Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Cloud Native eBPF Superpowers

Cloud Native eBPF Superpowers

Brendan Gregg called eBPF “Superpowers for Linux”, and in this talk Liz discusses why it’s a foundational technology for a new generation of cloud native operations tools, covering questions such as:
- What is eBPF?
- How is it unleashing a new wave of innovation?
- How does it enable detailed insights into application behaviour, without having to modify applications in any way?

Even if you’re not a Linux kernel aficionado you’ll leave this talk with an understanding of what eBPF is, and how it enables high-performance tools for connecting, managing and securing applications in the cloud.

Liz Rice

June 02, 2021
Tweet

More Decks by Liz Rice

Other Decks in Programming

Transcript

  1. Liz Rice Chief Open Source Officer, Isovalent Chair, CNCF Technical

    Oversight Committee @lizrice eBPF  Superpowers for Networking, Observability & Security
  2. @lizrice SEC("kprobe/sys_execve") int hello(void *ctx) { bpf_printk("I'm alive!"); return 0;

    } eBPF Hello World $ sudo ./hello bash-20241 [004] d... 84210.752785: 0: I'm alive! bash-20242 [004] d... 84216.321993: 0: I'm alive! bash-20243 [004] d... 84225.858880: 0: I'm alive! Info about process that called execve syscall + userspace code to load eBPF program
  3. @lizrice userspace kernel app app pods networking access files create

    containers Kernel aware of everything on the host
  4. @lizrice userspace app kernel app pods networking access files create

    containers eBPF programs can be aware of everything
  5. @lizrice host pod app socket veth veth eth0 iptables conntrack

    iptables INPUT Linux routing iptables PREROUTING mangle iptables conntrack iptables FORWARD Linux routing iptables PREROUTING nat iptables POSTROUTING mangle iptables PREROUTING mangle iptables POSTROUTING nat
  6. @lizrice host pod app socket veth veth eth0 iptables conntrack

    iptables INPUT Linux routing iptables PREROUTING mangle Linux routing
  7. @lizrice eBPF apps have a view across the entire node

    without any app or config changes
  8. @lizrice userspace pod container sidecar container my-app.yaml containers: - name:

    my-app ... - name: my-app-init … - name: my-sidecar ... Sidecars need YAML
  9. @lizrice userspace pod container container my-app.yaml containers: - name: my-app

    ... - name: my-app-init … eBPF does not need any app changes kernel