4 ms·
One cool project that uses eBPF is Cilium. It allows restricting network traffic to / from containers in Kubernetes. Many of the problems it solves, in my opini
by halpert 5y ago
One cool project that uses eBPF is Cilium. It allows restricting network traffic to / from containers in Kubernetes. Many of the problems it solves, in my opinion, are better solved via user-space solutions, e.g. service-to-service traffic is better controlled via signing / encryption, but overall Cilium is a pretty cool piece of technology.
- staticassertion 5y agoIt seems nice to have both layers. mTLS is great, but you're still exposing your TLS stack to the attacker. Dropping the packet altogether seems nicer.
- halpert 5y agoIn a perfect world, yes. What I’ve found in practice is that network policies add a mysterious failure point that makes debugging traffic issues hard, especially when providing a service platform to teams that don’t understand the inner workings. TLS failures tend to be easier to grok for most service devs.