small Cilium setup on your laptop. Intended as an easy way to get your hands dirty applying Cilium security policies between containers. Concepts: Describes the components of Cilium, and the different models Installation Observability Network Policy Security Tutorials Advanced Networking Cluster Mesh Operations Istio Concepts Component Overview Terminology Networking Network Security eBPF Datapath Observability Kubernetes Integration Multi-Cluster (Cluster Mesh) Getting Help FAQ Slack GitHub Training Enterprise support Security Bugs Operations System Requirements Summary Linux Distribution Compatibility & Considerations

small Cilium setup on your laptop. Intended as an easy way to get your hands dirty applying Cilium security policies between containers. Concepts: Describes the components of Cilium, and the different models Installation Observability Network Policy Security Tutorials Advanced Networking Cluster Mesh Operations Istio Concepts Component Overview Terminology Networking Network Security eBPF Datapath Observability Kubernetes Integration Multi-Cluster (Cluster Mesh) Getting Help FAQ Slack GitHub Training Enterprise support Security Bugs Operations System Requirements Summary Architecture Support Linux Distribution Compatibility

small Cilium setup on your laptop. Intended as an easy way to get your hands dirty applying Cilium security policies between containers. Concepts: Describes the components of Cilium, and the different models Installation Network Policy Security Tutorials Advanced Networking Operations Istio Other Orchestrators Concepts Component Overview Terminology Networking Network Security eBPF Datapath Observability Integration Multi-Cluster (Cluster Mesh) Getting Help FAQ Slack GitHub Training Enterprise support Security Bugs Operations System Requirements Summary Linux Distribution Compatibility Matrix Linux Kernel

small Cilium setup on your laptop. Intended as an easy way to get your hands dirty applying Cilium security policies between containers. Concepts: Describes the components of Cilium, and the different models Installation Network Policy Security Tutorials Advanced Networking Operations Istio Other Orchestrators Concepts Component Overview Terminology Networking Network Security eBPF Datapath Kubernetes Integration Integration Multi-Cluster (Cluster Mesh) Getting Help FAQ Slack GitHub Security Bugs Operations System Requirements Summary Linux Distribution Compatibility Matrix Linux Kernel Required Kernel Versions

small Cilium setup on your laptop. Intended as an easy way to get your hands dirty applying Cilium security policies between containers. Concepts: Describes the components of Cilium, and the different models Installation Network Policy Security Tutorials Advanced Networking Operations Istio Other Orchestrators Concepts Component Overview Terminology Address Management Multi Host Networking Security Datapath Failure Failure Behavior Architecture Datapath Scale Kubernetes Integration Getting Help FAQ Slack GitHub Security Bugs Integrations Kubernetes Introduction Concepts Requirements Configuration Network Policy

small Cilium setup on your laptop. Intended as an easy way to get your hands dirty applying Cilium security policies between containers. Concepts: Describes the components of Cilium, and the different models Guides Installation Security Tutorials Advanced Networking Operations Istio Other Orchestrators Concepts Component Overview Terminology Address Management Multi Host Networking Security Datapath Failure Failure Behavior Architecture Datapath Scale Kubernetes Integration Getting Help FAQ Slack GitHub Security Bugs Integrations Kubernetes Introduction Concepts Requirements Configuration Network Policy

small Cilium setup on your laptop. Intended as an easy way to get your hands dirty applying Cilium security policies between containers. Concepts: Describes the components of Cilium, and the different models Guides Installa�on Security Tutorials Advanced Networking Opera�ons Is�o Other Orchestrators Concepts Component Overview Assurances Terminology Address Management Mul� Host Networking Security Architecture Datapath Datapath Scale Kubernetes Integra�on Ge�ng Help FAQ Slack GitHub Security Bugs Integra�ons Kubernetes Introduc�on Concepts Requirements Configura�on Network Policy Endpoint CRD Kubernetes Compa�bility

more than 150 engineers Reduce operational complexity Scalability Availability Observability Security Reliability Messaging Analytics Multi-tenancy caveats ● Single underlying infrastructure ● operational complexity ○ Infrastructure is operated by a team of 3 engineers ● Reduce costs ● Security issues ● Scalability issues Namespaces +400 Pods +10k Services +3k CPU +2k Mem +5TB kube-proxy replacement NetworkPolicy logging Multi-cluster DNS Aware NetworkPolicy Increased Istio security External Services TLS visibility Performance Kafka policies by labels

Building a Secure and Maintainable PaaS Leveraging eBPF to Scale Security and Improve Platform Support Bradley Whitfield October 28, 2020 2 Dragon - Internal Platform as a Service TIP: To change Auditing ❏ Minimize maintenance and performance overhead ❏ Scale past iptables limits ❏ … 4 Network Security and Auditing 5 Scalability and Maintainability Source: https://commons.wikimedia.org/wiki/F picture:Right click on image > Replace image > Select file ❏ Durable log storage and enterprise Security Information and Event Management (SIEM) integration ❏ hubble observe command to help with troubleshooting

accurate That confounded darkness was repelled in a blast! eBPF can be used in conjunction with Linux Security Modules (LSM) to allow runtime instrumentation of the LSM hooks. eBPF combines seeing and understanding of all networking. This creates security systems operating with richer context and a better level of control than traditional solutions. Projects using eBPF for security purposes include Falco, Tetragon