Challenges with implementing in-kernel FQDN policies using eBPF
summary
Cilium replaces its user-space DNS proxy by parsing DNS in-kernel with eBPF, removing the single-point-of-failure and reducing dataplane/control-plane coupling; implementation uses stream parser and stream verdict SK_SK_SKB programs plus existing TC classifiers, supports DNS over TCP by reading the 2-byte length, and parses multiple answers with BPF loops. Needed fixes include calling SKB pull_data to linearize non-linear skbs, pre-allocating identities to avoid user-space allocation, and keeping garbage collection in user space for now; end-to-end demo works.
AI-written summary · about
chapters (14)
- 0:00Introduction and agenda
- 1:07Why FQDN policies are useful
- 3:17Current Celium FQDN implementation
- 5:24Limitations of user space DNS proxy
- 6:29Why move FQDN to eBPF
- 7:54DNS protocol deep dive
- 11:05Parsing DNS responses in BPF
- 12:12DNS over TCP in BPF
- 13:40Identity mapping and policy updates
- 14:22Challenges with BPF loops
- 15:25Pattern matching in BPF
- 17:14Live demo
- 19:42Next steps and future work
- 22:09Q&A session
related talks
38mUnderstanding and Troubleshooting the eBPF Datapath in Cilium
22mRole of eBPF in Kubernetes Networking and Security
28mLessons from Building Scalable Network Policy Enforcement with eBPF
32mExploring the Power of eBPF for System Observability
23mAn Intro to eBPF with Go : The Foundation of Modern Kubernetes Networking
36mLevel 7 Egress Control in Kubernetes: Current Solutions,...
35mLiberating Kubernetes From Kube-proxy and Iptables
36mCilium: Welcome, Vision and Updates