. Together, we explore the adventure that led to the creation of the first few lines of Cilium source code. What was the vision? How close was it to what Cilium has become today? As we make our way exploring the many Cilium milestones, we look back to Cilium's roots in Switzerland, the many surprises on the way, and the major milestones that put Cilium on the trajectory it is today.

Thomas Graf

April 18, 2023
Tweet

More Decks by Thomas Graf

Other Decks in Technology

Transcript

  1. Thomas Graf, Isovalent
    Co-Creator Cilium
    The Cilium
    Story
    Why we created Cilium

    View Slide

  2. - Networking
    - Security
    - Observability
    - Service Mesh & Ingress
    -based:
    Foundation
    Created by
    Technology
    Scalable, Secure,
    High Perfomance
    Networking
    Sidecar-free Service
    Mesh, Ingress, &
    Gateway API
    Security Observability &
    Runtime Enforcement
    Network
    Observability &
    Monitoring
    Cilium
    CNI
    Tetragon
    Cilium
    Service Mesh
    Hubble

    View Slide

  3. The Origins

    View Slide

  4. First Cilium Commit

    View Slide

  5. But First, we had
    to make it possible

    View Slide

  6. Makes the Linux kernel
    programmable in a
    secure and efficient
    way.
    “What JavaScript is to the
    browser, eBPF is to the
    Linux Kernel”
    Process
    Scheduler
    execve()
    Linux
    Kernel
    Syscall

    View Slide

  7. Origins of eBPF
    PlumGrid Crew: Pere Monclus, Brenden Blanco, Alexei Starovoitov
    Daniel Borkmann, Alexei, & Thomas discussing eBPF in the
    PlumGrid office
    Alexei Starovoitov

    View Slide

  8. eBPF Superpowers
    Brendan Gregg

    View Slide

  9. Daniel Borkmann speaking about eBPF
    eBPF
    Community Passion
    Brenden (VMware), Alexei (FB), Daniel (Isovalent) discussing
    the eBPF verifier at the Facebook booth

    View Slide

  10. Picture from a recent eBPF Kernel Conference with David S. Miller
    (Linux Kernel Networking Maintainer)

    View Slide

  11. The Founding

    View Slide

  12. From Left to Right:
    ● Thomas Graf
    ● Daniel Borkmann
    ● Madhu Challa
    ● Andre Martins
    25 Years Linux Birthday Party, Linux Foundation Event
    Early Cilium Presentation, ioVisor Summit
    Cilium Founding Team

    View Slide

  13. 1st Cilium Design Summit
    Cilium Design Summit, Diavolezza, Switzerland
    The moment we
    realized that
    observability
    matters

    View Slide

  14. - IPv6 Only
    - Built for Containers
    - Scalable & Flat L3
    - Identity-based security
    First Conference Talks

    View Slide

  15. Thomas Graf
    Co-Founder & CTO
    Dan Wendlandt,
    Co-Founder & CEO
    Isovalent
    Martin Casado
    General Partner, a16z
    Liz Rice
    Chief Open Source
    Officer
    Cilium joins CNCF
    Umesh Padval
    Venture Partner,
    Thomvest

    View Slide

  16. “We chose Cilium because
    we were looking for a simple
    solution, a resilient solution,
    and one which is ready for
    day two operations.“
    – Alex Berger, Chief Architect
    Cilium is a critical part of the
    Datadog network stack as it
    provides consistent Kubernetes
    networking across cloud
    providers as well as performant
    and secure communications,
    thanks to eBPF.
    – Laurent Bernaille, Staff Engineer
    The Beginning

    View Slide

  17. DockerCon
    2017

    View Slide

  18. “We are a bank. Everything
    is security first. We had to
    have a way to audit the
    network traffic down to the
    specific application that
    initiated the connection.”
    – Bradley Whitfield,
    Senior Lead Platform Engineer
    “We choose Cilium as it
    supports Network Policies at
    Layer 3/4/7, Cloud agnostic
    & easy to deploy anywhere.”
    – Adelina Simion,
    Technology Evangelist
    Network Policy

