Zero instrumentation monitoring with your first steps in eBPF Beatriz Martínez, Isovalent - @beatrizmrg October 28, 2020 2 What will we be doing? 3 How are we going to do it? 4 Demo time 5 Tracing easier: ○ First approach: C, LLVM/CLANG, tc ○ Second approach: gobpf, bcc ● Non-instrumentation monitoring http://34.70.147.68 $curl 34.70.147.68:8083 Let’s represent the attendees in the map! https://github

Identity Aware Threat Detection and Network Monitoring by using eBPF Natalia Reka Ivanko, Isovalent October 28, 2020 ● ● ○ ● ○ ○ ○ ○ ● ● ● ● ● ● ● ● ○ ● ○ ○ ○ ● ● ● ○ ● ○ ○ ● ●

Enforcement Modes : Detailed walkthrough of the policy language structure and the supported formats. Monitoring & Metrics : Instructions for configuring metrics collection from Cilium. Troubleshooting : Describes Layer 3 Examples Layer 4 Examples Layer 7 Examples Kubernetes Endpoint Lifecycle Troubleshooting Monitoring & Metrics Installation cilium-agent cilium-operator Troubleshooting Component & Cluster Health source host. Note: load balancing requires connection tracking to be enabled. This is the default. Monitoring and Troubleshooting The ability to gain visibility and to troubleshoot issues is fundamental to

Network Policy : Detailed walkthrough of the policy language structure and the supported formats. Monitoring & Metrics : Instructions for configuring metrics collection from Cilium. Troubleshooting : Describes 7 Protocol Visibility Using Kubernetes constructs in policy Endpoint Lifecycle Troubleshooting Monitoring & Metrics Cilium Metrics Hubble Metrics Example Prometheus & Grafana Deployment Metrics Reference HTTP calls are being made? What Kafka topics does a service consume from or produce to? Network monitoring & alerting Is any network communication failing? Why is communication failing? Is it DNS? Is it

Enforcement Modes : Detailed walkthrough of the policy language structure and the supported formats. Monitoring & Metrics : Instructions for configuring metrics collection from Cilium. Troubleshooting : Describes Configuration Automatic Adjustment Metrics Understanding the log output Configuration Core Agent Monitoring & Metrics Installation cilium-agent cilium-operator Troubleshooting Component & Cluster Health source host. Note: load balancing requires connection tracking to be enabled. This is the default. Monitoring and Troubleshooting The ability to gain visibility and to troubleshoot issues is fundamental to

Network Policy : Detailed walkthrough of the policy language structure and the supported formats. Monitoring & Metrics : Instructions for configuring metrics collection from Cilium. Troubleshooting : Describes 7 Protocol Visibility Using Kubernetes constructs in policy Endpoint Lifecycle Troubleshooting Monitoring & Metrics Cilium Metrics Hubble Metrics Example Prometheus & Grafana Deployment Metrics Reference HTTP calls are being made? What Kafka topics does a service consume from or produce to? Network monitoring & alerting Is any network communication failing? Why is communication failing? Is it DNS? Is it

Network Policy : Detailed walkthrough of the policy language structure and the supported formats. Monitoring & Metrics : Instructions for configuring metrics collection from Cilium. Troubleshooting : Describes 7 Protocol Visibility Using Kubernetes constructs in policy Endpoint Lifecycle Troubleshooting Monitoring & Metrics Cilium Metrics Hubble Metrics Example Prometheus & Grafana Deployment Metrics Reference HTTP calls are being made? What Kafka topics does a service consume from or produce to? Network monitoring & alerting Is any network communication failing? Why is communication failing? Is it DNS? Is it

Enforcement Modes : Detailed walkthrough of the policy language structure and the supported formats. Monitoring & Metrics : Instruc�ons for configuring metrics collec�on from Cilium. Troubleshoo�ng : Describes Layer 3 Examples Layer 4 Examples Layer 7 Examples Kubernetes Endpoint Lifecycle Troubleshoo�ng Monitoring & Metrics Exported Metrics Cilium as a Kubernetes pod Cilium as a host-agent on a node Troubleshoo�ng source host. Note: load balancing requires connec�on tracking to be enabled. This is the default. Monitoring and Troubleshooting The ability to gain visibility and to troubleshoot issues is fundamental to

Network Policy : Detailed walkthrough of the policy language structure and the supported formats. Monitoring & Metrics : Instructions for configuring metrics collection from Cilium. Troubleshooting : Describes 7 Protocol Visibility Using Kubernetes constructs in policy Endpoint Lifecycle Troubleshooting Monitoring & Metrics Cilium Metrics Hubble Metrics Example Prometheus & Grafana Deployment Metrics Reference HTTP calls are being made? What Kafka topics does a service consume from or produce to? Network monitoring & alerting Is any network communication failing? Why is communication failing? Is it DNS? Is it

problems. Projects such as BCC, bpftrace, Hubble, Parca, or Pyroscope use eBPF for tracing and monitoring purposes. The team flew and traveled, becoming so prosperous That the news spread around, even