Cilium + eBPF Day North America 2024
2024-11-12
Salt Lake City, United States
who it's for
platform engineers, site reliability engineers, security engineers, network engineers, observability engineers, kernel and eBPF engineers
topics
Cilium multi-cluster migrations; transparent WireGuard encryption; reading conntrack eBPF maps; Hubble without Cilium (Retina agent); eBPF in-kernel state machines (Game of Life); eBPF-based syscall filtering and seccomp; XDP-accelerated IPSec forwarding; custom etcd KV-store for cluster mesh; bpf_probe_write_user and user memory writes; production traffic enrichment with OpenTelemetry
| title | author | length |
|---|---|---|
| Welcome + Opening Remarks | Bill Mulligan | 07m |
Welcome and housekeeping plus concrete project news: Cilium hits 20K GitHub stars and ships 1.6 with netkit (container networking as fast as host), multicast… | ||
| Confluent's Multi-Cloud Journey to Cilium: Pitfalls and Lessons Learned | Nimisha Mehta, Alvaro Aleman | 24m |
Confluent migrates thousands of Kubernetes clusters across AWS, GCP and Azure to Cilium for transparent encryption (WireGuard), DNS FQDN policies and Hubble… | ||
| Insightful Traffic Monitoring: Harnessing Cilium for Comprehensive Network Observability | Sudheendra Murthy, Adithya Yavanamanda | 27m |
eBay builds a scalable traffic Observer that reads Cilium conntrack eBPF map on each node, batches reads and metric pushes, and streams enriched events via… | ||
| eBPF: Now Turing Complete! | Liz Rice | 05m |
Implements Conway's Game of Life entirely inside the kernel using eBPF by splitting logic across multiple programs and persisting cells in maps for state… | ||
| eBPF for Creating Least Privileged Policies; What Do I Need to Know to Prepare for the Next CVEs? | Natalia Reka Ivanko, John Fastabend | 16m |
Claim: eBPF moves policy enforcement into the kernel so enforcement survives agent downtime and avoids terabytes of userland telemetry. Implementation uses… | ||
| Reinventing Seccomp for Fun and Profiles | Ben Hirschberg, Dor Serero | 26m |
A proof-of-concept reimplements seccomp features using eBPF, KRSI/LSM hooks and tracepoints to provide eBPF + KRSI based syscall filtering, argument-level… | ||
| Scaling Network Policy Enforcement Beyond the Cluster Boundary with Cilium | Hemanth Malla, Maxime Visonneau | 26m |
Datadog runs Cilium across hundreds of thousands of pods in hundreds of clusters and implements a custom dedicated etcd KV-store mesh that converts cluster… | ||
| How to Use XDP and eBPF to Accelerate IPSec Throughput by 400% | Ryan Drew | 21m |
A practical POC injects a 3‑byte inner‑packet hash into the ESP SPI and uses the xtp/BPF redirect helper to steer decrypted packets to CPUs, implemented in… | ||
| Live Migrating Production Clusters From Calico to Cilium | Moh Ahmed, Raymond Maika | 28m |
Live in-place migration of ~20 clusters (many production, up to 500 nodes) swaps Calico for Cilium using Cilium node config CRD and a per-node labeled… | ||
| Hubble Beyond Cilium | Anubhab Majumdar, Mathew Merrick | 25m |
Shows how Hubble runs without Cilium by keeping Hubble server code untouched and feeding it flow objects from a new Retina agent with plugin API that attaches… | ||
| So You Want to Write Memory with eBPF? | Nikola Grcevski, Mike Dame | 21m |
Implemented W3C trace context propagation for OpenTelemetry Go using eBPF and prototype code actually writes into user memory but runs into kernel lockdown… | ||
| ⚡ Lightning Talk: Don't Get Blown up! Avoiding Configuration Gotchas for Tetragon Newbies | Pratik Lotia | 11m |
Five configuration pitfalls and concrete fixes: default logging floods clusters (observed 100 GB/day on a test cluster) so restrict namespaces and event types… | ||
| Lightning Talk: Applying Cilium at Edge with KubeEdge | Tomoya Fujita | 10m |
Cilium runs on KubeEdge nodes after kernel/BPF fixes landed, enabling enabled Cilium on KubeEdge with WireGuard to stitch cloud and edge dataplans; tested on… | ||
| Panel: Exploring eBPF Use Cases in Cloud-Native Security | Oshrat Nir, Anna Kapuścińska, Whitney Lee, Maya Singh, Cortney Nickerson | 36m |
eBPF is shown as a practical kernel-level security layer: teams use Inspector Gadget (OCI gadgets signed with cosign) and Tetragon to load policies, hook… | ||
| Lessons Learned Migrating to Modern Multi-Platform eBPF Programs | Dave Tucker | 24m |
Kepler migrates from BCC’s runtime LLVM compile to ahead-of-time object files using libbpf and the cilium/ebpf ecosystem with bpf2go to embed ELF and… | ||
| Closing Remarks | Bill Mulligan | 03m |
Cilium reports a sharp rise in activity: a CNCF project Journey report shows growing contributor counts and company participation, and a benchmark claims 400%… | ||
| nothing matches | ||