Daniel Borkmann

In this presentation we deep dive our path into achieving host networking performance characteristics for containers and Kubernetes Pods. As part of that we developed a veth driver replacement called meta devices which can be made programmable through eBPF. We outline the design of this driver, benchmarks with flamegraph comparison and next steps for upstreaming.

BPF is becoming ubiquitous in today's modern container environments and thanks to the fast pace of innovations from Linux kernel developers in the BPF subsystem, cloud native networking software such as Cilium is able to bring these extensions to a mainstream user base for improving throughput, latency and reliability of workloads and services. This talk provides a deep dive on recently added BPF kernel as well as Cilium extensions for Kubernetes environments which significantly reduce application tail latencies with the help of the earliest departure time (EDT) model for egress bandwidth management. Furthermore, recently added BPF redirection helpers are discussed which offer a low-latency switch into Pod network namespaces. Last but not least the talk also covers how Cilium's BPF kube-proxy replacement improves reliability for its high-performance XDP-based north-south service load-balancing through a BPF-based Maglev consistent hashing implementation. We'll discuss our path towards implementing these features, our lessons learned as well as future follow-up work.

BPF as a foundational technology in the Linux kernel provides a powerful tool for systems developers and users to dynamically reprogram and customize the kernel to meet their needs in order to solve real-world problems and without having to be a kernel expert. Thanks to BPF we have come to the point to overcome having to carry legacy accumulated over decades of development grounded in a more traditional networking environment that is typically far more static than your average Kubernetes cluster. In the age of containers, they are no longer the best tool for the job, especially in terms of performance, reliability, scalability, and operations. This talk provides a few examples on how BPF allows to rethink container networking based on recent work we did in Cilium. Among others, the audience will learn about running a fully functioning Kubernetes cluster without iptables, Netfilter and thus without kube-proxy in a scalable and secure way with the help of BPF and Cilium.

This talk presents an overview of the Linux kernel's eBPF subsystem and how it integrates into tc (traffic control) and XDP (eXpress Data Path) for providing a high-performance, in-kernel programmable networking data plane. Since the last fosdem, many new eBPF-related features found its way into the Linux kernel. This talk highlights some of the most important advances along with some examples on how this facility can be programmed.

This talk provides a deep-dive into the Linux kernel's eBPF engine and how iproute2's tc (traffic control) tool is utilizing it through cls_bpf for providing a programmable data plane for network packets. It's perhaps the most flexible and lightweight entity from all tc classifier/actions and can be used for classifying, encap, mangling, forwarding packets, etc. The talk also presents recently upstreamed features that made it into the eBPF architecture, and gives a short intro on how eBPF programs can be developed in restricted C syntax, compiled with llvm and loaded through tc.