Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Cilium's Envoy Filter and VS Bridge to Kubernetes

Rueian
November 14, 2020

Cilium's Envoy Filter and VS Bridge to Kubernetes

Demonstrate how to addressing the limitations of Visual Studio Bridge to Kubernetes with the power of Cilium L7 Network Policy and custom tunnel agent.

Full Code: https://github.com/rueian/aerial

Rueian

November 14, 2020
Tweet

More Decks by Rueian

Other Decks in Technology

Transcript

  1. Hi, I am Ruian • Dcard Backend Engineer • https://medium.com/@ruian

    • http://github.com/rueian • https://speakerdeck.com/rueian Previous Sharing
  2. • Cilium Overview • What is Cilium & Why Cilium

    is important • How Cilium L7 Network Policy works
 • Imporve Development Experience with Cilium • What is Bridge To Kubernetes and its limitations • How to customize Cilium L7 Network Policy to address the Bridge To Kubernetes limitations Outline
  3. Why Cilium? Linux Network Acceleration with BPF K8s Service Endpoint

    Selection on connect(2) Syscall Source: https://cilium.io/blog/2020/02/18/cilium-17#kubeproxy-removal
  4. • NO need to inject sidecars • NO need to

    restart pods • ONLY traffic matched by L4 level policy is processed • Do whatever you want to the traffic, ex: • HTTP access control • RPC redirection • DB connection mutation, auditing FULL control of L7 traffic With Golang Envoy Filter
  5. • For Developing: • Hard to prepare other service dependancies

    • Need to re-deploy container to reflect code changes • For Debugging: • Hard to target traffic to the which remote container • Hard to inspect the memory of the remote container (maybe uprobe) Microservice Development Experience Some Pain Points
  6. • Cilium’ Golang Envoy Filter • Do whatever you want

    to L7 traffic • Visual Studio Bridge To Kubernetes • Improve microservice development experience • Build your own Bridge To Kubernetes with Cilium • Addressing the BTK limitations • Full Code of Tunnel and Golang Envoy Filter: • http://github.com/rueian/aerial • https://github.com/rueian/cilium/tree/httpredirect Recap