Reject all other Kafka messages. Require the HTTP header X-Token: [0-9]+ to be present in all REST calls. See the section Layer 7 Policy [http://docs.cilium.io/en/stable/policy/#layer-7] in our documentation strongest security (i.e., enforce least-privilege isolation) between microservices, each service that calls deathstar’s API should be limited to making only the set of HTTP requests it requires for legitimate limiting tiefighter to making only a POST /v1/request-landing API call, but disallowing all other calls (including PUT /v1/exhaust-port). apiVersion: "cilium.io/v2" kind: CiliumNetworkPolicy description:

Reference Guide BPF Architecture Instruction Set Helper Functions Maps Object Pinning Tail Calls BPF to BPF Calls JIT Hardening Offloads Toolchain Development Environment LLVM iproute2 bpftool BPF sysctls Reject all other Kafka messages. Require the HTTP header X-Token: [0-9]+ to be present in all REST calls. See the section Layer 7 Policy [http://docs.cilium.io/en/stable/policy/#layer-7] in our documentation strongest security (i.e., enforce least-privilege isolation) between microservices, each service that calls deathstar’s API should be limited to making only the set of HTTP requests it requires for legitimate

Reference Guide BPF Architecture Instruction Set Helper Functions Maps Object Pinning Tail Calls BPF to BPF Calls JIT Hardening Offloads Toolchain Development Environment LLVM iproute2 bpftool BPF sysctls communicating with each other? How frequently? What does the service dependency graph look like? What HTTP calls are being made? What Kafka topics does a service consume from or produce to? Network monitoring & Reject all other Kafka messages. Require the HTTP header X-Token: [0-9]+ to be present in all REST calls. See the section Layer 7 Policy [http://docs.cilium.io/en/stable/policy/#layer-7] in our documentation

Reference Guide BPF Architecture Instruction Set Helper Functions Maps Object Pinning Tail Calls BPF to BPF Calls JIT Hardening Offloads Toolchain Development Environment LLVM iproute2 bpftool BPF sysctls communicating with each other? How frequently? What does the service dependency graph look like? What HTTP calls are being made? What Kafka topics does a service consume from or produce to? Network monitoring & Reject all other Kafka messages. Require the HTTP header X-Token: [0-9]+ to be present in all REST calls. See the section Layer 7 Policy [http://docs.cilium.io/en/stable/policy/#layer-7] in our documentation

Reference Guide BPF Architecture Instruction Set Helper Functions Maps Object Pinning Tail Calls BPF to BPF Calls JIT Hardening Offloads Toolchain Development Environment LLVM iproute2 bpftool BPF sysctls communicating with each other? How frequently? What does the service dependency graph look like? What HTTP calls are being made? What Kafka topics does a service consume from or produce to? Network monitoring & Reject all other Kafka messages. Require the HTTP header X-Token: [0-9]+ to be present in all REST calls. See the section Layer 7 Policy [http://docs.cilium.io/en/stable/policy/#layer-7] in our documentation

Reference Guide BPF Architecture Instruction Set Helper Functions Maps Object Pinning Tail Calls BPF to BPF Calls JIT Hardening Offloads Toolchain Development Environment LLVM iproute2 bpftool BPF sysctls communicating with each other? How frequently? What does the service dependency graph look like? What HTTP calls are being made? What Kafka topics does a service consume from or produce to? Network monitoring & Reject all other Kafka messages. Require the HTTP header X-Token: [0-9]+ to be present in all REST calls. See the section Layer 7 Policy [http://docs.cilium.io/en/stable/policy/#layer-7] in our documentation

so it lacks the flexibility of user space programming. Applications User space Kernel System calls Files Networking Process Memory Flying for years across the galaxy and back, The crew learned to constant adjustments to adapt to the evolution of the kernel. Applications User space Kernel System calls Files Networking Process Module Memory One day, a concerned Captain Tux reviewed the crew And programs can be loaded and upgraded in real time without the need to restart the kernel. System calls Bees of various talents took many roles in the hive. There were scientists, teachers, switchboard

Reject all other Ka�a messages. Require the HTTP header X-Token: [0-9]+ to be present in all REST calls. See the sec�on Layer 7 Policy [h�p://docs.cilium.io/en/stable/policy/#layer-7] in our documenta�on strongest security (i.e., enforce least-privilege isola�on) between microservices, each service that calls deathstar’s API should be limited to making only the set of HTTP requests it requires for legi�mate limi�ng �efighter to making only a POST /v1/request- landing API call, but disallowing all other calls (including PUT /v1/exhaust- port). apiVersion: "cilium.io/v2" kind: CiliumNetworkPolicy description:

--pid=124 cpu - $ rbperf report [...] rbperf – Rails on-CPU profile rbperf – tracing write(2) calls - $ rbperf record \ --pid=124 event \ --tracepoint=syscalls:sys_enter_write - $ rbperf report [ to profile, thread address) 3. Receives stacktrace 4. Serialisation and persistence BPF tail-calls Bounded loop Challenges - Implementing the stack walking for a dynamic language Challenges -

28, 2020 2 What will we be doing? 3 How are we going to do it? 4 Demo time 5 Tracing Go function with uprobes 6 Demo time 7 Conclusions ● eBPF programs can be attached to different events: