small Cilium setup on your laptop. Intended as an easy way to get your hands dirty applying Cilium security policies between containers. Concepts: Describes the components of Cilium, and the different models Guides Installation Security Tutorials Advanced Networking Operations Istio Other Orchestrators Concepts Component Overview Terminology Address Management Multi Host Networking Security Datapath Failure Failure Behavior Architecture Datapath Scale Kubernetes Integration Getting Help FAQ Slack GitHub Security Bugs Integrations Kubernetes Introduction Concepts Requirements Configuration Network Policy

small Cilium setup on your laptop. Intended as an easy way to get your hands dirty applying Cilium security policies between containers. Concepts: Describes the components of Cilium, and the different models Guides Installa�on Security Tutorials Advanced Networking Opera�ons Is�o Other Orchestrators Concepts Component Overview Assurances Terminology Address Management Mul� Host Networking Security Architecture Datapath Datapath Scale Kubernetes Integra�on Ge�ng Help FAQ Slack GitHub Security Bugs Integra�ons Kubernetes Introduc�on Concepts Requirements Configura�on Network Policy Endpoint CRD Kubernetes Compa�bility

small Cilium setup on your laptop. Intended as an easy way to get your hands dirty applying Cilium security policies between containers. Concepts: Describes the components of Cilium, and the different models Installation Network Policy Security Tutorials Advanced Networking Operations Istio Other Orchestrators Concepts Component Overview Terminology Address Management Multi Host Networking Security Datapath Failure Failure Behavior Architecture Datapath Scale Kubernetes Integration Getting Help FAQ Slack GitHub Security Bugs Integrations Kubernetes Introduction Concepts Requirements Configuration Network Policy

small Cilium setup on your laptop. Intended as an easy way to get your hands dirty applying Cilium security policies between containers. Concepts: Describes the components of Cilium, and the different models Installation Network Policy Security Tutorials Advanced Networking Operations Istio Other Orchestrators Concepts Component Overview Terminology Networking Network Security eBPF Datapath Observability Integration Multi-Cluster (Cluster Mesh) Getting Help FAQ Slack GitHub Training Enterprise support Security Bugs Operations System Requirements Summary Linux Distribution Compatibility Matrix Linux Kernel

small Cilium setup on your laptop. Intended as an easy way to get your hands dirty applying Cilium security policies between containers. Concepts: Describes the components of Cilium, and the different models Installation Observability Network Policy Security Tutorials Advanced Networking Cluster Mesh Operations Istio Concepts Component Overview Terminology Networking Network Security eBPF Datapath Observability Kubernetes Integration Multi-Cluster (Cluster Mesh) Getting Help FAQ Slack GitHub Training Enterprise support Security Bugs Operations System Requirements Summary Linux Distribution Compatibility & Considerations

small Cilium setup on your laptop. Intended as an easy way to get your hands dirty applying Cilium security policies between containers. Concepts: Describes the components of Cilium, and the different models Installation Network Policy Security Tutorials Advanced Networking Operations Istio Other Orchestrators Concepts Component Overview Terminology Networking Network Security eBPF Datapath Kubernetes Integration Integration Multi-Cluster (Cluster Mesh) Getting Help FAQ Slack GitHub Security Bugs Operations System Requirements Summary Linux Distribution Compatibility Matrix Linux Kernel Required Kernel Versions

small Cilium setup on your laptop. Intended as an easy way to get your hands dirty applying Cilium security policies between containers. Concepts: Describes the components of Cilium, and the different models Installation Observability Network Policy Security Tutorials Advanced Networking Cluster Mesh Operations Istio Concepts Component Overview Terminology Networking Network Security eBPF Datapath Observability Kubernetes Integration Multi-Cluster (Cluster Mesh) Getting Help FAQ Slack GitHub Training Enterprise support Security Bugs Operations System Requirements Summary Architecture Support Linux Distribution Compatibility

Node L4LB Architecture XDP DPlane L3DSR with IPIP, Magrev Hashing, Session caching, etc… API Server FRR (bgpd) bcc-based CPlane Upstream Routers Advertise VIP with eBGP Configure with RPC Health com/torvalds/linux/ commit/62ebaeaedee7591c257543 d040677a60e35c7aec eth VM1 VM2 VM3 SRv6 + iptables Security Policy VRF VRF VRF For More Information • Our SRv6 DC network architecture (en) • https://speakerdeck

Packet Filter Dynamically program the kernel for efficient networking, observability, tracing, and security. • 稳定 • 高性能 • 安全（内核verifier机制） • 动态可编程（无需重启） eBPF程序加载和校验 02. eBPF程序加载和校验 eBPF事件驱动 Kprobe/Kretprobe 业务应用 应用框架 容器虚拟化 系统调用 内核 应用性能监控（APM） Kubernetes监控 Kubernetes组件异常： Scheduler, KCM， etcd，api-server, coredns… 系统调用异常：网络请 求，内存申请，文件操 作，CGroup… 内核异常：进程调度， 内存管理，文件管理， 夯机宕机，资源异 常… 应用组件异常：线程池满，数据库连接无法获取，

more than 150 engineers Reduce operational complexity Scalability Availability Observability Security Reliability Messaging Analytics Multi-tenancy caveats ● Single underlying infrastructure ● operational complexity ○ Infrastructure is operated by a team of 3 engineers ● Reduce costs ● Security issues ● Scalability issues Namespaces +400 Pods +10k Services +3k CPU +2k Mem +5TB kube-proxy replacement NetworkPolicy logging Multi-cluster DNS Aware NetworkPolicy Increased Istio security External Services TLS visibility Performance Kafka policies by labels