    View Slide

  19. Batman
    Visits
    From Left To Right: Thomas, Batman, Cynthia Thomas
    Dan, Cynthia, Thomas

    View Slide

  20. Getting an Office
    Martynas Pumputis (author kube-proxy replacement) performing engineering tasks
    New Logo
    Design
    Happy Birthday
    Andre Martins
    (Cilium Maintainer)

    View Slide

  21. “With Hubble, we are able to
    get easy traceability of
    network calls associated to
    a Kubernetes pod.”
    – Vlad Ungureanu, Backend
    Software Engineer
    Hubble

    View Slide

  22. Hubble UI
    Network
    Policy Editor

    View Slide

  23. Starting to
    Grow
    KubeCon! (Arvind Soni, Andre Martins, Ian Vernon)
    2K GitHub
    Stars
    Celebration
    Michi & Joe
    Cilium Maintainers

    View Slide

  24. “What makes Cilium Cluster
    Mesh unique in our opinion is:
    ● Cross cluster Service
    Discovery
    ● Cross cluster Service
    Load Balancing
    ● Cross Cluster Network
    Policies”
    – Karsten Nielsen, Senior Systems
    Engineer, Swedish Home
    Furnishings Retailer
    Cluster Mesh

    View Slide

  25. The Swiss Roots
    Live On
    Fondue in
    an AirBnB,
    Palo Alto
    Snow Chain
    Incident,
    Julier Pass
    (Product Manager
    is looking up
    tutorial on
    YouTube)
    Glib Smaga
    Hubble Maintainer
    and team
    Zurich Offsite

    View Slide

  26. Things get crazy…
    AWS picks Cilium for EKS-A
    Google picks Cilium for GKE & Anthos
    Cilium joins the CNCF

    View Slide

  27. Security Observability &
    Runtime Enforcement

    View Slide

  28. Tetragon

    View Slide

  29. eBPF & Cilium Team Spirits
    Duffie Cooley
    Summer Hike, Cilium Team Europe
    CI Testing of Floating Equipment,
    Cilium Team US

    View Slide

  30. Microsoft picks Cilium for AKS
    eBPF for Windows & Cilium for AKS

    View Slide

  31. Isovalent & Grafana Labs
    Strategic Partnership

    View Slide

  32. We Keep Growing….
    … and skiing

    View Slide

  33. The Team Grows
    Bill Mulligan,
    Cilium Community Pollinator
    Isovalent Work Uniform
    Watching Star Wars
    :jibicibation:

    View Slide

  34. The advantages of a service mesh
    without the management overhead of
    running Istio or Linkerd is mind-blowing
    – Staff Software Engineer,
    Popular Fitness App
    Cilium Service Mesh

    View Slide

  35. Service Mesh

    View Slide

  36. We don’t always ski
    Liz Rice, Cilium Maintainer,
    Chief Open Source Officer
    Cilium Team Ride in Swiss Mountains
    Sebastian Wicki, Hubble Maintainer
    …sometimes we bike

    View Slide

  37. or walk if we have to
    Kornilios, Nathalia, Maciej, Tobias, Timo, Nicolas, Tom
    Quentin & Team

    View Slide

  38. What is Next?

    View Slide

  39. View Slide

  40. mTLS Support
    for Network Policy
    mTLS via just Network Policy,
    no service mesh needed
    SPIFFE Integration
    Roadmap Highlights
    Certificate management via
    SPIFFE/SPIRE + SPIFFE ID
    selector matching
    Day 2 Ops

    View Slide

  41. One more…

    View Slide

  42. Cilium Mesh
    One Mesh to Connect Them All
    Connect!

    View Slide

  43. Cilium Mesh
    One Mesh to Connect Them All

    View Slide

  44. Cilium Mesh
    Connect!
    One Mesh to Connect Them All
    Principle #1:
    Combines all Cilium
    components into a single
    mesh:
    - Kubernetes Networking
    (CNI)
    - Cluster Mesh (Multi-Cluster)
    - Ingress & Egress Gateway
    - Load Balancer
    - Service Mesh
    Principle #2:
    Connects Kubernetes, VMs, and Servers across
    cloud, on-prem, and edge.

    View Slide

  45. Thank you!
    isovalent.com

    View Slide