This talk demonstrates that programmability and performance does not require user space networking, it can be achieved in the kernel by generating BPF programs and leveraging the existing kernel subsystems. We will demo an early prototype which provides fast IPv6 & IPv4 connectivity to containers, container labels based security policy with avg cost O(1), and debugging and monitoring based on the per-cpu perf ring buffer. We encourage a lively discussion on the approach taken and next steps.

3. ●
○
○
⇒
⇒
●
●

4. ●
○
●
○
○
●

6. ●
○
○
○
●
○
○

7. ●
●
○
○
Frontend BackendLB
FE BE
LB
LB
FE
FE BE
LB

8. ●
●
○
○
Frontend BackendLB
FE BE
LB
LB
FE
FE BE
LB
Prod
Frontend BackendLB
FE BELB
QA
Prod
QA
Prodrequires
requires QA
QA

9. ●
○
FE
BE
LB Prod
QA
Prod
Prod
FE
BE
LB
QA
QA
10
11
12
13
14
15
16
Cluster Wide Label ID Table: This ID is carried in the network packet and used
to reconstruct the label context at the receiving
host.
Policy enforcement cost is reduced to a
single hashtable lookup regardless of
complexity.

10. ●
●
●
FE
BE
LB
LB
ECMP
FE
FE
BE
BE
BE
Small HTTP GET
Ultra HD Cat Pictures/Videos

12. Intel Xeon 3.5Ghz Sandy Bridge, 24 cores,
1 TCP flow per core, netperf -t TCP_SENDFILE, 10’000 policies

15. ●
●
●
●
●
●
●
●
●
●
●
●
●