Cloud Native eBPF Day Europe 2022

Click here to view captioning/translation in the MeetingPlay platform!

eBPF is taking the cloud native world by storm. Where will it lead us? This talk introduces eBPF by looking at the ecosystem of eBPF-enabled CNCF projects focusing on what they provide for end-users and how they will evolve in the coming years. The projects covered span a wide set of use cases including networking, security, service mesh, observability, and performance monitoring. We will answer questions such as "Why is eBPF so powerful?" "What is different to prior similar technologies?", and "What values does eBPF provide for end users?". To sum it all up, we will together look at how eBPF itself will evolve in the coming years and what impact that will have to the cloud native world.

Click here to view captioning/translation in the MeetingPlay platform!

The digital systems of IKEA are situated in public cloud and private data centers around the world. In this talk we’ll highlight some of the challenges – and opportunities - we faced in setting up a large scale, multi-cluster distributed Kubernetes environment across our data centers. We’ll share how we have used Cilium and its eBPF features to have a better scaling profile, to improve observability and even to replace some of our proprietary load balancers. * Connecting Kubernetes workloads across our BGP network * Protecting multi-tenant workloads with multi-cluster network policy * Cilium support for multi-homed pods * Mimicking availability zones with Cilium ClusterMesh * Use Cilium with XDP, ServiceType Loadbalancer and Ingress to replace our proprietary load balancer fronting workload. You’ll leave this talk understanding how you can use Cilium and its eBPF capabilities to build and instrument your network and obtain great observability.

Click here to view captioning/translation in the MeetingPlay platform!

eBPF being a promising technology is no news. And C is the defacto choice for writing eBPF programs. The act of writing C programs in an error-prone process. Even the eBPF verifier makes life a lot easier; it is still possible to write unsafe programs and make trivial mistakes that elude the compiler but are detected by the verifier in the load time, which are preventable with compile-time checks. It is where Rust comes in. Rust is a language designed for safety. Recently the Rust compiler gained the ability to compile to the eBPF virtual machine, and Rust became an official language for Linux. We discover more and more use cases where eBPF can be helpful. We find more efficient ways to build safe eBPF programs that are parallel to these developments. We will demonstrate how we made applications combined with Rust in the data plane for more safety and Go in the control plane for a higher development pace to target Kubernetes for security, observability and performance tuning.

Click here to view captioning/translation in the MeetingPlay platform!

Bpftrace is an essential tool for developers investigating the workings and performance of applications on Linux systems; Pixie is an eBPF-based observability platform for real-time troubleshooting of applications on Kubernetes. What if you could bring these two open-source projects together and combine the power of bpftrace with Pixie's approach to monitoring Kubernetes? This session presents Pixie's bpftrace integration and how it enables dynamic monitoring of Kubernetes clusters. This talk will show how Pixie can deploy a bpftrace program across all the nodes of your cluster, and make the collected data available for querying and visualization. Topics include (1) an overview of how the Pixie bpftrace integration works, (2) how to import existing bpftrace scripts (or write new ones) into Pixie, and (3) how to use the Pixie's query language to perform real-time debugging of Kubernetes applications. The talk will include a number of live demonstrations, including how bpftrace + Pixie can identify TCP issues, and even how to discover patterns of unauthorized bitcoin mining in your K8s cluster.

Click here to view captioning/translation in the MeetingPlay platform!

In this talk, we will explore how someone can use eBPF to get insights about the communications happening in a Kubernetes cluster. We will write an eBPF program and then use the BumbleBee (https://github.com/solo-io/bumblebee) open source project to build and deploy it. This program gathers information about all the network communications happening in the cluster and publishes the corresponding metrics that we store on Prometheus. We will then deploy a service that gets the metrics and correlate them with the Pod and Service IP addresses to build a graph displaying all the communications.

Click here to view captioning/translation in the MeetingPlay platform!

Many cloud native projects started using eBPF to provide OS and application observability, networking and security. Kubernetes deployments run on many different kernel versions and currently there is a big challenge on portability, as the eBPF programs depend heavily on the kernel version. BPF CO-RE (Compile Once – Run Everywhere) is a mechanism to solve this issue. It requires the kernel to expose information about its types by using BTF (BPF Type Format), which is not always available. BTFHub aims to solve that by providing BTF files for released kernels that don't support BTF. However, it’s not possible to ship the BTF information for many different kernels with the application because of size limitations. BTFGen generates very small BTF files that can be shipped with the application, making it easier to run eBPF programs in different kernel versions. Mauricio will introduce the challenges of creating portable eBPF cloud native ready applications and how BTFGen helps to solve those challenges. The talk covers BTFGen implementation, in bpftool, and discusses our experience in integrating it to the open-source eBPF powered projects Inspektor Gadget and Tracee.

Click here to view captioning/translation in the MeetingPlay platform!

In this special edition Klustered, David sends our worthy opponents from Isovalent, Microsoft, and Sysdig through a series of eBPF challenges. Wielding only their tools of choice, Cilium, Inspektor Gadget, and Sysdig/Falco, the teams must unravel the 3 breaks across their bare metal Kubernetes clusters to get their applications working.

During this panel we’ll show clips of each episode while discussing how eBPF changes the game for debugging, networking, and security.

We welcome your questions on eBPF and the tools above throughout the session, so come have a giggle and enjoy the show.

Click here to view captioning/translation in the MeetingPlay platform!

Click here to view captioning/translation in the MeetingPlay platform!