Enabling eBPF Super Powers on ARM64 with Cilium Jianlin Lv Trevor Tao October 28, 2020 Preface Arm ecosystem of CNI Support Arm64 • Cilium enable on aarch64 • https://github.com/cilium/cilium/issues/9898 issue on Arm64; • Multi-arch support for cilium-related images • CI/CD • Travis • Unit test Travis CI • Arm64 Full VM • arm64-graviton2 • Refer to: • https://docs.travis-ci.com/user/multi-cpu-architectures Demo on Arm64 Future Work • Cilium benchmark on Arm64 • Enable End-To-End Testing Cilium Channel for Arm64 • https://cilium.slack.com/archives/C0125S9TQD8 Confidential Restricted © 2020 Arm Limited

How and When You Should Measure CPU Overhead of eBPF Programs Bryce Kahle, Datadog October 28, 2020 Why should I profile eBPF programs? CI variance tracking Tools kernel.bpf_stats_enabled kernel

com/cilium/cilium-cli/main/stable- v0.14.txt) CLI_ARCH=amd64 if [ "$(uname -m)" = "aarch64" ]; then CLI_ARCH=arm64; fi curl -L --fail --remote-name-all https://github.com/cilium/cilium- cli/releases/download/${C githubusercontent.com/cilium/cilium-cli/main/stable- v0.14.txt) CLI_ARCH=amd64 if [ "$(uname -m)" = "arm64" ]; then CLI_ARCH=arm64; fi curl -L --fail --remote-name-all https://github.com/cilium/cilium- cli/releases/ com/cilium/cilium-cli/main/stable- v0.14.txt) CLI_ARCH=amd64 if [ "$(uname -m)" = "aarch64" ]; then CLI_ARCH=arm64; fi curl -L --fail --remote-name-all https://github.com/cilium/cilium- cli/releases/download/${C

in-kernel verifier ensures that BPF programs are safe to run and a JIT compiler converts the bytecode to CPU architecture specific instruc�ons for na�ve execu�on efficiency. BPF programs can be run at various between 10 seconds and 30 minutes or 12 hours for LRU based maps. This should automa�cally op�mize CPU consump�on as much as possible while keeping the connec�on tracking table u�liza�on below 25%. If needed and bpf-ct-global-tcp-max can be increased. Se�ng both of these op�ons will be a trade-off of CPU for conntrack-gc-interval , and for bpf-ct-global-any-max and bpf-ct-global-tcp-max the amount of

resource-constrained, remote locations or inside IoT appliances. Cilium is presently supported on amd64 and arm64 architectures. Install a Master Node The first step is to install a K3s master node making sure istioctl-1.10.4-linux-amd64.tar.gz | tar xz Linux (arm64) curl -L https://github.com/cilium/istio/releases/download/1.10.4/cilium- istioctl-1.10.4-linux-arm64.tar.gz | tar xz OSX curl -L https://github Silicon) curl -L https://github.com/cilium/istio/releases/download/1.10.4/cilium- istioctl-1.10.4-osx-arm64.tar.gz | tar xz Note Cilium integration, as presented in this Getting Started Guide, has been tested

\ --min-cpu-platform "Intel Broadwell" \ kata-testing gcloud compute ssh kata-testing # While ssh'd into the VM: $ [ -z "$(lscpu|grep GenuineIntel)" ] && { echo "ERROR: Need an Intel CPU"; exit 1; kernel verifier ensures that BPF programs are safe to run and a JIT compiler converts the bytecode to CPU architecture specific instructions for native execution efficiency. BPF programs can be run at various BPF datapath to perform more aggressive aggregation on packet forwarding related events to reduce CPU consumption while running cilium monitor. The automatic change only applies to the default ConfigMap

assumes installation on amd64 architecture. Cilium is presently supported on amd64 architecture with ARM support planned [https://github.com/cilium/cilium/issues/9898] for a future release. Install a Master istioctl version 1.10.4 [https://github.com/cilium/istio/releases/tag/1.10.4]: Linux (amd64) Linux (arm64) OSX OSX (Apple Silicon) curl -L https://github.com/cilium/istio/releases/download/1.10.4/cilium- xz curl -L https://github.com/cilium/istio/releases/download/1.10.4/cilium- istioctl-1.10.4-linux-arm64.tar.gz | tar xz curl -L https://github.com/cilium/istio/releases/download/1.10.4/cilium- istioctl-1

assumes installation on amd64 architecture. Cilium is presently supported on amd64 architecture with ARM support planned [https://github.com/cilium/cilium/issues/9898] for a future release. Install a Master kernel verifier ensures that BPF programs are safe to run and a JIT compiler converts the bytecode to CPU architecture specific instructions for native execution efficiency. BPF programs can be run at various BPF datapath to perform more aggressive aggregation on packet forwarding related events to reduce CPU consumption while running cilium monitor. The automatic change only applies to the default ConfigMap

assumes installation on amd64 architecture. Cilium is presently supported on amd64 architecture with ARM support planned [https://github.com/cilium/cilium/issues/9898] for a future release. Install a Master istioctl-1.10.4-linux-amd64.tar.gz | tar xz Linux (arm64) curl -L https://github.com/cilium/istio/releases/download/1.10.4/cilium- istioctl-1.10.4-linux-arm64.tar.gz | tar xz OSX curl -L https://github Silicon) curl -L https://github.com/cilium/istio/releases/download/1.10.4/cilium- istioctl-1.10.4-osx-arm64.tar.gz | tar xz Note Cilium integration, as presented in this Getting Started Guide, has been tested

The data deluge on modern storage 2 Compute node CPU Network Storage node Flash The data deluge on modern storage 3 Compute node 3 CPU Network Storage node Flash 16-lane PCIe, 16GB/s eBPF and DoS 6 Compute node CPU Network Storage node Flash eBPF and DoS 7 Compute node CPU Network Storage node Flash DoS eBPF and DoS 8 Compute node CPU Network Storage node Flash DoS reverse! 9 Compute node CPU Network Storage node Flash DoS in reverse! 10 Compute node CPU Network Storage node Flash Data DoS in reverse! 11 Compute node CPU Network Storage node Flash