Conversations With the Kernel: A Netlink Deep Dive
summary
Linux Netlink is shown as a binary, message-based API used by kube-proxy to talk to the kernel: the netfilter accounting subsystem nfacct exposes named counters (packets, bytes) that arrive as TLV attributes with two-byte length, two‑byte type, null‑terminated strings and four‑byte TLV alignment padding. Conntrack cleanup moves from a forked userland binary to a Netlink dump/filter/delete flow, cutting cleanup time from 300s → 5s. A custom Go decoder is required because no NFACCT library exists.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:05What is Netlink
- 2:12Netlink architecture
- 3:18Netlink families
- 4:20Message formats
- 6:07Netlink in Kubernetes
- 6:51Decoding Netlink
- 10:00Performance best practices
- 11:47Q&A
related talks
51mHow Kubernetes Networking Really Works: A Packet’s Journey Across Pods and Nodes
27mDeconstructing K8s Networking for Knowledge and Profit
08m⚡ Lightning Talk: Deep Dive Into Kernel Requirements: Strengthening Cloud Native With New Kernel Features
30mMix Kubernetes with Linux Kernel Tracing to Boost the Observability of Your Cluster
14mZero-overhead Container Networking with eBPF and Netkit
29mInside Kubernetes Networking
23mLife of a Container
09mLightning Talk: Hacking Kubernetes Networking to Create Telco Solutions