Envoy Mesh Acceleration: From Iptables to Fully BPF
Talkat KubeCon + CloudNativeCon + Open Source Summit China 2021 · on Thursday, 2021-12-09· at 13:15· Kubecon + CloudNativeCon 演讲厅, 虚拟会议 (Virtual)·
summary
The talk examines using eBPF sockmap to speed local communication between Envoy and containers, identifies iptables-based transparent hijacking as a performance bottleneck, and compares existing solutions including Cilium and a previously introduced lightweight approach. It then presents a first-of-its-kind iptables-free design that uses eBPF bind hooks to steer inbound traffic to Envoy, eBPF for transparent outbound redirection, and an integrated control plane for DaemonSet deployment and management via annotations and ConfigMaps.
AI-written summary · about
chapters (21)
- 0:00Intro
- 0:16Istio Architecture
- 1:17Agenda
- 1:43Pod Initialization
- 2:18Iptables Rules
- 2:42Traffic hijacking
- 3:13Envoy VirtualOutbound
- 4:35What is eBPF?
- 4:54Cilium
- 5:12eBPF Architecture
- 5:55eBPF Hello World
- 7:01TCP Inbound
- 9:07eBPF Map
- 14:08Smart DNS Proxying
- 14:27UDP Outbound
- 15:23Sockmap
- 17:04eBPF Prog
- 17:28Duplicate Sock Key
- 18:30Linux kernel Patch
- 18:43Deploy
- 19:14Performance
related talks
16mSuper Charge Your Service Mesh With eBPF
36mCloud Native Superpowers with eBPF
31mThe Future of Service Meshes: Sidecarless or eBPF?
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
14mZero-overhead Container Networking with eBPF and Netkit
32mBuzzing across the eBPF Landscape and into the Hive
46mConquering the Linux network stack: decapsulating packets with eBPF at 6Mpps+
37mEfficient and Flexible Virtual Machine Networking Through eBPF