Networking, Observability, and Security for the Cloud Native world

1. Cloud Native
Networking & Security
with Cilium & eBPF
Speaker: Raphaël Pinson

2. Who am I
Raphaël Pinson
Solutions Architect @ Isovalent

3. Cilium & eBPF
Introduction

4. Agenda
● Cilium & eBPF Introduction
● Networking
● Cluster Mesh
● Security
● Observability
● Service Mesh
● Tetragon

5. ● Open Source Projects ● Company behind Cilium
● Provides Cilium Enterprise

6. What is Cilium?
At the foundation of Cilium is the new Linux kernel
technology eBPF, which enables the dynamic
insertion of powerful security, visibility, and networking
control logic within Linux itself. Besides providing
traditional network level security, the flexibility of BPF
enables security on API and process level to secure
communication within a container or pod.
Read More
● Networking & Load-Balancing
○ CNI, Kubernetes Services, Multi-cluster, VM Gateway
● Network Security
○ Network Policy, Identity-based, Encryption
● Observability
○ Metrics, Flow Visibility, Service Dependency

8. Makes the Linux kernel
programmable in a
secure and efficient way.
“What JavaScript is to the
browser, eBPF is to the
Linux Kernel”

9. Run eBPF programs on events
Attachment points
● Kernel functions (kprobes)
● Userspace functions (uprobe)
● System calls
● Tracepoints
● Sockets (data level)
● Network devices (packet level)
● Network device (DMA level) [XDP]
● ...

10. - Networking
- Security
- Observability
- Service Mesh & Ingress
-based:
Foundation
Created by
Technology

12. Networking

13. Kubernetes Networking
Networking plugin
● Network devices
● IP Address Management
● Intra-node connectivity
● Inter-node connectivity
Kube Proxy
● Services
● iptables or ipvs
● Service discovery

14. Kubernetes Networking
● Agent on each node
● Tunneling or Direct Routing
● eBPF native dataplane
● kube-proxy replacement.

15. Kubernetes Services
East-west connectivity
● Durable abstraction
● Connect applications
● Ephemeral addresses
● High churn
● Iptables or ipvs

16. Kubernetes Services
kube-proxy
● Linear list
● All rules have to be replaced as a
whole
eBPF based
● Per-CPU hash table

17. Egress Gateway

18. Platform Integration

19. node1
22
pod
192.168.1.1
pod
192.168.1.4
CiliumNode CRD
metadata:
name: node1
spec:
eni:
instance-id: i-123
instance-type: m4.large
preallocate: “8”
security-groups:
- sg1
- sg2
ipam:
available:
- 192.168.1.1
- 192.168.1.2
- 192.168.1.3
- 192.168.1.4
status:
ipam:
used:
- 192.168.1.1
- 192.168.1.4
Agent
Report used IPs
Use IPs
Operator
Make IPs
available
Init
Read ENI
parameters
Native Cloud Support
Alibaba, AWS, Azure, Google

20. Cluster Mesh

21. Cluster Mesh - Introduction

22. Cluster Mesh - High Availability

23. Cluster Mesh - Shared Services

24. Cluster Mesh - Splitting Services

25. Cluster Mesh - Local Service Affinity

26. Cluster Mesh - Local Service Affinity

27. Security

28. Identity-based Security

29. API-aware Authorization

30. Cassandra Cilium Network Policy Example

31. DNS-aware Cilium Network Policy

32. L3 Matching Capabilities
Kubernetes
● Pod labels
● Namespace name & labels
● ServiceAccount name
● Service names
● Cluster names
DNS Names
● FQDN and regular expression
CIDR
● CIDR blocks with exceptions
Cloud Providers
● Instance labels
● VPC/Subnet name/tags
● Security group name
Logical Entities
● Everything inside cluster
● Everything outside cluster
● Local host
● ...

33. Observability

34. What is Hubble?

35. Flow Visibility
$ kubectl get pods
NAME READY STATUS RESTARTS AGE
tiefighter 1/1 Running 0 2m34s
xwing 1/1 Running 0 2m34s
deathstar-5b7489bc84-crlxh 1/1 Running 0 2m34s
deathstar-5b7489bc84-j7qwq 1/1 Running 0 2m34s
$ hubble observe --follow -l class=xwing
# DNS lookup to coredns
default/xwing:41391 (ID:16092) -> kube-system/coredns-66bff467f8-28dgp:53 (ID:453) to-proxy FORWARDED (UDP)
kube-system/coredns-66bff467f8-28dgp:53 (ID:453) -> default/xwing:41391 (ID:16092) to-endpoint FORWARDED (UDP)
# ...
# Successful HTTPS request to www.disney.com
default/xwing:37836 (ID:16092) -> www.disney.com:443 (world) to-stack FORWARDED (TCP Flags: SYN)
www.disney.com:443 (world) -> default/xwing:37836 (ID:16092) to-endpoint FORWARDED (TCP Flags: SYN, ACK)
www.disney.com:443 (world) -> default/xwing:37836 (ID:16092) to-endpoint FORWARDED (TCP Flags: ACK, FIN)
default/xwing:37836 (ID:16092) -> www.disney.com:443 (world) to-stack FORWARDED (TCP Flags: RST)
# ...
# Blocked HTTP request to deathstar backend
default/xwing:49610 (ID:16092) -> default/deathstar:80 (ID:16081) Policy denied DROPPED (TCP Flags: SYN)
Flow Metadata
‒ Ethernet headers
‒ IP & ICMP headers
‒ UDP/TCP ports, TCP flags
‒ HTTP, DNS, Kafka, ...
Kubernetes
‒ Pod names and labels
‒ Service names
‒ Worker node names
DNS (if available)
‒ FQDN for source and
destination
Cilium
‒ Security identities and
endpoints
‒ Drop reasons
‒ Policy verdict matches

36. Service Map

37. Service Mesh

38. Introduction

39. Bring your own Control Plane

40. Service Mesh Evolution

41. Sidecar vs per-Node Proxy
Total number of proxies required

42. Traffic Management
- L3/L4 forwarding & Load-balancing
- Canary, Topology Aware Routing
- Multi-cluster
Security
- Network Policy
- mTLS
Observability
- Tracing, OpenTelemetry, & Metrics
- HTTP, TLS, DNS, TCP, UDP, …
eBPF Native
(no sidecar)
Proxy
Traffic Management
- L7 Load-balancing & Ingress
Resilience
- Retries, L7 Rate Limiting
Security
- TLS Termination & Origination
When eBPF cannot do it
Whenever possible

43. Performance Impact of a Sidecar

44. Tetragon

45. @lizrice
Cilium Tetragon
● New open source project in Cilium
● eBPF based = high performance and zero modifications required to app
● Hooks into kernel functions after parameters are copied
● Adds contextual information about Kubernetes objects
● Preventative capabilities
github.com/cilium/tetragon

46. Tetragon

47. Process Tree View

48. OSS Community
eBPF-based Networking,
Observability, Security
cilium.io
cilium.slack.com
Regular news
Learn more!
Base technology
The revolution in the Linux kernel,
safely and efficiently extending the
capabilities of the kernel.
ebpf.io
What is eBPF? - ebook
For the Enterprise
Hardened, enterprise-grade
eBPF-powered networking,
observability, and security.
isovalent.com/product
isovalent.com/labs

49. Thank you!