Panel: Exploring eBPF Use Cases in Cloud-Native Security
Panelat Cilium + eBPF Day North America 2024 · on Tuesday, 2024-11-12· at 11:50· Salt Palace | Level 1 | Grand Ballroom B·
summary
eBPF is shown as a practical kernel-level security layer: teams use Inspector Gadget (OCI gadgets signed with cosign) and Tetragon to load policies, hook kernel functions, parse DNS in BPF, and block file writes before completion. XDP is recommended for high-performance packet filtering. Vulnerability mitigations ship within an hour via kernel hooks, and measured overhead is tiny — roughly 1–2.5% CPU and ~1% RAM per node. Controls include verifier-based allowlists and signed BPF images.
AI-written summary · about
chapters (15)
- 0:00Introductions
- 2:15eBPF for network security in Kubernetes
- 4:23Runtime security with eBPF
- 5:49Runtime security observability
- 10:05Mitigating vulnerabilities at kernel level
- 15:26Securing eBPF access
- 18:21Verifying eBPF programs
- 20:50Balancing security monitoring and performance costs
- 23:00Measuring eBPF resource impact
- 25:49Optimizing kernel event processing
- 28:16Key personas for eBPF security
- 30:46Why security remains challenging despite eBPF
- 32:33Hurdles in eBPF adoption
- 34:43Collaborating on eBPF policies
- 35:48Closing thoughts
related talks
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
29mBuzzing Across the Cloud Native Landscape with eBPF
36meBPF for Runtime Security- 40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
33meBPF: exploring use case of BPF kernel infrastructure
22mRole of eBPF in Kubernetes Networking and Security
14mWill eBPF Save Us From the Next Global Outage?
42mResolving Performance and Security Issues with eBPF