Come explore the World of Cilium with us! In this workshop, you'll have the opportunity to discover about Cilium and Tetragon, and the kernel technology that makes them possible, eBPF. Through a collection of hands-on labs (available at https://labs-map.isovalent.com/) and the presenter's support, you'll be able to explore many topics covering Cloud Native Networking, Security, and Observability. In this gamified approach, you'll also be able to earn badges for completing labs. Whether you're a Platform Engineer, SRE, Network Engineer, SecOps Professional, Cloud Architect, and more, you'll certainly find subjects to explore in this session!

1. Raphaël Pinson | @raphink | @raphink@mastodon.social
🧪 Cilium Alchemist, Isovalent
Explore the World of
Cilium, Tetragon & eBPF

2. ⬢ Principles
Cilium & eBPF
Cloud Native Networking & Security

3. ⬢ Principles
⬢ Networking
Cilium & eBPF
Cloud Native Networking & Security

4. ⬢ Principles
⬢ Networking
⬢ Cluster Mesh
Cilium & eBPF
Cloud Native Networking & Security

5. ⬢ Principles
⬢ Networking
⬢ Cluster Mesh
⬢ Security
Cilium & eBPF
Cloud Native Networking & Security

6. ⬢ Principles
⬢ Networking
⬢ Cluster Mesh
⬢ Security
⬢ Observability
Cilium & eBPF
Cloud Native Networking & Security

7. ⬢ Principles
⬢ Networking
⬢ Cluster Mesh
⬢ Security
⬢ Observability
⬢ Service Mesh
Cilium & eBPF
Cloud Native Networking & Security

8. ⬢ Principles
⬢ Networking
⬢ Cluster Mesh
⬢ Security
⬢ Observability
⬢ Service Mesh
⬢ Tetragon
Cilium & eBPF
Cloud Native Networking & Security

9. Who am I
Raphaël Pinson
Cilium Alchemist @ Isovalent
CNCF Ambassador

10. ⬢ Principles
⬢ Networking
⬢ Cluster Mesh
⬢ Security
⬢ Observability
⬢ Service Mesh
⬢ Tetragon
Cilium & eBPF
Cloud Native Networking & Security

11. ● Open Source Projects ● Company behind Cilium
● Provides Cilium Enterprise

13. Makes the Linux kernel
programmable in a
secure and efficient way.
“What JavaScript is to the
browser, eBPF is to the
Linux Kernel”

14. Run eBPF programs on events
Attachment points
● Kernel functions (kprobes)
● Userspace functions (uprobe)
● System calls
● Tracepoints
● Sockets (data level)
● Network devices (packet level)
● Network device (DMA level) [XDP]
● ...

15. eBPF documentary
https://isogo.to/ebpf-documentary

16. What is Cilium?
At the foundation of Cilium is the new Linux kernel
technology eBPF, which enables the dynamic
insertion of powerful security, visibility, and networking
control logic within Linux itself. Besides providing
traditional network level security, the flexibility of BPF
enables security on API and process level to secure
communication within a container or pod.
Read More
● Networking & Load-Balancing
○ CNI, Kubernetes Services, Multi-cluster, VM Gateway
● Network Security
○ Network Policy, Identity-based, Encryption
● Observability
○ Metrics, Flow Visibility, Service Dependency

18. - Networking
- Security
- Observability
- Service Mesh & Ingress
-based:
Foundation
Created by
Technology

19. Cilium has Graduated!

20. ⬢ Principles
⬢ Networking
⬢ Cluster Mesh
⬢ Security
⬢ Observability
⬢ Service Mesh
⬢ Tetragon
Cilium & eBPF
Cloud Native Networking & Security

21. Kubernetes Networking
Networking plugin
● Network devices
● IP Address Management
● Intra-node connectivity
● Inter-node connectivity
Kube Proxy
● Services
● iptables or ipvs
● Service discovery

22. Kubernetes Networking
● Agent on each node
● Tunneling or Direct Routing
● eBPF native dataplane
● kube-proxy replacement.

