Cilium - BPF &amp; XDP for containers

Cilium is open source software for transparently securing the network connectivity between application services deployed using Linux container management platforms like Docker and Kubernetes. At the foundation of Cilium is a new Linux kernel technology called BPF, which enables the dynamic insertion of powerful security visibility and control logic within Linux itself. Because BPF runs inside the Linux kernel itself, Cilium security policies can be applied and updated without any changes to the application code or container configuration.

Linux Native, HTTP Aware Network Security

Leveraging Network Offload to Accelerate SDN and NFV Deployments

Berkeley Packet Filter is an old friend for most people that deal with network under Linux. But its extended version eBPF is completely redefining the scope of usage and interaction with the kernel. It can indeed be used to instrument most parts of the kernel. This goes from network tracing to process or I/O monitoring. This talk will provide an overview of eBPF, from concept to tools like BCC. It will then focus on XDP for eXtreme Data Path and the possible applications in term of networking provided by this new framework. Eric Leblond, Stamus Network

Kernel Recipes 2017 - EBPF and XDP - Eric Leblond

Anne Nicolas

Cilium is open source software for providing and transparently securing network connectivity and loadbalancing between application workloads such as application containers or processes. Cilium operates at Layer 3/4 to provide traditional networking and security services as well as Layer 7 to protect and secure use of modern application protocols such as HTTP, gRPC and Kafka. Cilium is integrated into common orchestration frameworks such as Kubernetes and Mesos.

Cilium - API-aware Networking and Security for Containers based on BPF

As containers are being deployed as part of multi tenant clusters, virtual multi layer switches become essential to interconnect containers while providing isolation guarantees. Assigning tenants their own private networks requires stateful network address translation (NAT) implemented in a scalable architecture to expose containers to public networks. Existing virtual switches integrated into the Linux kernel did not support stateful NAT so far. This presentation introduces a new virtual NAT service deployable as container built using existing kernel functionality such as network namespaces, routing rules and Netfilter to provide NAT services to existing virtual switches such as Open vSwitch and the Linux bridge but also the core L3 layer of Linux.

LinuxCon 2015 Stateful NAT with OVS

Cilium is open source software for providing and transparently securing network connectivity and loadbalancing between application containers and services deployed using Linux container management platforms like Docker and Kubernetes. A new Linux kernel technology called eBPF is at the foundation of Cilium, which enables the dynamic insertion of BPF bytecode into the Linux kernel. Cilium generates eBPF programs for each individual application container to provide networking, security, loadbalancing and visibility.

Cilium - Network security for microservices

BPF is one of the fastest emerging technologies of the Linux kernel. The talk provides an introduction to Cilium which brings the powers of BPF to Kubernetes and other orchestration systems to provide highly scalable and efficient networking, security and load balancing for containers and microservices. The talk will provide an introduction to the capabilities of Cilium today but also deep dives into the emerging roadmap involving networking at the socket layer and service mesh datapath capabilities to provide highly efficient connectivity between cloud native apps and sidecar proxies.

Cilium - Bringing the BPF Revolution to Kubernetes Networking and Security

Measuring a 25 and 40Gb/s Data Plane

The Linux packet filtering technology, iptables, has its roots in times when networking was relatively simple and network bandwidth was measured in mere megabits. Emerging technologies, such as distributed NAT, overlay networks and containers require enhanced functionality and additional flexibility. In parallel, the next generation of network cards with speeds of 40Gb and 100Gb will put additional pressure on performance. In the upcoming Red Hat Enterprise Linux 7, a new dynamic firewall service, FirewallD, is planned to provide greater flexibility over iptables by eliminating service disruptions during rule updates, abstraction, and support for different network trust zones. Additionally, a new virtual machine-based packet filtering technology, nftables, addresses the functionality and flexibility requirements of modern network workloads. In this session you’ll: Deep dive into the newly introduced packet filtering capabilities of Red Hat Enterprise Linux 7 beta. Learn best practices. See the new set of configuration utilities that allow new optimization possibilities.

The Next Generation Firewall for Red Hat Enterprise Linux 7 RC

o protect the privacy of sensitive application data, we encrypt it before sending it over networks. However, we do not treat sensitive information about the network in the same way. Instead, headers are sent in plain text and leak sensitive information about the network – especially valid host addresses, type of service markings. In our research, we are developing a protocol to also encrypt Layer 3 headers. Using P4, we are able to rapidly stand up and prototype our proposed solution in real code running across real devices. In this webinar, I will introduce our approach and how we used and extended P4 functionality to stand up a prototype. Mark Matties The Johns Hopkins University Applied Physics Lab Mark Matties is the Chief Scientist in the Communication and Networking Systems group at JHU APL, where he develops and evaluates SDN solutions to improve network security and performance. He holds a B.S. in Chemistry and a Ph.D. in Polymer Science and has worked for over 20 years in computing, networking, and security.

