Using eBPF to Bring Kubernetes-Aware Security to the Linux Kernel
summary
eBPF is used to add Kubernetes-aware security directly in the kernel: the demo combines Cilium and BCC with kprobes on a 4.15 minikube host to audit syscalls, distinguish kubectl exec from the main process, and tell sidecar, init and main containers apart to enforce per-container policies. BPF maps hold real‑time rules so updates avoid recompiling, programs swap atomically, and Cilium reports validation at scale (tested to 5,000 nodes, 20k+ pods/services). Policies stop sidecars from reaching Redis and block unwanted external DNS endpoints.
AI-written summary · about
chapters (33)
- 0:00Introduction
- 1:07Dans background
- 2:40What is Linux
- 3:35Runtime Security Attacks
- 4:30Attack Scenario
- 5:20What should security do
- 6:00What is BPF
- 7:25Programs and hook points
- 9:12What are BPF maps
- 10:34Putting it all together
- 11:40Common public BPF projects
- 13:15How can we use eBPF
- 15:02Why eBPF
- 16:12What is Psyllium
- 17:45Runtime attack
- 18:09Examples
- 19:24Other options
- 20:55General purpose operating systems
- 21:59Perfect wine carrier boxes
- 22:35Microservices
- 22:56Mopes Containers
- 24:32microservices services
- 25:25identifying and stopping runtime attacks
- 26:23demo overview
- 27:23the problem with Kubernetes
- 28:27Demo
- 32:02Frontend Policy 1
- 33:35Simple Network Policy
- 34:44Container Awareness
- 36:48Type Run
- 37:23Test
- 37:53Conclusion
- 38:35Questions
related talks
22mRole of eBPF in Kubernetes Networking and Security
36meBPF for Runtime Security
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
29mBuzzing Across the Cloud Native Landscape with eBPF
25mProtecting Modern Workloads with eBPF superpowers
33meBPF for Security
35mAn Introduction to eBPF - Superpowers for Networking, Observability & Security
36mPanel: Exploring eBPF Use Cases in Cloud-Native Security