Zero instrumentation monitoring with your first steps in eBPF Beatriz Martínez, Isovalent - @beatrizmrg October 28, 2020 2 What will we be doing? 3 How are we going to do it? 4 Demo time 5 Tracing

management . . . . . . . . . . . . . . . . . . . . . . . . . . 194 10.8 List of the meaning of the trust code . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194 10.9 List reading process waits until there is nothing to read before terminating. The size of the pipe is always zero --- it does not store data, it just links two processes like the functionality offered by the shell number are displayed by executing ls(1) as the following. $ ls -l /dev/sda /dev/sr0 /dev/ttyS0 /dev/zero brw-rw---T 1 root disk 8, 0 Oct 16 20:57 /dev/sda brw-rw---T+ 1 root cdrom 11, 0 Oct 16 21:53 /dev/sr0

from 1,000 tests). » The passthrough tests of the Serial Peripheral Interface (SPI bus) show near-zero performance loss (average value taken from 1,000 tests). » The passthrough tests of the Controller router Wakeup proxy NIC multi-queue Polling/Interrupt mode Regional hugepages Dynamic core binding Zero copy Distributed TCP hash table Telecom Finance ...... Server Cloud Edge Embedded Efficient Concurrency leverages technologies such as regional hugepage splitting, dynamic core binding, and full-path zero-copy. • Hardware acceleration: Hardware offload approaches, including TCP segmentation offload (TSO)

address The IP address is a unique identifying string expressed as four decimal numbers ranging from zero (0) to two-hundred and fifty-five (255), separated by periods, with each of the four numbers representing Address of 192.168.1.0, which specifies the first three bytes of the Class C 192.168.1 network and a zero (0) for all the possible hosts on the network. • Broadcast Address The Broadcast Address is an IP failback but that failback can happen only with operator intervention. • A numeric value greater than zero specifies deferred failback, expressed in seconds. The default value is manual. rr_min_io Specifies

security-apparmor AppArmor 3 security-firewall Firewall 3 security-certificates Certificates 3 security-trust-store CA trust store 3 security-console Console 2 High Availability 3 ubuntu-ha-introduction Introduction executed via “sh -c”) or a list, in which case it is executed directly. Any command exiting with a non-zero return code is considered an error and aborts the install (except for error-commands, where it is Security risk When using any software that you have not audited yourself, you must implicitly trust the publisher of that software with your data. However, with third party APT repositories, there are

alternative certificates for external destinations. This model requires each client workload to also trust this new certificate, otherwise the client’s TLS library will reject the connection as invalid. In Ensure that all clients where TLS inspection is have the CA certificate installed so that they will trust all certificates signed by that CA. 5. Given that Cilium will be terminating the initial TLS connection creating a new TLS connection to the destination, Cilium must be told the set of CAs that it should trust when validating the new TLS connection to the destination service. Note In a non-demo environment

try http://www.rsyslog.com/e/0 ] Sep 15 00:14:01 localhost systemd[1]: Started update of the root trust anchor for DNSSEC validation in unbound. Sep 15 00:14:01 localhost sssd[kcm][2764]: Shutting down dd 命令是一个比较重要而且比较有特色的命令，它能够让用户按照指定大小和个数的数 据块来复制文件的内容。当然，如果愿意的话，还可以在复制过程中转换其中的数据。Linux 系统中有一个名为/dev/zero 的设备文件，每次在课堂上解释它时都充满哲学理论的色彩。因 为这个文件不会占用系统存储空间，但却可以提供无穷无尽的数据，因此常常使用它作为 dd 命令的输入文件，来生成一个指定大小的文件。dd count 设置要复制“块”的个数 例如，用 dd 命令从/dev/zero 设备文件中取出一个大小为 560MB 的数据块，然后保存成 名为 560_file 的文件。在理解了这个命令后，以后就能随意创建任意大小的文件了： [root@linuxprobe~]# dd if=/dev/zero of=560_file count=1 bs=560M 1+0 records

groups Group details are stored inside the /etc/group file. Each user has one primary group, and zero or more supplementary groups. wheel group If your user is part of the wheel group, then it has sudo about the supported modes of # operation for /etc/resolv.conf. nameserver 127.0.0.53 options edns0 trust-ad search localdomain That strange IP address, 127.0.0.53 is a special one managed by systemd-resolved | -S (show) | | -o outgoing | LIMIT | | | -Z (zero) | | -m mac | RETURN | | | -N |

groups Group details are stored inside the /etc/group file. Each user has one primary group, and zero or more supplementary groups. 5.4 wheel group If your user is part of the wheel group, then it has about the supported modes of # operation for /etc/resolv.conf. nameserver 127.0.0.53 options edns0 trust-ad search localdomain 13.5. /etc/hosts 83 Linux command line for you and me Documentation, Release USER_DEFINED_CHAINS | -i incoming | ˓→SNAT | | | -S (show) | | -o outgoing | ˓→LIMIT | | | -Z (zero) | | -m mac | ˓→RETURN | | | -N | | -m time | ˓→MASQUERADE | | | -X | | -m quota | ˓→ | | |

alternative certificates for external destinations. This model requires each client workload to also trust this new certificate, otherwise the client’s TLS library will reject the connection as invalid. In Ensure that all clients where TLS inspection is have the CA certificate installed so that they will trust all certificates signed by that CA. 5. Given that Cilium will be terminating the initial TLS connection creating a new TLS connection to the destination, Cilium must be told the set of CAs that it should trust when validating the new TLS connection to the destination service. Note In a non-demo environment