Understanding and Troubleshooting the eBPF Datapath in Cilium
Talkat KubeCon + CloudNativeCon North America 2019 · on Tuesday, 2019-11-19· at 16:25· Room 15AB - San Diego Convention Center, Mezzanine Level·
summary
eBPF programs power Cilium’s datapath using XDP for early drops, cgroup eBPF for transparent client‑side load balancing and sockops for per‑socket shaping; debugging uses the cilium CLI, bpftool and cilium monitor inside the Cilium daemonset. Claim: eBPF can remove much iptables and even replace kube‑proxy (nodePort/ClusterIP handling), but verifier limits (instruction and map size) and kernel version differences constrain behavior. Demo shows cilium monitor tracing 400 responses to a proxy protocol mismatch and fixing it resolves the errors.
AI-written summary · about
chapters (14)
- 0:00Intro
- 1:19Why should we care
- 3:57What is eBPF
- 8:06Brief History of eBPF
- 11:18Hardware
- 12:38Drivers
- 14:35Receive Socket Buffer
- 16:13IP Receive
- 18:09User Space
- 19:17Socket Listening Program
- 23:35Kubernetes vs Cilium
- 25:38Bait and Switch
- 27:22Demo
- 32:44Questions
related talks
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
34mTroubles and Tidbits from Datadogs eBPF journey
44mCilium - Container Security and Networking Using BPF and XDP
22mRole of eBPF in Kubernetes Networking and Security- 40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
33mThe Future of eBPF in Cloud Native
28mLessons from Building Scalable Network Policy Enforcement with eBPF
46mThe eBPF Revolution: A Dynamic Linux Kernel