Accelerating Envoy with the Linux Kernel
summary
Demonstrates that replacing iptables redirects with socket-level BPF and Cilium yields a sidecar data path that skips TCP/Ethernet, preserves TCP handshakes, and measures roughly 3–4× faster request throughput versus iptables redirects (with 50 persistent connections to saturate a node). Shows use of kTLS to push symmetric crypto into the kernel so external TLS connections avoid decrypt/re-encrypt at the sidecar, and presents DDoS, XDP, and tracing examples that work in production.
AI-written summary · about
chapters (19)
- 0:00Intro
- 1:12The Rise of BPF (and XDP)
- 2:23Facebook published BPF numbers for L3/L4 LB at NetDev 2.1
- 3:57BPF/XDP: DDoS mitigation
- 5:32BPF: "dtrace for Linux"
- 7:04What is your favorite iptables memory?
- 8:37Early performance benchmark
- 9:43BPF toolchain
- 12:39Service Mesh / Sidecar Architecture
- 14:54Sidecar Injection (Non-transparent)
- 15:47Sidecar Injection (Transparent)
- 17:20Transparent Sidecar Injection with Cilium
- 18:32Sidecar Injection Performance
- 20:22Transparent acceleration during data phase
- 24:27Cilium in a Nutshell
- 28:39TLS in Service Mesh
- 29:01Accessing external services via sidecar using TLS
- 29:40Option #1: Inject Root CA
- 33:39Sidecar for TLS encrypted connections without CA injection & decryption
related talks
34mIntro: Envoy
21mLightning Talk: Integrating Envoy with DPDK-based virtual networks
39mSecurity & Observability For All Apps - Combining The User/Kernel Powers
11mCilium Service Mesh
36mSecuring Every Bit
44mCilium - Container Security and Networking Using BPF and XDP
15mBeyond OS Sockets: Custom Socket Interfaces in Envoy
21mHow to Use XDP and eBPF to Accelerate IPSec Throughput by 400%