Socket termination for policy enforcement and load-balancing
summary
Cilium needs to kill client sockets when backends or policies change, so the work adds a BPF iterator to scan kernel socket structs for destination IP or socket cookie and a new sock_destroy helper BPF call that invokes the kernel’s socket-abort path (sets ECONNABORTED, sends reset, cleans up). Netlink sock_diag is too limited and namespace-bound; a tested selftest attaches a cgroup sock_ops program, records socket cookies, runs the iterator, and calls the helper. Future optimization is a sock-hash map to avoid global iteration.
AI-written summary · about
chapters (11)
- 0:00Introduction to talk
- 1:51Cilium networking overview
- 3:35Socket-based load balancing issues
- 5:26Policy enforcement challenges
- 7:11Problem breakdown and approaches
- 11:08Evaluating socket termination methods
- 13:43Kernel socket destroy API
- 15:11Mailing list discussions
- 16:40BPF helper for socket destroy
- 18:47Summary and next steps
- 20:14Q&A session
related talks
31mNetworking Failure Stories: How to Maintain, Break, and Fix Cluster Connectivity
38mUnderstanding and Troubleshooting the eBPF Datapath in Cilium
28mLessons from Building Scalable Network Policy Enforcement with eBPF
11mCilium Service Mesh
44mCilium - Container Security and Networking Using BPF and XDP
24mSpeedrun Through Splicing Sockets with Sockmap
10mTaming the BPF LRU: Eliminating TCP Resets in Cilium
31mUnleashing the Tides of Kubernetes Networking by Removing kube-proxy