Accelerating Envoy and Istio with Cilium and the Linux KernelThomas Graf
This talk will provide an introduction to injection options of Envoy and then deep dive into ongoing Linux kernel work that enables injecting Envoy while introducing as little latency as possible.
The servicemesh and the sidecar proxy model are on a steep trajectory to redefine many networking and security use cases. This talk explains and demos a new socket redirect Linux kernel technology that allows running Envoy with similar performance as if the sidecar was linked to the application using a UNIX domain socket. The talk will also give an outlook on how Envoy can use the recently merged kernel TLS functionality to gain access to the clear text payload transparently for end to end encrypted applications without requiring to decrypt and re-encrypt any data to further reduce the overhead and latency.
Accelerating Envoy and Istio with Cilium and the Linux KernelThomas Graf
This talk will provide an introduction to injection options of Envoy and then deep dive into ongoing Linux kernel work that enables injecting Envoy while introducing as little latency as possible.
The servicemesh and the sidecar proxy model are on a steep trajectory to redefine many networking and security use cases. This talk explains and demos a new socket redirect Linux kernel technology that allows running Envoy with similar performance as if the sidecar was linked to the application using a UNIX domain socket. The talk will also give an outlook on how Envoy can use the recently merged kernel TLS functionality to gain access to the clear text payload transparently for end to end encrypted applications without requiring to decrypt and re-encrypt any data to further reduce the overhead and latency.
Introduction for Vagrant and Docker provider.
This presentation is prepared for Docker Meetup Tokyo 2014 #1 in 12, Feb, 2014 at National Institute of Informatics.
Copyright 2014, NTT Data Corporation.
9. Demo1: 昔ながらの通信方法の場合 ~virtio-net & pcap経由~
9
kernel space on host
user space on host
DPDK App1
Guest
QEMU
kernel space on VM
user space on VM
DPDK App2
virtio-net
virtio-net PMD
pcap PMD
tap driver
uio
tap client
この線が2つあるのが、 今回のデモ構成
12. Demo1: vhost-userを使った場合 ~virtio-net & vhost-user backend経由~
12
kernel space on host
user space on host
DPDK App1
Guest
QEMU
kernel space on VM
user space on VM
DPDK App2
virtio-net
virtio PMD
vhost- user backend
QEMU-2.1以上では、vhost-net のバックエンドを、ユーザ空間にイ ンプリさせるための仕組みが実装 されている(vhost-user)。 なお、この仕組みでは、ゲストの 物理メモリは、hugetlbfsから取得 する必要がある。
eventfd