eBPF & Cillium
summary
Sky runs a multi-tenant Kubernetes PaaS hosting ~300 apps, ~60,000 replicas and ~1,000 engineers and adopts Cilium + eBPF to replace iptables for scalable network policies, cluster-wide deny and Hubble observability. A CI pipeline runs functional tests (including the Cilium connectivity suite), non‑functional tests that simulate 5,000 identities, chaos events and continuous 24/7 load, plus extended 8‑hour runs; goal is zero drop during upgrades — a restart edge case appears, gets reproduced and patched upstream.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:55Core Engineering
- 4:07Scale
- 4:34Technical Stats
- 4:55Introduction to Anthony
- 5:14Network Security
- 6:10Scalability
- 7:10Risk Mitigation
- 7:25Deploy
- 7:52Test Image
- 8:10Network Policies
- 9:12Network Testing
- 11:52Nonfunctional Testing
- 15:15Extended NFT
- 16:03Continuous Load
related talks
33mThe Future of eBPF in Cloud Native
32mBuzzing across the eBPF Landscape and into the Hive
33mIKEA Private Cloud, eBPF Based Networking, Load Balancing, and Observability with Cilium
47mUsing eBPF to Bring Kubernetes-Aware Security to the Linux Kernel
16mBeyond Dashboards: Deep-Dive Network Observability with eBPF
36mCloud Native Superpowers with eBPF
10mKeynote: eBPF - Everything You Need to Know in 5 Minutes
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools