Nathan Skrzypczak

Kubernetes is a great solution for hosting highly available endpoint applications, but network functions can still prove challenging. VPN gateways are notably tricky, with overlay and underlay conflicts making their deployment an interesting dance. Performance is also a challenging topic when speaking about scale, most importantly when common optimizations like GSO don't really apply.

Leveraging the Calico CNI with a VPP dataplane mixed with multus, allowed us exposing multiple k8s managed interfaces to pods, and thus building complex network functions that still benefit from k8s constructs (HA, service discovery, ...). In the end building an highly available Wireguard gateway gets as easy as building any other application. And it can even leverage accelerated interfaces and cryptographic engines, to reach multiple Gbps without hassle.

Hoping this architecture could benefit Kubernetes at large, we started drafting a KEP, proposing to upstream the concept of multiple isolated networks, and standardizing their interaction with existing k8s resources.

Kubernetes is great, containers are lightweight & disposable, networking is simple yet powerful. But when it comes to network oriented applications, oh that can be slow !

That's how the Calico/VPP integration first came up, as a way to address performance bottlenecks, making VPP's performance the motor of Calico's functionalities in Kubernetes. It speeds up container networking, but also allows us to expose even faster functionalities directly to the applications. So with this in place, how can we go even faster, while still preserving the Kubernetes abstractions ?

We'll present how applications can leverage userspace interfaces, what this allows regarding network performance & additional functionalities and how the Calico/VPP integration makes this happen under the hood.

QUIC was introduced by Google to move the transport protocol implementation out of the kernel, and is now being standardized in the IETF. It provides both encryption and multiplexing, and will be the default transport for HTTP/3. In this talk we'll present the work we've done investigating whether QUIC would benefit from vectorized packet processing, the impact it has on performance and how it can be consumed by external applications.

VPP (vector packet processing) is a fast network data plane, part of the Linux Foundation FD.io project providing fast network functions on top of DPDK. It provides an optimized support of TCP & UDP allowing significant performance improvements. In this presentation, we'll discuss:

• How we took advantage of the open source protocol implementation quicly and vpp's hoststack, to implement fast QUIC sockets.
• How this can be consumed by external applications and to what ends.
• What this enables regarding hardware and software offloads.