23. Kubernetes Services
East-west connectivity
● Durable abstraction
● Connect applications
● Ephemeral addresses
● High churn
● Iptables or ipvs

24. Kubernetes Services
kube-proxy / iptables
● Linear list / sieve
● All rules have to be replaced as a
whole
eBPF based
● Per-CPU hash table ⇒ more
performant
● Native metadata => Cloud Native
routing

25. Egress Gateway

26. Platform Integration

27. node1
30
pod
192.168.1.1
pod
192.168.1.4
CiliumNode CRD
metadata:
name: node1
spec:
eni:
instance-id: i-123
instance-type: m4.large
preallocate: “8”
security-groups:
- sg1
- sg2
ipam:
available:
- 192.168.1.1
- 192.168.1.2
- 192.168.1.3
- 192.168.1.4
status:
ipam:
used:
- 192.168.1.1
- 192.168.1.4
Agent
Report used IPs
Use IPs
Operator
Make IPs
available
Init
Read ENI
parameters
Native Cloud Support
Alibaba, AWS, Azure, Google

28. ⬢ Principles
⬢ Networking
⬢ Cluster Mesh
⬢ Security
⬢ Observability
⬢ Service Mesh
⬢ Tetragon
Cilium & eBPF
Cloud Native Networking & Security

29. Cluster Mesh - Introduction

30. Cluster Mesh - High Availability

31. Cluster Mesh - Shared Services

32. Cluster Mesh - Splitting Services

33. Cluster Mesh - Local Service Affinity

34. Cluster Mesh - Remote Service Affinity

35. Cluster Mesh - Local Service Affinity

36. Cluster Mesh - Remote Service Affinity

37. Cluster Mesh with Service Mesh
Canary Rollout to other Cluster

38. ⬢ Principles
⬢ Networking
⬢ Cluster Mesh
⬢ Security
⬢ Observability
⬢ Service Mesh
⬢ Tetragon
Cilium & eBPF
Cloud Native Networking & Security

39. Identity-based Security

40. API-aware Authorization

41. Cassandra Cilium Network Policy Example

42. DNS-aware Cilium Network Policy

43. L3 Matching Capabilities
Kubernetes
● Pod labels
● Namespace name & labels
● ServiceAccount name
● Service names
● Cluster names
DNS Names
● FQDN and regular expression
CIDR
● CIDR blocks with exceptions
Cloud Providers
● Instance labels
● VPC/Subnet name/tags
● Security group name
Logical Entities
● Everything inside cluster
● Everything outside cluster
● Local host
● ...

44. ⬢ Principles
⬢ Networking
⬢ Cluster Mesh
⬢ Security
⬢ Observability
⬢ Service Mesh
⬢ Tetragon
Cilium & eBPF
Cloud Native Networking & Security

