feature in RedBPF • Use BPF maps to make stateful decisions • Load the program and protect the Rabbit(MQ)! About Me • Software Engineer @ CCP Games • @aquarhead on GitHub, Twitter… • Rust (and Elixir) name] ingress \ bpf da obj target/bpf/programs/limit/limit.elf \ sec tc_action/limit Rabbit(MQ) Protected BPF (Kernel) vs. Application • BPF programs can be developed and deployed very quickly

10 ，cilium github 项目已有 9.3K star，Contributors 316位 cilium的特色功能： • 网络功能 • 负载均衡 • 网络安全 • 可观察性 • 多集群连通 注：本 PPT 基于 cilium v1.10.4 进行分析 ��������������� ��������������� �������������������� �������������������� 、 sendmsg、 recvmsg 、getpeername 、 bind等系统调用，实现 service 的地址解 析，并且伪装通信目的地址，让上层应用 无感知 DNAT 的发生 效果： • 集群内访问nodePort、LoadBalancer 的service时，能够减少数据包转发跳 数，极大提高网络性能 • 相比传统 iptables 等 技术，降低了访 问延时。例如在相同环境下，service 发生变化， 整集群可能需要同步 信息，刷 新 OVS 流表或者 ipset 规则 • 大规模的 policy ，会一定程度 的影响规则查询的效率，会一 定程度的影响规则更新的时间， 这些都会引入的TPS波动 Cilium policy采用了 identity 标识来进行 L3 - L4 policy 决策。 • 根据Cilium endpoint 的 label， 计算生成集群唯一的identity，意味着

xdpdrv obj prog.o # ip link show [...] 6: em1: mtu 1500 xdp qdisc mq state UP mo link/ether be:08:4d:b6:85:65 brd ff:ff:ff:ff:ff:ff prog/xdp id 1 tag 57cd311f2e27366b obj prog.o # ip link show [...] 6: em1: mtu 1500 xdpgeneric qdisc mq stat link/ether be:08:4d:b6:85:65 brd ff:ff:ff:ff:