Michal Rostecki

Linux kernel already supports writing modules in Rust. There is also an ongoing effort of rewriting Linux subsystems in eBPF (for example HID-BPF). It almost feels like there is an ongoing race between Rust and eBPF to implement parts of the kernel, but both can be done at the same time - by writing eBPF programs in Rust with Aya!

Aya is an eBPF library built with a focus on operability and developer experience. It allows for both user-land and kernel-land programs to be written in Rust - and even allows for sharing of code between the two! It has minimal dependencies. When linked with musl, it creates a truly portable, self-contained binary that can be deployed on many Linux distributions and kernel versions.

In this talk I would like to deep dive into the present state of Aya, with focus on:

• How it works
• Currently supported features
• How Rust for Linux and Aya can benefit from each other
• Our plans about BTF and CO-RE support, which is already being implemented and includes changes in Rust ecosystem

Michal Rostecki is a Software Engineer working at SUSE. He's working on Cilium, both upstream and on integrating it with openSUSE Kubic Project and SUSE CaaS Platform.

Swaminathan Vasudevan is a Software Engineer working at SUSE. Worked on Neutron Networking Upstream and currently migrating to Cilium and openSUSE Kubic Project and SUSE CaaS Platform.

Cilium is an open source project which provides networking, security and load balancing for application services that are deployed using Linux container technologies by using the native eBPF technology in the Linux kernel. In this presentation we would talk about: - The evolution of the BPF filters and will explain the advantages of eBPF Filters and its use cases today in Linux especially on how Cilium networking utilizes the eBPF Filters to secure the Kubernetes workload with increased performance when compared to legacy iptables. - How Cilium uses SOCKMAP for layer 7 policy enforcement - How Cilium integrates with Istio and handles L7 Network Policies with Envoy Proxies. - The new features since the last release such as running Kubernetes cluster without kube-proxy, providing clusterwide NetworkPolicies, providing fully distributed networking and security observability platform for cloud native workloads etc.

Cilium is on open source project which provides networking, security and load balancing for containers by using eBPF and XDP technologies in the Linux kernel. It provides eBPF and XDP features to CRI-O, Docker and Kubernetes. This talk will present an overview on Cilium, explain the concepts behind it and then provide the project update, as it reached the 1.0 milestone last year.

Bio: Michal Rostecki is a Software Engineer working at SUSE. He's contributing to Cilium on daily basis, sometimes to Kubernetes and several projects related to containers and networking. He used to be a core reviewer for OpenStack Kolla project.

The idea of running virtual machines inside containers is surprisingly old and was used due to several reasons. They include willingness to run VM-s in container orchestration engines like Kubernetes or Borg, or packaging IaaS cloud software like OpenStack in containers. In this presentation, I am going to describe these use cases and two main different approaches of containerizing VM-s - putting every qemu(-kvm) process in a separate container (like Borg or Rancher OS are doing) and putting libvirtd process in container (like OpenStack Kolla or Stackanetes are doing)