Opening the Black Box: Understanding and Troubleshooting Calico’s eBPF Data Plane
summary
Calico’s eBPF data plane replaces iptables rules with injected programs, claiming lower latency, better scalability and features like preserve client IP for NodePort and DSR; debugging uses the Calico BPF tool to dump services, routes, eBPF maps, connection-tracking entries and per-rule counters so operators can see which policy rules are hit. New filtered logging compiles pcap-style expressions into BPF to avoid a trace-pipe firehose and make production troubleshooting practical.
AI-written summary · about
chapters (26)
- 0:00Introduction
- 0:30Overview
- 1:28What is Calico
- 2:18What is Calico multiplatform
- 3:23What is eBPF
- 4:43IPtables vs eBPF
- 7:41User feedback
- 8:32What this talk is about
- 9:25ppf maps
- 10:48Routes
- 11:49Connections
- 12:51Dumping Contracts
- 13:38Services in Play
- 14:26IP Pool
- 15:30Connection Tracking
- 15:47Network Policies
- 17:10Policy Dump
- 18:22eBPF Map
- 19:09eBPF counters
- 19:47Policy dumps
- 20:22Log level
- 21:11Filtering
- 22:50finegrained login
- 23:28login examples
- 24:53services and network as translation
- 25:57Conclusion
related talks
44mUnderstanding Calico's eBPF data-plane
32mCalico Networking with eBPF
23mContainer and Kubernetes security policy design: 10 critical best practices
38mUnderstanding and Troubleshooting the eBPF Datapath in Cilium
36mFrom Monitoring to Observability: eBPF Chaos - Michael Friedrich
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
30mAll You Can Eat Networking. Kubernetes Goodness for the Hungriest Workloads
22mRole of eBPF in Kubernetes Networking and Security