10.16 cilium的网络加速秘诀 蓝维洲 网络组研发负责人 演讲人 cilium介绍 https://cilium.io https://github.com/cilium cilium是 kubernetes 的 CNI 网络解决方案，创新采用了 eBPF datapath，为 kubernetes网络和 linux 社区的 eBPF 发展，启动了 最要的推动作用。 截止 2021 2021.10 ，cilium github 项目已有 9.3K star，Contributors 316位 cilium的特色功能： • 网络功能 • 负载均衡 • 网络安全 • 可观察性 • 多集群连通 注：本 PPT 基于 cilium v1.10.4 进行分析 ��������������� ��������������� �������������������� �������������������� Cilium加速网络 性能提升的主要表现： • 不同场景下，不同程度地降低了 网络数据包的“转发延时” • 不同场景下，不同程度地提升了 网络数据包的“吞吐量” • 不同场景下，不同程度地降低了 转发数据包所需的“ CPU 开销” eBPF 简介 eBPF 技术 在 Linux kernel 3.19 开始被 引入，可在用户态进行 eBPF 程序编程，编译 后，动态加载到内核指定的 hook 点上，以

通过Golang + eBPF实现无侵入应用可观测 张海彬 阿里云 应用可观测技术专家 目 录 eBPF简介 01 eBPF在云原生场景下的应用 02 微服务可观测的挑战 03 Golang + eBPF实现数据采集 04 构建完整的应用可观测系统 05 eBPF简介 第一部分 eBPF简介 01. eBPF简介 eBPF = extended Berkeley Packet eBPF事件驱动 eBPF在云原生场景下的应用 第二部分 网络加速 01.网络加速 From:https://istio.io/latest/zh/blog/2022/merbridge/ eBPF 的可编程能力使其能够内核中完成包的处理和转发，而且可以添加额外扩展能力。 观测和跟踪 将 eBPF 程序附加到跟踪点以及内核和用户应用探针点的能力，使得应用程序和系统本身的 运行时行为具有前所未有的可见性 cn/post/7280746515525156918 安全 看到和理解所有系统调用的基础上，将其与所有网络操作的数据包和套接字级视图相结合，通 过检测来阻止恶意攻击行为，如 DDoS攻击等，实施网络策略、增强系统的安全性、稳定性。 From:https://zhuanlan.zhihu.com/p/507388164 微服务可观测的挑战 第三部分 微服务可观测的挑战 应用：微服务架构、多语言、多协议 挑战1：微服务、多语言、多协议环境下，端到端观测

(org=empire, class=deathstar), (org=empire, class=tiefighter), and (org=alliance, class=xwing). It also includes a deathstar-service, which load-balances traffic to all pods with label (org=empire, class=deathstar) ENFORCEMENT ENFORCEMENT 232 Disabled Disabled 16530 k8s:class=deathstar 10.0.0.147 ready k8s:k8s- app=kube-dns 1673 Disabled Disabled 31028 k8s:class=tiefighter 10.0.0.112 ready

(org=empire, class=deathstar), (org=empire, class=tiefighter), and (org=alliance, class=xwing). It also includes a deathstar-service, which load-balances traffic to all pods with label (org=empire, class=deathstar) ENFORCEMENT ENFORCEMENT 232 Disabled Disabled 16530 k8s:class=deathstar 10.0.0.147 ready k8s:k8s- app=kube-dns 1673 Disabled Disabled 31028 k8s:class=tiefighter 10.0.0.112 ready

(org=empire, class=deathstar), (org=empire, class=tiefighter), and (org=alliance, class=xwing). It also includes a deathstar-service, which load-balances traffic to all pods with label (org=empire, class=deathstar) k8s:k8s- app=kube-dns 2407 Disabled Disabled 22839 k8s:class=deathstar 10.15.129.95 ready 10.15.28.196 ready 3339 Disabled Disabled 22839 k8s:class=deathstar 10.15.72.39 ready

(org=empire, class=deathstar), (org=empire, class=tiefighter), and (org=alliance, class=xwing). It also includes a deathstar-service, which load-balances traffic to all pods with label (org=empire, class=deathstar) ENFORCEMENT ENFORCEMENT 232 Disabled Disabled 16530 k8s:class=deathstar 10.0.0.147 ready k8s:k8s- app=kube-dns 1673 Disabled Disabled 31028 k8s:class=tiefighter 10.0.0.112 ready

deployment is iden�fied using the Kubernetes labels ( org=empire, class=deathstar ), ( org=empire, class=tiefighter ), and ( org=alliance, class=xwing ). It also includes a deathstar-service, which load-balances load-balances traffic to all pods with label ( org=empire, class=deathstar ). $ kubectl create -f https://raw.githubusercontent.com/cilium/cilium/v1.5/ex service/deathstar created deployment.extensions/deathstar k8s:k8s-app=kube 2407 Disabled Disabled 22839 k8s:class=death k8s:io.cilium.k8

(org=empire, class=deathstar), (org=empire, class=tiefighter), and (org=alliance, class=xwing). It also includes a deathstar-service, which load-balances traffic to all pods with label (org=empire, class=deathstar) ENFORCEMENT ENFORCEMENT 232 Disabled Disabled 16530 k8s:class=deathstar 10.0.0.147 ready k8s:k8s- app=kube-dns 1673 Disabled Disabled 31028 k8s:class=tiefighter 10.0.0.112 ready

(org=empire, class=deathstar), (org=empire, class=tiefighter), and (org=alliance, class=xwing). It also includes a deathstar-service, which load-balances traffic to all pods with label (org=empire, class=deathstar) k8s:k8s- app=kube-dns 2407 Disabled Disabled 22839 k8s:class=deathstar 10.15.129.95 ready 10.15.28.196 ready 3339 Disabled Disabled 22839 k8s:class=deathstar 10.15.72.39 ready