Cilium in different deployment modes. Policy Enforcement Modes : Detailed walkthrough of the policy language structure and the supported formats. Monitoring & Metrics : Instruc�ons for configuring metrics /inventory/hosts ./cluster.yml -e ansible_user=core Validate Cluster To check if cluster is created successfully, ssh into the bas�on host with the user core . # Get information about the basiton host host $ cat ssh-bastion.conf $ ssh -i ~/path/to/ec2-key-file.pem core@public_ip_of_bastion_host Execute the commands below from the bas�on host. If kubectl isn’t installed on the bas�on host, you can login

Cilium in different deployment modes. Policy Enforcement Modes : Detailed walkthrough of the policy language structure and the supported formats. Monitoring & Metrics : Instructions for configuring metrics cilium_version: "v1.2.0". $ ansible-playbook -i ./inventory/hosts ./cluster.yml -e ansible_user=core -e bootstrap_os=coreos -e kube_network_plugin=cilium -b --become-user=root --flush-cache -e ans successfully, ssh into the bastion host with the user core. # Get information about the basiton host $ cat ssh-bastion.conf $ ssh -i ~/path/to/ec2-key-file.pem core@public_ip_of_bastion_host Execute the commands

Cilium in different deployment modes. Policy Enforcement Modes : Detailed walkthrough of the policy language structure and the supported formats. Monitoring & Metrics : Instructions for configuring metrics Rate Limits Configuration Automatic Adjustment Metrics Understanding the log output Configuration Core Agent Monitoring & Metrics Installation cilium-agent cilium-operator Troubleshooting Component cilium_version: "v1.2.0". $ ansible-playbook -i ./inventory/hosts ./cluster.yml -e ansible_user=core -e bootstrap_os=coreos -e kube_network_plugin=cilium -b --become-user=root --flush-cache -e ans

troubleshooting Cilium in different deployment modes. Network Policy : Detailed walkthrough of the policy language structure and the supported formats. Monitoring & Metrics : Instructions for configuring metrics Running pre-flight check (Required) Upgrading Cilium Version Specific Notes Advanced Configuration Core Agent Network Policy Policy Enforcement Modes Rule Basics Layer 3 Examples Layer 4 Examples Layer cilium_version: "v1.2.0". $ ansible-playbook -i ./inventory/hosts ./cluster.yml -e ansible_user=core -e bootstrap_os=coreos -e kube_network_plugin=cilium -b --become-user=root --flush-cache -e ans

troubleshooting Cilium in different deployment modes. Network Policy : Detailed walkthrough of the policy language structure and the supported formats. Monitoring & Metrics : Instructions for configuring metrics Running pre-flight check (Required) Upgrading Cilium Version Specific Notes Advanced Configuration Core Agent Network Policy Policy Enforcement Modes Rule Basics Layer 3 Examples Layer 4 Examples Layer -e cilium_version=v1.11.0. $ ansible-playbook -i ./inventory/hosts ./cluster.yml -e ansible_user=core -e bootstrap_os=coreos -e kube_network_plugin=cilium -b --become-user=root --flush-cache -e ans

troubleshooting Cilium in different deployment modes. Network Policy : Detailed walkthrough of the policy language structure and the supported formats. Monitoring & Metrics : Instructions for configuring metrics Running pre-flight check (Required) Upgrading Cilium Version Specific Notes Advanced Configuration Core Agent Network Policy Policy Enforcement Modes Rule Basics Layer 3 Examples Layer 4 Examples Layer -e cilium_version=v1.11.0. $ ansible-playbook -i ./inventory/hosts ./cluster.yml -e ansible_user=core -e bootstrap_os=coreos -e kube_network_plugin=cilium -b --become-user=root --flush-cache -e ans

troubleshooting Cilium in different deployment modes. Network Policy : Detailed walkthrough of the policy language structure and the supported formats. Monitoring & Metrics : Instructions for configuring metrics Running pre-flight check (Required) Upgrading Cilium Version Specific Notes Advanced Configuration Core Agent Network Policy Policy Enforcement Modes Rule Basics Layer 3 Examples Layer 4 Examples Layer -e cilium_version=v1.11.0. $ ansible-playbook -i ./inventory/hosts ./cluster.yml -e ansible_user=core -e bootstrap_os=coreos -e kube_network_plugin=cilium -b --become-user=root --flush-cache -e ans

a dynamic language Challenges - Implementing the stack walking for a dynamic language - Supporting multiple Ruby versions Challenges - Implementing the stack walking for a dynamic language - Supporting Ruby versions - Correctness testing Challenges - Implementing the stack walking for a dynamic language - Supporting multiple Ruby versions - Correctness testing - BPF safety features Future plans -

confinement mechanism for Linux using eBPF ▶ Users write per-application policy in a simple policy language ▶ Policy is enforced by attaching BPF programs to LSM hooks ▶ Integrates userspace and kernelspace and production-safe ▶ Works out of the box on any vanilla Linux kernel ≥ 5.8 4 / 7 Our Policy Language Rules and Directives Rules specify access to system objects: ▶ fs(file, access) ▶ net(socket to be taken on a block of rules ▶ Add additional context to a block of rules 5 / 7 Our Policy Language Policy at the Function Call Level ▶ #[func " foo" ] → Apply rules only within a call to foo()

同时支持用户态插桩 全栈覆盖 ✅ uprobe ✅ kprobe ✅ tracepoint ✅ USDT ✅ perf ✅ … eBPF的编程实践 bcc libbpf + bpf + core 编程  bcc 依靠运行时汇编，将整个大型LLVM/Clang 库带入并嵌入其中  编译过程中资源用量大，对Cpu、Mem有要求  依赖内核的头包  bpf 程序跟其他的用户空间的程序没有太大区别