Liberating Kubernetes From Kube-proxy and Iptables
Talkat KubeCon + CloudNativeCon North America 2019 · on Wednesday, 2019-11-20· at 14:25· Ballroom Sec 20AB - San Diego Convention Center, Upper Level·
summary
Claims Kubernetes runs without kube-proxy, iptables or netfilter by replacing service logic with eBPF programs at TC ingress and socket connect hooks inside Cilium; implements ClusterIP, NodePort and ExternalIP with BPF maps for service state and connection tracking, does DNAT/SNAT in-kernel, and can preserve client IP plus avoid the extra node hop. Benchmarks on 100Gbps bare metal show lower latency than both iptables and IPVS and better scaling as services grow; proof-of-concept runs on kernels without netfilter modules and is production-used by large operators.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 3:37Why
- 4:48Reliability
- 6:21Debugging
- 6:40Adding more rules
- 7:14Overhead
- 8:56Kubeproxy
- 10:46EBPF
- 13:29EBPF Adoption
- 14:52Replacing Kubeproxy
- 20:28Updating Service Maps
- 21:11Enabling Communication via Cluster B
- 23:39Enabling Communication via Node Port
- 25:56External Traffic Policy Equal Local
- 27:30Benchmarks
- 29:53Recap
- 32:49Questions
related talks
31mUnleashing the Tides of Kubernetes Networking by Removing kube-proxy
22mRole of eBPF in Kubernetes Networking and Security
40mCloud, Kubernetes, and Service Networking - Taming the Turtles
28mScale Kubernetes to Support 50,000 Services [I]
29mSimplifying the Networking and Secur...
35mNext-level Kubernetes Networking with Cilium - Nico Meisenzahl and Philip Welz
51mKubernetes SIG-Network: Intro and Deep-Dive
26mIPv6 First, Not Just Ready: Kubernetes Without IPv4 Using Cilium