45. What is Hubble?

46. Flow Visibility
$ kubectl get pods
NAME READY STATUS RESTARTS AGE
tiefighter 1/1 Running 0 2m34s
xwing 1/1 Running 0 2m34s
deathstar-5b7489bc84-crlxh 1/1 Running 0 2m34s
deathstar-5b7489bc84-j7qwq 1/1 Running 0 2m34s
$ hubble observe --follow -l class=xwing
# DNS lookup to coredns
default/xwing:41391 (ID:16092) -> kube-system/coredns-66bff467f8-28dgp:53 (ID:453) to-proxy FORWARDED (UDP)
kube-system/coredns-66bff467f8-28dgp:53 (ID:453) -> default/xwing:41391 (ID:16092) to-endpoint FORWARDED (UDP)
# ...
# Successful HTTPS request to www.disney.com
default/xwing:37836 (ID:16092) -> www.disney.com:443 (world) to-stack FORWARDED (TCP Flags: SYN)
www.disney.com:443 (world) -> default/xwing:37836 (ID:16092) to-endpoint FORWARDED (TCP Flags: SYN, ACK)
www.disney.com:443 (world) -> default/xwing:37836 (ID:16092) to-endpoint FORWARDED (TCP Flags: ACK, FIN)
default/xwing:37836 (ID:16092) -> www.disney.com:443 (world) to-stack FORWARDED (TCP Flags: RST)
# ...
# Blocked HTTP request to deathstar backend
default/xwing:49610 (ID:16092) -> default/deathstar:80 (ID:16081) Policy denied DROPPED (TCP Flags: SYN)
Flow Metadata
‒ Ethernet headers
‒ IP & ICMP headers
‒ UDP/TCP ports, TCP flags
‒ HTTP, DNS, Kafka, ...
Kubernetes
‒ Pod names and labels
‒ Service names
‒ Worker node names
DNS (if available)
‒ FQDN for source and
destination
Cilium
‒ Security identities and
endpoints
‒ Drop reasons
‒ Policy verdict matches

47. Service Map

48. Cilium & Grafana Integration

49. ⬢ Principles
⬢ Networking
⬢ Cluster Mesh
⬢ Security
⬢ Observability
⬢ Service Mesh
⬢ Tetragon
Cilium & eBPF
Cloud Native Networking & Security

50. Introduction

51. Bring your own Control Plane

52. Service Mesh Evolution

53. Sidecar vs per-Node Proxy
Total number of proxies required

54. Traffic Management
- L3/L4 forwarding & Load-balancing
- Canary, Topology Aware Routing
- Multi-cluster
Security
- Network Policy
- mTLS
Observability
- Tracing, OpenTelemetry, & Metrics
- HTTP, TLS, DNS, TCP, UDP, …
eBPF Native
(no sidecar)
Proxy
Traffic Management
- L7 Load-balancing & Ingress
Resilience
- Retries, L7 Rate Limiting
Security
- TLS Termination & Origination
When eBPF cannot do it
Whenever possible

55. Performance Impact of a Sidecar

56. ⬢ Principles
⬢ Networking
⬢ Cluster Mesh
⬢ Security
⬢ Observability
⬢ Service Mesh
⬢ Tetragon
Cilium & eBPF
Cloud Native Networking & Security

57. @lizrice
Cilium Tetragon
● New open source project in Cilium
● eBPF based = high performance and zero modifications required to app
● Hooks into kernel functions after parameters are copied
● Adds contextual information about Kubernetes objects
● Preventative capabilities
github.com/cilium/tetragon

58. Tetragon

59. Process Tree View

60. OSS Community
eBPF-based Networking,
Observability, Security
cilium.io
cilium.slack.com
Regular news
Learn more!
Base technology
The revolution in the Linux kernel,
safely and efficiently extending the
capabilities of the kernel.
ebpf.io
What is eBPF? - ebook
For the Enterprise
Hardened, enterprise-grade
eBPF-powered networking,
observability, and security.
isovalent.com/product
isovalent.com/labs

62. Practical Labs
… to become a Cilium & eBPF Jedi
Get badges 🏅
@raphink | @raphink@mastodon.social

63. Which eBee are you?
@raphink | @raphink@mastodon.social
Cloud Network
Engineer
Platform
Engineer
SecOps
Engineer
https://isogo.to/cfgmgmtcamp24

64. All major cloud providers have picked
-based Networking & Security
for their Kubernetes platforms
@raphink | @raphink@mastodon.social
How about you?

65. eBPF resources
eCHO
eBPF YouTube podcast:
https://www.youtube.com/channel/UCJFUxkVQTBJh3LD1wYB
WvuQ
eBPF & Cilium Slack
http://slack.cilium.io/
eCHO News
Bi-weekly eBPF newsletter:
https://cilium.io/newsletter/
@raphink | @raphink@mastodon.social

66. Thank you!