Protecting the Privacy of the Network – Using P4 to Prototype and Extend Netw...

Cilium is an open source project which provides networking, security and load balancing for containers by using eBPF and XDP technologies in the Linux kernel. It provides eBPF and XDP features to CRI-O, Docker and Kubernetes. This presentation shows an overview on Cilium, explains the concepts behind it and then provide the project update, as it reached the 1.0 milestone last year. The video from talk at FOSDEM 2019: https://video.fosdem.org/2019/H.2214/cilium_overview_and_updates.webm

Cilium - overview and recent updates

Michal Rostecki

The OpenContrail project aims to produce an open-source platform that delivers high performance software-defined networking while integrating cleanly with existing networking equipment. Netronome has added support for transparent hardware acceleration of OpenContrail's vRouter dataplane using Agilio hardware. This talk discusses the architecture of the system as well as the components we hope to open up to the broader community. We will discuss how to support transparent offload in the context of a split dataplane as well as provisioning of NFP resources required to produce a performant solution.

OpenContrail, Real Speed: Offloading vRouter

BPF: Next Generation of Programmable Datapath

From the Infra//Structure Conference May 2019 by Ron Renwick of Netronome Disaggregation a Primer: Optimizing design for Edge Cloud & Bare Metal applications Hyperscalers and Edge Cloud providers have recognized economic value of disaggregated infrastructure. Netronome Agilio SmartNICs enable disaggregated architectures to perform with up to 30x lower tail latency while encrypting every session using KTLS security.

Disaggregation a Primer: Optimizing design for Edge Cloud & Bare Metal applic...

Commodity servers equipped with intelligent server adapters (ISAs) are being used as platforms for Network Functions Virtualization (NFV). The network traffic processing required by a specific use case is frequently expressed by forming a chain of Virtual Network Functions (VNFs). This demonstration illustrates that VNFs in the chain can be hosted on the server CPU or on the ISA. It furthermore illustrates that VNFs can be decomposed into components called Micro-VNFs, with the components again being hosted on the server CPU and/or the ISA. A P4 program (compiled to native code running on the ISA) defines the overall semantics of the datapath within an ISA equipped server and expresses how VNFs and Micro-VNFs should be composed within this platform. We show how mechanisms like tunnels and service headers programmed using P4 are employed to establish the VNF service chain across multiple network nodes. David George Lead Engineer, Netronome David George is a lead engineer on the Netronome SDK team and is primarily responsible for Netronome's P4 data plane. He has previously been worked on the SDK simulator and x86 data plane components. He holds a Masters of Electrical Engineering from the University of Cape Town.

P4-based VNF and Micro-VNF Chaining for Servers With Intelligent Server Adapters

As microservices grow, traditional firewall rules based on network ACLs are no longer scalable and fall short of providing fine-grained enforcement. Group Based Policy (GBP) is a flexible policy language that allows users to specify policy enforcement based on intent, independent of network infrastructure and IP addressing. Using micro-segmented virtual domains, administrators can define policies at a centralized location and use IO Visor technology for distributed enforcement. This provides infrastructure independent rules, template-based policy definitions, and scale-out policy enforcement for a solution that secures and scales with microservices. This session will be presented by members of the IO Visor community and will cover how IO Visor technology can be used to define and enforce GBP. The discussion will also cover using GBP for cloud foundry application spaces where microservices are deployed and need scalable, efficient security policies.

Using IO Visor to Secure Microservices Running on CloudFoundry [OpenStack Sum...

IO Visor Project

In this talk, we outline a kernel and upstream centric approach to data plane acceleration using an upstream SmartNIC BPF JIT. This allows extended Berkeley Packet Filter (eBPF) bytecode to be transparently offloaded to the SmartNIC from either the Traffic Control (TC) or Express Data Path (XDP) hooks in the kernel and could be used for applications such as DoS protection, load balancing and software switching e.g., Open vSwitch (OVS). We then follow this by outlining the proposed ICONICS OCP contribution related to an open approach for reconfiguration using directly compiled SmartNIC programs in situations where BPF bytecode alone is not sufficient to accommodate changing semantics in the network.

