Facebook published BPF/XDP numbers for L3/L4 LB at Netdev 21
5
BPF Revolution #3: Security
6
Evolution of Application Design & Delivery Frequency
7
Network Security for Microservices
8
Gordon wants to build a service to tweet out all job offerings.
9
Gordon uses mutual TLS Auth Good thinking Gordon
10
The security team has L3/L4 network security in place for all services
11
Back to the drawing board...
12
Least privilege security for microservices
13
Kubernetes Integration
14
Should I encapsulate or not?
15
L3 Policy (Labels Based)
16
L3 Policy (CIDR)
17
Policy - Only allow GET /v1
18
How are these policies enforced?
19
What is a sidecar proxy?
20
Networking Path with a Sidecar
21
Kernel Proxy
22
Socket Redirect - Performance?
23
The Before and After
24
Cilium Summary
Description:
Explore a comprehensive conference talk on Cilium, an open-source project leveraging BPF for container security and networking. Dive into the revolutionary aspects of BPF technology, including its applications in application and network security, tracing, and visibility. Learn how Cilium applies BPF to solve networking, security, and load balancing challenges for distributed applications. Discover the integration of Cilium with orchestration systems like Kubernetes to enhance security and networking for cloud-native applications. Gain insights into topics such as DDoS mitigation, L3/L4 load balancing, microservices security, and the evolution of application design and delivery frequency. Understand the implementation of least privilege security for microservices, Kubernetes integration, and policy enforcement mechanisms. Compare traditional sidecar proxy approaches with kernel-based solutions, and examine the performance benefits of socket redirection.
Cilium - Container Security and Networking Using BPF and XDP