Security & Observability For All Apps - Combining The User/Kernel Powers
summary
Compares Istio sidecar proxies and eBPF/Cilium kernel hooks and shows concrete integrations: socket-level eBPF acceleration routes packets from app sockets directly to proxies to cut double TCP traversal and lower latency, while layer‑4 kernel enforcement (Cilium) provides non‑bypassable network policy for defense‑in‑depth and Istio supplies fine‑grained layer‑7 authorization and mTLS. Notes limits: eBPF is L4 only, iptables redirection is TCP‑only, sidecars add CPU/memory and restart requirements. Describes Ambient/sidecarless architecture (node Z‑tunnels + waypoint proxies) and working demos.
AI-written summary · about
chapters (15)
- 0:00Intro
- 1:30Agenda
- 3:49Challenges with scaling Microservices
- 5:16Introducing Service Mesh
- 10:01Networking in Istio
- 11:28What is eBPF?
- 15:49eBPF architecture
- 17:22Cilium: Cloud Networking Overlay
- 18:03Service Mesh/Istio benefits & limitations
- 22:23eBPF/Cilium benefits & limitations
- 24:43Leveraging User & Kernel powers together
- 26:39Istio sidecar redirection
- 27:37Istio data-path acceleration w/eBPF
- 32:27Observability w/Istio sidecars
- 35:19Looking ahead
related talks
27mRevolutionizing Sidecarless Service Mesh With eBPF
47mUsing eBPF to Bring Kubernetes-Aware Security to the Linux Kernel
42mAmbient Mesh: new sidecar less & faster Istio for zero trust
36mIstio: Real world scenarios
11mIstio Ambient Mesh: Sidecar vs Sidecar-less, Explained Simply
18mThe Negatives to a Per-Host Service Mesh, the Sidecar Model Being a More Ideal Solution for Providing a More Robust Security Boundary
22mRole of eBPF in Kubernetes Networking and Security
37mDemystifying Secure Application Communication with Zero Trust and Istio Without Sidecars