OCP U.S. Summit 2017 Presentation

With the rise of cloud-native principles, applications are increasingly able to take advantage of diverse, specialized and distributed infrastructure. The emergence of Edge Cloud solutions promises faster and more immersive application experiences, as well as infrastructure primitives for 5G, IoT, mobility, and more. However, this new resource comes with space and power constraints that can only be overcome by using new disaggregated architectures that leverage network acceleration and optimally sized CPUs. The session will highlight how the capabilities unleashed by hardware offload of eBPF in edge cloud microservers will enable developers to efficiently leverage the massive amounts of data on the edge and to create next-generation real-time applications.

Using Network Acceleration for an Optimized Edge Cloud Server Architecture

This presentation features a walk through the Linux kernel networking stack for users and developers. It will cover insights into both, existing essential networking features and recent developments and will show how to use them properly. Our starting point is the network card driver as it feeds a packet into the stack. We will follow the packet as it traverses through various subsystems such as packet filtering, routing, protocol stacks, and the socket layer. We will pause here and there to look into concepts such as networking namespaces, segmentation offloading, TCP small queues, and low latency polling and will discuss how to configure them.

LinuxCon 2015 Linux Kernel Networking Walkthrough

Linux offers an extensive selection of programmable and configurable networking components from traditional bridges, encryption, to container optimized layer 2/3 devices, link aggregation, tunneling, several classification and filtering languages all the way up to full SDN components. This talk will provide an overview of many Linux networking components covering the Linux bridge, IPVLAN, MACVLAN, MACVTAP, Bonding/Team, OVS, classification & queueing, tunnel types, hidden routing tricks, IPSec, VTI, VRF and many others.

Mais procurados (20)

OVS Hardware Offload with TC Flower

Linux Native, HTTP Aware Network Security

Leveraging Network Offload to Accelerate SDN and NFV Deployments

Kernel Recipes 2017 - EBPF and XDP - Eric Leblond

Cilium - API-aware Networking and Security for Containers based on BPF

LinuxCon 2015 Stateful NAT with OVS

Cilium - Network security for microservices

Cilium - Bringing the BPF Revolution to Kubernetes Networking and Security

Measuring a 25 and 40Gb/s Data Plane

The Next Generation Firewall for Red Hat Enterprise Linux 7 RC

Protecting the Privacy of the Network – Using P4 to Prototype and Extend Netw...

Cilium - overview and recent updates

OpenContrail, Real Speed: Offloading vRouter

BPF: Next Generation of Programmable Datapath

Disaggregation a Primer: Optimizing design for Edge Cloud & Bare Metal applic...

P4-based VNF and Micro-VNF Chaining for Servers With Intelligent Server Adapters

Using IO Visor to Secure Microservices Running on CloudFoundry [OpenStack Sum...

OCP U.S. Summit 2017 Presentation

Using Network Acceleration for an Optimized Edge Cloud Server Architecture

LinuxCon 2015 Linux Kernel Networking Walkthrough

Destaque

Linux Networking Explained

2015 FOSDEM - OVS Stateful Services

Open vSwitch (OVS) has long been a critical component of the Neutron's reference implementation, offering reliable and flexible virtual switching for cloud environments. Being an early adopter of the OVS technology, Neutron's reference implementation made some compromises to stay within the early, stable featureset OVS exposed. In particular, Security Groups (SG) have been so far implemented by leveraging hybrid Linux Bridging and IPTables, which come at a significant performance overhead. However, thanks to recent developments and ongoing improvements within the OVS community, we are now able to implement feature-complete security groups directly within OVS. In this talk we will summarize the existing Security Groups implementation in Neutron and compare its performance with the Open vSwitch-only approach. We hope this analysis will form the foundation of future improvements to the Neutron Open vSwitch reference design.

Taking Security Groups to Ludicrous Speed with OVS (OpenStack Summit 2015)

Open vSwitch - Stateful Connection Tracking & Stateful NAT

This presentation features a walk through the Linux kernel networking stack covering the essentials and recent developments a developer needs to know. Our starting point is the network card driver as it feeds a packet into the stack. We will follow the packet as it traverses through various subsystems such as packet filtering, routing, protocol stacks, and the socket layer. We will pause here and there to look into concepts such as segmentation offloading, TCP small queues, and low latency polling. We will cover APIs exposed by the kernel that go beyond use of write()/read() on sockets and will look into how they are implemented on the kernel side.

DevConf 2014 Kernel Networking Walkthrough

SDN & NFV Introduction - Open Source Data Center Networking