Lessons from Building Scalable Network Policy Enforcement with eBPF
summary
Cilium uses eBPF to enforce identity based network policy at cluster scale (examples cite 5k+ nodes and hundreds of thousands of pods) by converting label selectors to integer identities and keeping per-node selector cache and policy cache so updates are incremental instead of rebuilding hundreds of thousands of BPF entries. Per-packet work is constant time via embedding identities in BPF bytecode and an LRU connection‑tracker, pod startup latency drops with ELF templating, and debugging uses cilium-debug, BPF map dumps and Hubble observe.
AI-written summary · about
chapters (4)
- 0:00Introduction to scalability
- 3:33Efficient policy application
- 14:56Data plane enforcement
- 23:32Debugging and conclusion
related talks
22mRole of eBPF in Kubernetes Networking and Security
38mUnderstanding and Troubleshooting the eBPF Datapath in Cilium
20mTackling Container Networking at Scale
36mCilium: Welcome, Vision and Updates
56mHands-on Workshop: Network Policies - The Not-So-Hard Way
41mAdopting Network Policies for Multi-Tenant Environments
29mSimplifying the Networking and Secur...
24mThe Cilium Story - Why We Created Cilium