Cfgmgmtcamp 2023 — eBPF Superpowers

eBPF Superpowers
Raphaël Pinson | @raphink | @raphink@mastodon.social
A dynamic Kernel
Solutions Architect, Isovalent

⬢ What is eBPF?
eBPF Superpowers
A dynamic Kernel

⬢ What is eBPF?
⬢ Principles
eBPF Superpowers
A dynamic Kernel

⬢ What is eBPF?
⬢ Principles
⬢ Observability
eBPF Superpowers
A dynamic Kernel

⬢ What is eBPF?
⬢ Principles
⬢ Observability
⬢ Networking
eBPF Superpowers
A dynamic Kernel

⬢ What is eBPF?
⬢ Principles
⬢ Observability
⬢ Networking
⬢ Security
eBPF Superpowers
A dynamic Kernel

⬢ What is eBPF?
⬢ Principles
⬢ Observability
⬢ Networking
⬢ Security
⬢ The Future
eBPF Superpowers
A dynamic Kernel

⬢ What is eBPF?
⬢ Principles
⬢ Observability
⬢ Networking
⬢ Security
⬢ The Future
⬢ Practical Labs
eBPF Superpowers
A dynamic Kernel

The Linux Kernel
The Power Behind Modern Technology
- From cars to servers to fridges
- Foundation of the GNU/Linux operating system
- Most widely used operating system in the world
- Powers the vast majority of:
- embedded systems / IoT
- Cloud Server
- Super Computers
@raphink | @raphink@mastodon.social

Before

With

Have you used eBPF?
eBPF is already used in many places
- Load balancing
- DDOS protection on large Internet platforms
- Kernel live-patching (5.7+ with LSM/eBPF)
- Android (e.g. app data stats)

Who am I
Raphaël Pinson
Solutions Architect @ Isovalent

Makes the Linux kernel
programmable in a
secure and efficient way.
“What JavaScript is to the
browser, eBPF is to the
Linux Kernel”

eBPF Superpowers
A dynamic Kernel
⬢ What is eBPF?
⬢ Principles
⬢ Observability
⬢ Networking
⬢ Security
⬢ The Future
⬢ Practical Labs

How does it work?

eBPF Helpers

Stacks & hooks

BPF / user-space communication

SDK (cilium/ebpf)

Safety

Performance

Cloud Native Identities

eBPF Projects & SDKs

Cilium & Friends
- performance gains
(no need for iptables, bypass TCP/IP)
- simpler architecture
(e.g. no sidecar proxy for Service Mesh)
Cilium

Cilium & Friends
Hubble
- fine-grained network observability
- exports to SIEM
- support for OpenTelemetry
- performance gains
Cilium

Cilium & Friends
Tetragon
- observe & export kernel events
- act on events (e.g. SIGKILL)
- performance gains
Cilium
Hubble
- fine-grained network observability
- exports to SIEM
- support for OpenTelemetry

Observability
Observe directly in the kernel
- Low-overhead tracing/observability
- Example: network performance / SRTT / micro-bursts
- HTTP / TLS in-kernel visibility
- Troubleshooting prod on the fly (see bpftrace)

Observability
Example software
- BCC
- bpftrace
- Pixie
- Cilium (network)
- Cilium Tetragon (system)
Observe directly in the kernel
- Low-overhead tracing/observability
- Example: network performance / SRTT / micro-bursts
- HTTP / TLS in-kernel visibility
- Troubleshooting prod on the fly (see bpftrace)

Observability: bpftrace

Observability: Hubble (CLI)
$ kubectl get pods
NAME READY STATUS RESTARTS AGE
tiefighter 1/1 Running 0 2m34s
xwing 1/1 Running 0 2m34s
deathstar-5b7489bc84-crlxh 1/1 Running 0 2m34s
deathstar-5b7489bc84-j7qwq 1/1 Running 0 2m34s
$ hubble observe --follow -l class=xwing
# DNS lookup to coredns
default/xwing:41391 (ID:16092) -> kube-system/coredns-66bff467f8-28dgp:53 (ID:453) to-proxy FORWARDED (UDP)
kube-system/coredns-66bff467f8-28dgp:53 (ID:453) -> default/xwing:41391 (ID:16092) to-endpoint FORWARDED (UDP)
# ...
# Successful HTTPS request to www.disney.com
default/xwing:37836 (ID:16092) -> www.disney.com:443 (world) to-stack FORWARDED (TCP Flags: SYN)
www.disney.com:443 (world) -> default/xwing:37836 (ID:16092) to-endpoint FORWARDED (TCP Flags: SYN, ACK)
www.disney.com:443 (world) -> default/xwing:37836 (ID:16092) to-endpoint FORWARDED (TCP Flags: ACK, FIN)
default/xwing:37836 (ID:16092) -> www.disney.com:443 (world) to-stack FORWARDED (TCP Flags: RST)
# ...
# Blocked HTTP request to deathstar backend
default/xwing:49610 (ID:16092) -> default/deathstar:80 (ID:16081) Policy denied DROPPED (TCP Flags: SYN)

