Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Cilium - Container Networking with BPF & XDP

2,789 views

Published on

This talk demonstrates that programmability and performance does not require user space networking, it can be achieved in the kernel by generating BPF programs and leveraging the existing kernel subsystems. We will demo an early prototype which provides fast IPv6 & IPv4 connectivity to containers, container labels based security policy with avg cost O(1), and debugging and monitoring based on the per-cpu perf ring buffer. We encourage a lively discussion on the approach taken and next steps.

Published in: Software
  • Be the first to comment

Cilium - Container Networking with BPF & XDP

  1. 1. ● ○ ○ ⇒ ⇒ ● ●
  2. 2. ● ○ ● ○ ○ ●
  3. 3. ● ○ ○ ○ ● ○ ○
  4. 4. ● ● ○ ○ Frontend BackendLB FE BE LB LB FE FE BE LB
  5. 5. ● ● ○ ○ Frontend BackendLB FE BE LB LB FE FE BE LB Prod Frontend BackendLB FE BELB QA Prod QA Prodrequires requires QA QA
  6. 6. ● ○ FE BE LB Prod QA Prod Prod FE BE LB QA QA 10 11 12 13 14 15 16 Cluster Wide Label ID Table: This ID is carried in the network packet and used to reconstruct the label context at the receiving host. Policy enforcement cost is reduced to a single hashtable lookup regardless of complexity.
  7. 7. ● ● ● FE BE LB LB ECMP FE FE BE BE BE Small HTTP GET Ultra HD Cat Pictures/Videos
  8. 8. Intel Xeon 3.5Ghz Sandy Bridge, 24 cores, 1 TCP flow per core, netperf -t TCP_SENDFILE, 10’000 policies
  9. 9. ● ● ● ● ● ● ● ● ● ● ● ● ●

×