from the Data Deluge? A case for file filtering in eBPF Giulia Frascaria October 28, 2020 1 The data deluge on modern storage 2 Compute node CPU Network Storage node Flash The data deluge on CPU Network Storage node Flash Data DoS in reverse! 11 Compute node CPU Network Storage node Flash Data So similar yet so different ● DoS is malicious ● Data transfer is business-critical ● We 12 So similar yet so different ● DoS is malicious ● Data transfer is business-critical ● We can blindly drop DoS 13 But could we reduce data transfer size? eBPF filter-reduce 14 Filter Reduce input

Istio Multicluster First Demo About GitOps Second Demo What’s next? Control Plane Data Plane istiod Manages data plane components Handles Custom Resources Handles actual traffic Can be standalone Operator istio-operator Manages Istio installation with IstioOperator Custom Resource Example ● Data Plane with 5 proxies ● Each pod knows endpoint details of other pods ● Can be Sidecar or Gateway What to expect Istio Multicluster First Demo About GitOps Second Demo What’s next? Control Plane Data Plane istiod Some container Istio Sidecar Proxy Istio Ingress Gateway Istio Egress Gateway @rytswd

Information Technology Technology Communication 10,000 + mainstream applications on cloud native, big data CND, MEC, industrial control,etc. Integrated ecosystems and extensive compatibility through distributed maintenance status. Software Package Repositories EPOL Image EUR/oepkgs/... Desktop/SDS/ DB/Big data/... kernel/glibc/ system/GCC/... Core/Base package repository Software package repository of the enablement Linux kernel x86, Arm, RISC-V GPU NPU Real-time kernel Security kernel Database Big data Resource orchestration Desktop system Industrial application ... ... openEuler OpenHarmony / DSoftBus

Cilium Hubble Important common packages Debugging toFQDNs and DNS Debugging Mutexes / Locks and Data Races Release Management Organization Release tracking Release Cadence Backporting process Backport run in standalone mode or as a cluster making it a great choice for local testing with multi-node data paths. Agent nodes are joined to the master node using a node-token which can be found on the master will create a cluster with 3 worker nodes and 1 control-plane node. kind: Cluster apiVersion: kind.x-k8s.io/v1alpha4 nodes: - role: control-plane - role: worker - role: worker - role: worker networking:

Cilium Hubble Important common packages Debugging toFQDNs and DNS Debugging Mutexes / Locks and Data Races Hubble Bumping the vendored Cilium dependency Release Management Organization Release tracking Cilium’s eBPF implementation is optimized for maximum performance, can be attached to XDP (eXpress Data Path), and supports direct server return (DSR) as well as Maglev consistent hashing if the load balancing open http://localhost:12000/ to access the UI. Hubble UI is not the only way to get access to Hubble data. A command line tool, the Hubble CLI, is also available. It can be installed by following the instructions

Cilium Hubble Important common packages Debugging toFQDNs and DNS Debugging Mutexes / Locks and Data Races Hubble Bumping the vendored Cilium dependency Documentation Style Header Titles Body Code Cilium’s eBPF implementation is optimized for maximum performance, can be attached to XDP (eXpress Data Path), and supports direct server return (DSR) as well as Maglev consistent hashing if the load balancing run in standalone mode or as a cluster making it a great choice for local testing with multi-node data paths. Agent nodes are joined to the master node using a node-token which can be found on the master

cilium-agent running on control plane to enable control/data plane connectivity ● Cilium state-keeping in shared cluster etcd Cilium in the DOKS Architecture Data Plane Node #1 cilium-agent Node #1 #1 cilium-agent cilium-operator Node #1 cilium-agent cilium-operator Control Plane kube-api-server cilium-agent kube-controller- manager scheduler ….. etcd VPC digitalocean.com How’s Cilium

Cilium Hubble Important common packages Debugging toFQDNs and DNS Debugging Mutexes / Locks and Data Races Hubble Bumping the vendored Cilium dependency Release Management Organization Release tracking Cilium’s eBPF implementation is optimized for maximum performance, can be attached to XDP (eXpress Data Path), and supports direct server return (DSR) as well as Maglev consistent hashing if the load balancing run in standalone mode or as a cluster making it a great choice for local testing with multi-node data paths. Agent nodes are joined to the master node using a node-token which can be found on the master

iSulad+shimv2+StratoVirt secure container solution reduces the memory overhead and boot time by 40%. • Dual-plane deployment tool eggo: OSs can be installed with one click for ARM and x86 hybrid clusters, while evaluation, and various development tools such as secPaver, to simplify security configuration. Data center Cloud native Edge HPC Embedded/Industrial … CPU: x86, ARM, RISC-V DPU NPU Media Bus Server codes (PACs): The register value is authenticated before being used as a pointer to access the data or code, so as to defend against return-oriented programming (ROP) and jump-oriented programming

run in standalone mode or as a cluster making it a great choice for local testing with multi-node data paths. Agent nodes are joined to the master node using a node-token which can be found on the master kind release was created. kind: Cluster apiVersion: kind.x-k8s.io/v1alpha4 nodes: - role: control-plane - role: worker - role: worker - role: worker networking: disableDefaultCNI: true To change the by Cilium may be out of date and no longer routing api-server requests to the current kind-control-plane container. Recreating the kind cluster and using the helm command Install Cilium will detach the