Zero instrumentation monitoring with your first steps in eBPF Beatriz Martínez, Isovalent - @beatrizmrg October 28, 2020 2 What will we be doing? 3 How are we going to do it? 4 Demo time 5 Tracing easier: ○ First approach: C, LLVM/CLANG, tc ○ Second approach: gobpf, bcc ● Non-instrumentation monitoring http://34.70.147.68 $curl 34.70.147.68:8083 Let’s represent the attendees in the map! https://github

Identity Aware Threat Detection and Network Monitoring by using eBPF Natalia Reka Ivanko, Isovalent October 28, 2020 ● ● ○ ● ○ ○ ○ ○ ● ● ● ● ● ● ● ● ○ ● ○ ○ ○ ● ● ● ○ ● ○ ○ ● ●

collaboration Host VM Container shim QEMU process rexec server Rexec cross-host startup and monitoring DPU Management-plane processes libvirtd dockerd virsh client Kubernetes Server 011 openEuler drives. • The capabilities of the management plane are insufficient, and device management or I/O monitoring methods are absent. Project Introduction Applications (VM, CSD) SCM NVMe SSD HDD SSD Ceph server various storage media. • Storage management: provides functions such as device management, I/O monitoring, and maintenance and test tools to manage devices. Efficient Concurrency and Ultimate Performance

Enforcement Modes : Detailed walkthrough of the policy language structure and the supported formats. Monitoring & Metrics : Instructions for configuring metrics collection from Cilium. Troubleshooting : Describes Layer 3 Examples Layer 4 Examples Layer 7 Examples Kubernetes Endpoint Lifecycle Troubleshooting Monitoring & Metrics Installation cilium-agent cilium-operator Troubleshooting Component & Cluster Health source host. Note: load balancing requires connection tracking to be enabled. This is the default. Monitoring and Troubleshooting The ability to gain visibility and to troubleshoot issues is fundamental to

Network Policy : Detailed walkthrough of the policy language structure and the supported formats. Monitoring & Metrics : Instructions for configuring metrics collection from Cilium. Troubleshooting : Describes 7 Protocol Visibility Using Kubernetes constructs in policy Endpoint Lifecycle Troubleshooting Monitoring & Metrics Cilium Metrics Hubble Metrics Example Prometheus & Grafana Deployment Metrics Reference HTTP calls are being made? What Kafka topics does a service consume from or produce to? Network monitoring & alerting Is any network communication failing? Why is communication failing? Is it DNS? Is it

Enforcement Modes : Detailed walkthrough of the policy language structure and the supported formats. Monitoring & Metrics : Instructions for configuring metrics collection from Cilium. Troubleshooting : Describes Configuration Automatic Adjustment Metrics Understanding the log output Configuration Core Agent Monitoring & Metrics Installation cilium-agent cilium-operator Troubleshooting Component & Cluster Health source host. Note: load balancing requires connection tracking to be enabled. This is the default. Monitoring and Troubleshooting The ability to gain visibility and to troubleshoot issues is fundamental to

Network Policy : Detailed walkthrough of the policy language structure and the supported formats. Monitoring & Metrics : Instructions for configuring metrics collection from Cilium. Troubleshooting : Describes 7 Protocol Visibility Using Kubernetes constructs in policy Endpoint Lifecycle Troubleshooting Monitoring & Metrics Cilium Metrics Hubble Metrics Example Prometheus & Grafana Deployment Metrics Reference HTTP calls are being made? What Kafka topics does a service consume from or produce to? Network monitoring & alerting Is any network communication failing? Why is communication failing? Is it DNS? Is it

Network Policy : Detailed walkthrough of the policy language structure and the supported formats. Monitoring & Metrics : Instructions for configuring metrics collection from Cilium. Troubleshooting : Describes 7 Protocol Visibility Using Kubernetes constructs in policy Endpoint Lifecycle Troubleshooting Monitoring & Metrics Cilium Metrics Hubble Metrics Example Prometheus & Grafana Deployment Metrics Reference HTTP calls are being made? What Kafka topics does a service consume from or produce to? Network monitoring & alerting Is any network communication failing? Why is communication failing? Is it DNS? Is it

Enforcement Modes : Detailed walkthrough of the policy language structure and the supported formats. Monitoring & Metrics : Instruc�ons for configuring metrics collec�on from Cilium. Troubleshoo�ng : Describes Layer 3 Examples Layer 4 Examples Layer 7 Examples Kubernetes Endpoint Lifecycle Troubleshoo�ng Monitoring & Metrics Exported Metrics Cilium as a Kubernetes pod Cilium as a host-agent on a node Troubleshoo�ng source host. Note: load balancing requires connec�on tracking to be enabled. This is the default. Monitoring and Troubleshooting The ability to gain visibility and to troubleshoot issues is fundamental to

Network Policy : Detailed walkthrough of the policy language structure and the supported formats. Monitoring & Metrics : Instructions for configuring metrics collection from Cilium. Troubleshooting : Describes 7 Protocol Visibility Using Kubernetes constructs in policy Endpoint Lifecycle Troubleshooting Monitoring & Metrics Cilium Metrics Hubble Metrics Example Prometheus & Grafana Deployment Metrics Reference HTTP calls are being made? What Kafka topics does a service consume from or produce to? Network monitoring & alerting Is any network communication failing? Why is communication failing? Is it DNS? Is it