tgraf

4 ms·

1.
Tetragon – eBPF-Based Security Observability and Runtime Enforcement(isovalent.com)
7 points by tgraf 4y ago|0 comments
2.
by tgraf 5y ago
Then you should interview again but with us. This is not too different from wpa_supplicant used by several operating for key management for wireless networks. The complicated key negotiation and authentication can remain in user space, the
3.
by tgraf 5y ago
It looks not too different from the majority of HTTP parsers out there written in C. Here is an example of NodeJS [0]. [0] https://github.com/nodejs/http-parser/blob/main/http_parser....
4.
by tgraf 5y ago
It can do both. It can authenticate and encrypt all traffic between nodes which then also encrypts all traffic between the pods running on those pods. This is great because it also covers pod to node and all control plane traffic. The encry
5.
by tgraf 5y ago
The model I'm describing contains two pieces: 1) Moving away from sidecars to per-node proxies that can be better integrated into the Linux kernel concept of namespacing instead of artificially injecting them with complicated iptables
6.
by tgraf 5y ago
If you are in a position where you can do that then great. Most folks out there are in a position where they need to run arbitrary applications delivered by vendors without an ability to modify them. The second aspect is that this can get e
7.
by tgraf 5y ago
One of the methods that Cilium (which implements this eBPF-based service mesh idea) uses to implementation authentication between workloads is Wireguard. It does exactly what you describe above. In addition it can also be used to enforce ba
8.
by tgraf 5y ago
What the proposed architecture allows is to continue using SPIFFE or another certificate management solution to generate and distribute the certificates but use either a per-node proxy or an eBPF implementation to enforce it. Even if the au
9.
by tgraf 5y ago
OP here: It's whimsical.com. I really love it.
10.
eBPF will help solve service mesh by getting rid of sidecars(isovalent.com)
237 points by tgraf 5y ago|108 comments
11.
by tgraf 6y ago
Extending a bit on what Alexei is talking about (Full eBPF summit talk: https://youtu.be/jw8tEPP6jwQ?t=639 ) Many people seem to make an assumption that kernel code is perfect and that when code is merged into the Linux kern
12.
by tgraf 6y ago
I personally think that networking will be almost exclusively based Linux in some form. If you want to interpret it as "eBPF - The Future of Linux Networking" then that is totally fine as well. That said, eBPF-based networking can
13.
by tgraf 6y ago
I'm not going to argue with you. You can read up on initial naming and framing in slides of netconf and plumbers conferences as well as LKML archives.
14.
by tgraf 6y ago
I'm not going to spam this forum with a marketing pitch so I'll just refer to https://www.isovalent.com/product and add that you can buy a Cilium Enterprise distribution with enterprise specific add-ons from us.
15.
by tgraf 6y ago
Another good way to get started is https://ebpf.io/ . It features pointers that go beyond just networking and also cover usage of use cases involving tracing, profiling, security, ...
16.
by tgraf 6y ago
The shift from BPF to eBPF was less of an evolutionary step as the name might indicate. The overlap with the name BPF is primarily due to the requirement for eBPF to be a superset of BPF in order to avoid having to maintain two virtual mach
17.
by tgraf 6y ago
Disclaimer: I wrote the post. Happy to answer any questions.
18.
by tgraf 6y ago
Disclaimer: I'm one of the organizers of eBPF summit If you are interested in eBPF, consider attending the eBPF summit [0] on Oct 28-29. Community driven, free and virtual. I've spotted half a dozen "getting started with eBPF
19.
EBPF Summit 2020 – CFP is now open(ebpf.io)
3 points by tgraf 6y ago|1 comments
20.
by tgraf 6y ago
We’re excited to announce that the call for proposals is now open for the inaugural eBPF Summit, a virtual event, targeted at DevOps, platform architects and developers, to be held October 28-29, 2020. The summit is offered at no cost, and
21.
by tgraf 8y ago
https://www.slideshare.net/ThomasGraf5/accelerating-envoy-an... Slide 21-25
22.
by tgraf 8y ago
[Disclaimer: I'm one of the Cilium authors] We have been trying to reproduce the performance results ever since the article was published as this is not in line at all with what we measure daily in our CI. We can easily do a multiple o