Observability: Hubble (UI)

Observability: Cilium + Grafana ❤️

Observability: Network Metrics (Hubble)

Observability: HTTP Metrics (Hubble)

Observability: Network Policy Verdicts

Observability: TLS (Tetragon)

Observability: Combined Network & Runtime

Networking
Bypass native kernel network stack:
- eXpress Data Path (XDP)
- TCP improvements (bandwidth manager, BBR, Big TCP)
- NAT64/NAT46
- Performant load-balancing algorithms (Maglev)
- Network Policies
- Cluster Mesh
- Egress Gateway
- Sidecar-free service mesh
- etc.

Networking: XDP
Drop packets before they reach the kernel
- E.g. packet of death, DDOS
- XDP allows to drop packets before
they reach the kernel routing stack

Networking: XDP
Efficient Cloud Native LB
- E.g. Socket Load Balancer
Drop packets before they reach the kernel
- E.g. packet of death, DDOS
- XDP allows to drop packets before
they reach the kernel routing stack

Networking: IPtables vs eBPF
kube-proxy / iptables
- Linear list / sieve
- All rules have to be replaced as a whole
eBPF based
- Per-CPU hash table ⇒ more performant
- Native metadata (e.g. Pod labels) ⇒ Cloud Native routing
🏆

Networking: BBR (TCP Congestion)
@raphink | @raphink@mastodon.social https://isovalent.com/blog/post/accelerate-network-performance-with-cilium-bbr/

Networking: NAT46/NAT64
IPv6 / IPv4 bridge
DNS64
NAT64
[64:ff9b::<z>] -> [<z>]
IPv6 Single Stack
K8s cluster
bar.com
A 4.3.2.1
DNS
bar.com
AAAA 64:ff9b::4.3.2.1
SYN 64:ff9b::4.3.2.1
IPv4 / Internet
SYN 4.3.2.1
ext. node
(Dual Stack)
https://www.youtube.com/watch?v=Kvdh78TURck

Networking: BIG TCP
https://www.youtube.com/watch?v=Kvdh78TURck
Back to back: AMD Ryzen 9 3950X @ 3.5 GHz, 128G RAM @ 3.2 GHz, PCIe 4.0, ConnectX-6 Dx, mlx5 driver
netperf -t TCP_RR -H <remote pod> -- -r 80000,80000 -O MIN_LATENCY,P90_LATENCY,P99_LATENCY,THROUGHPUT
2.2x lower p99 latency

Networking: Sidecar-free Service Mesh

Security
Observe and manipulate kernel events in real time
- Performant and transparent process visibility
- Metadata
- Fix kernel bugs on the fly
- Catch & kill

Security Visibility & Enforcement
Traditional approaches
- App instrumentation / LD_PRELOAD ⇒ bypassed by statically linked executables
- ptrace(2) ⇒ TOCTTOU with syscalls
- Existing Kernel Runtime Enforcement ⇒ can benefit from BPF (BPF LSM with kernel 5.7+)
- Kernel module ⇒ stability & maintenance

Security Visibility & Enforcement with eBPF

Security: Catch & Kill

To Infinity…
… and beyond 🚀
- Improved device I/O perf with eBPF (XRP)
- Support for 100% of C (in a safe way)
- Cross-platform:
- archs
- compilers (LLVM/gcc)
- platforms (Linux, Windows, etc.)
- Towards a micro-kernel approach?

All major cloud providers have picked
-based Networking & Security
for their Kubernetes platforms
How about you?

eBPF resources
eCHO
eBPF YouTube podcast:
https://www.youtube.com/channel/UCJFUxkVQTBJh3LD1wYB
WvuQ
eBPF & Cilium Slack
http://slack.cilium.io/
eCHO News
Bi-weekly eBPF newsletter:
https://cilium.io/newsletter/

Practical Labs
… to become a Cilium & eBPF Jedi
📅 Come tomorrow 2023-02-08, 09:00–13:00
🏛️ In room B.2.015
💻 Bring your laptop (web-based labs)
Get badges 🏅 and goodies 👕!

Cfgmgmtcamp 2023 — eBPF Superpowers

More Related Content

Similar to Cfgmgmtcamp 2023 — eBPF Superpowers

More from Raphaël PINSON

Recently uploaded

Cfgmgmtcamp 2023 — eBPF Superpowers

Editor's Notes