Calling OPA from eBPF, Through WASM, in the Kernel? You've Gone Mad!
Talkat Cloud Native Wasm Day Europe 2023 · on Tuesday, 2023-04-18· at 15:20· Hall 7, Room C | Ground Floor | Europe Complex·
summary
A kernel module embeds wasm3 in-kernel VM and loads an OPA compiled to Wasm policy, exposes the evaluator as a kfunc bridge to eBPF, and calls it from an XDP program to decide per-packet counting. The prototype runs the Wasm interpreter in-kernel (wasm32-unknown, no WASI), evaluates the policy ~1,000,000 times during the demo, and successfully filters/counters packets. It is experimental, interpreter-backed (no JIT/AOT yet) and available as open source for testing.
AI-written summary · about
chapters (11)
- 0:00Welcome
- 1:07eBPF and WebAssembly
- 2:55What is eBPF
- 6:27WebAssembly fundamentals and advantages
- 8:36Kernel WASM projects
- 10:24Wasm kernel module
- 12:30eBPF calls WASM with OPA
- 15:44Live demo: Packet filtering
- 21:02Wasm VM in kernel details
- 22:50Project status
- 23:33Q&A
related talks
14mWriting Custom eBPF Programs for O11y: What You Need to Know
31meBPF and Wasm: Unifying Userspace Extensions With Bpftime
33meBPF: exploring use case of BPF kernel infrastructure
01h 06mOPA everywhere! Exploring new opportunities in policy evaluation
42mResolving Performance and Security Issues with eBPF
47mInto the Heart of the eBPF Hive!
15mExtending Applications Safely and Efficiently
23mWhat If... Kubernetes Core Pieces Could Be Extended with Pluggable WebAssembly Modules?