golang dependency Add/update a new Kubernetes version Optional: Docker and IPv6 Debugging Building Container Images Developer images Official release images Experimental Docker BuildKit and Buildx support transparently securing the network connectivity between application services deployed using Linux container management platforms like Docker and Kubernetes. At the foundation of Cilium is a new Linux kernel without any changes to the application code or container configuration. What is Hubble? Hubble is a fully distributed networking and security observability platform. It is built on top of Cilium and eBPF to

golang dependency Add/update a new Kubernetes version Optional: Docker and IPv6 Debugging Building Container Images Developer images Official release images Experimental Docker BuildKit and Buildx support transparently securing the network connectivity between application services deployed using Linux container management platforms like Docker and Kubernetes. At the foundation of Cilium is a new Linux kernel without any changes to the application code or container configuration. What is Hubble? Hubble is a fully distributed networking and security observability platform. It is built on top of Cilium and eBPF to

Box Making Changes Add/update a golang dependency Optional: Docker and IPv6 Debugging Building Container Images Developer images Official release images Update cilium-builder and cilium-runtime images transparently securing the network connectivity between application services deployed using Linux container management platforms like Docker and Kubernetes. At the foundation of Cilium is a new Linux kernel without any changes to the application code or container configuration. What is Hubble? Hubble is a fully distributed networking and security observability platform. It is built on top of Cilium and BPF to

golang dependency Add/update a new Kubernetes version Optional: Docker and IPv6 Debugging Building Container Images Developer images Official release images Official Cilium repositories Update cilium-builder transparently securing the network connectivity between application services deployed using Linux container management platforms like Docker and Kubernetes. At the foundation of Cilium is a new Linux kernel without any changes to the application code or container configuration. What is Hubble? Hubble is a fully distributed networking and security observability platform. It is built on top of Cilium and eBPF to

Local Development in Vagrant Box Making Changes Add/update a golang dependency Debugging Building Container Images Developer images Official release images Update cilium-builder and cilium-runtime images transparently securing the network connectivity between application services deployed using Linux container management platforms like Docker and Kubernetes. At the foundation of Cilium is a new Linux kernel Cilium security policies can be applied and updated without any changes to the application code or container configuration. Why Cilium? The development of modern datacenter applications has shifted to a

Development process End-To-End Testing Framework How to contribute Pull request review process Building Container Images Documentation Developer’s Certificate of Origin Release Management Release Cadence Stable transparently securing the network connectivity between application services deployed using Linux container management platforms like Docker and Kubernetes. At the foundation of Cilium is a new Linux kernel Cilium security policies can be applied and updated without any changes to the application code or container configuration. Why Cilium? The development of modern datacenter applications has shifted to a

Development process End-To-End Tes�ng Framework How to contribute Pull request review process Building Container Images Documenta�on CI / Jenkins Release Management Developer’s Cer�ficate of Origin BPF and XDP transparently securing the network connec�vity between applica�on services deployed using Linux container management pla�orms like Docker and Kubernetes. At the founda�on of Cilium is a new Linux kernel Cilium security policies can be applied and updated without any changes to the applica�on code or container configura�on. Why Cilium? The development of modern datacenter applica�ons has shi�ed to a service-

paper in OSDI'20 [0] [0] https://sites.google.com/site/tangchq/papers/Twine-OSDI20.pdf twagent Container (aka “task”): ● namespaces: cgroup, mount, pid and optionally: ipc, net, user, uts ● cgroup not in-use) ○ host services connector (netns is in-use) ○ transparent proxy (mostly for TLS) ○ container firewall ○ network faults injection ○ network counters (rack, datacenter, region) ● but not only: Integrated with service discovery: can filter by service name (dynamic set of IP:port endpoints) Container firewall (twfw) Network faults injection: ● Same per-packet firewall is used ● Attached to a

our platform healthy Ramiro Berrelleza October 28, 2020 ● Co-founder of Okteto ● Former architect @ Atlassian, Software Engineer @ Azure ● @rberrelleza Hey everyone! ● Developer platform, powered young and naive Attempt #1 - The result ● The default falco rules are not well suited for a dev platform ● The processing overhead is non-trivial ● Falco's eBPF module + ContainerOS was not very performant

From Managed Kubernetes to App Platform: 1.5 Years of Cilium Usage at DigitalOcean Timo Reimann, DigitalOcean October 28, 2020 digitalocean.com History / Context ● DigitalOcean Kubernetes Service Move to using eBPF kube-proxy replacement ● Look more into Hubble digitalocean.com App Platform ● App Platform: push-to-deploy PaaS offering by DigitalOcean ● Built on top of DOKS with multi-tenancy