0.0" Apply the configuration terraform init to initialize the following modules module.aws-vpc module.aws-elb module.aws-iam $ terraform init Once initialized , execute: $ terraform plan -out=aws_kubespray_plan cilium_version: "v1.2.0". $ ansible-playbook -i ./inventory/hosts ./cluster.yml -e ansible_user=core -e bootstrap_os=coreos -e kube_network_plugin=cilium -b --become-user=root --flush-cache -e ans successfully, ssh into the bastion host with the user core. # Get information about the basiton host $ cat ssh-bastion.conf $ ssh -i ~/path/to/ec2-key-file.pem core@public_ip_of_bastion_host Execute the commands

Rate Limits Configuration Automatic Adjustment Metrics Understanding the log output Configuration Core Agent Monitoring & Metrics Installation cilium-agent cilium-operator Troubleshooting Component 0" Apply the configuration terraform init to initialize the following modules module.aws-vpc module.aws-elb module.aws-iam $ terraform init Once initialized , execute: $ terraform plan -out=aws_kubespray_plan cilium_version: "v1.2.0". $ ansible-playbook -i ./inventory/hosts ./cluster.yml -e ansible_user=core -e bootstrap_os=coreos -e kube_network_plugin=cilium -b --become-user=root --flush-cache -e ans

0" Apply the configuration terraform init to ini�alize the following modules module.aws-vpc module.aws-elb module.aws-iam $ terraform init Once ini�alized , execute: $ terraform plan -out=aws_kubespray_plan /inventory/hosts ./cluster.yml -e ansible_user=core Validate Cluster To check if cluster is created successfully, ssh into the bas�on host with the user core . # Get information about the basiton host host $ cat ssh-bastion.conf $ ssh -i ~/path/to/ec2-key-file.pem core@public_ip_of_bastion_host Execute the commands below from the bas�on host. If kubectl isn’t installed on the bas�on host, you can login

Running pre-flight check (Required) Upgrading Cilium Version Specific Notes Advanced Configuration Core Agent Network Policy Policy Enforcement Modes Rule Basics Layer 3 Examples Layer 4 Examples Layer 0" Apply the configuration terraform init to initialize the following modules module.aws-vpc module.aws-elb module.aws-iam $ terraform init Once initialized , execute: $ terraform plan -out=aws_kubespray_plan cilium_version: "v1.2.0". $ ansible-playbook -i ./inventory/hosts ./cluster.yml -e ansible_user=core -e bootstrap_os=coreos -e kube_network_plugin=cilium -b --become-user=root --flush-cache -e ans

Running pre-flight check (Required) Upgrading Cilium Version Specific Notes Advanced Configuration Core Agent Network Policy Policy Enforcement Modes Rule Basics Layer 3 Examples Layer 4 Examples Layer 0" Apply the configuration terraform init to initialize the following modules module.aws-vpc module.aws-elb module.aws-iam $ terraform init Once initialized , execute: $ terraform plan -out=aws_kubespray_plan -e cilium_version=v1.11.0. $ ansible-playbook -i ./inventory/hosts ./cluster.yml -e ansible_user=core -e bootstrap_os=coreos -e kube_network_plugin=cilium -b --become-user=root --flush-cache -e ans

Running pre-flight check (Required) Upgrading Cilium Version Specific Notes Advanced Configuration Core Agent Network Policy Policy Enforcement Modes Rule Basics Layer 3 Examples Layer 4 Examples Layer 0" Apply the configuration terraform init to initialize the following modules module.aws-vpc module.aws-elb module.aws-iam $ terraform init Once initialized , execute: $ terraform plan -out=aws_kubespray_plan -e cilium_version=v1.11.0. $ ansible-playbook -i ./inventory/hosts ./cluster.yml -e ansible_user=core -e bootstrap_os=coreos -e kube_network_plugin=cilium -b --become-user=root --flush-cache -e ans

Running pre-flight check (Required) Upgrading Cilium Version Specific Notes Advanced Configuration Core Agent Network Policy Policy Enforcement Modes Rule Basics Layer 3 Examples Layer 4 Examples Layer 0" Apply the configuration terraform init to initialize the following modules module.aws-vpc module.aws-elb module.aws-iam $ terraform init Once initialized , execute: $ terraform plan -out=aws_kubespray_plan -e cilium_version=v1.11.0. $ ansible-playbook -i ./inventory/hosts ./cluster.yml -e ansible_user=core -e bootstrap_os=coreos -e kube_network_plugin=cilium -b --become-user=root --flush-cache -e ans

are not well suited for a dev platform ● The processing overhead is non-trivial ● Falco's eBPF module + ContainerOS was not very performant Attempt #1 - The Postmortem Iteration is key ● Built a Use Ubuntu instead of ContainerOS Current Implementation Iteration is key ● Move back to eBPF module to reduce our OS footprint ● Smarter rules based on user behavior ● Automatically respond to

evolution of the kernel. Applications User space Kernel System calls Files Networking Process Module Memory One day, a concerned Captain Tux reviewed the crew And remembered that bees had long been eBPF programs run as efficiently as natively compiled kernel code or as code loaded as a kernel module. Linux supports JIT compilation towards all widespread architectures. System calls Acquiring a

同时支持用户态插桩 全栈覆盖 ✅ uprobe ✅ kprobe ✅ tracepoint ✅ USDT ✅ perf ✅ … eBPF的编程实践 bcc libbpf + bpf + core 编程  bcc 依靠运行时汇编，将整个大型LLVM/Clang 库带入并嵌入其中  编译过程中资源用量大，对Cpu、Mem有要求  依赖内核的头包  bpf 程序跟其他的用户空间的程序没有太大区别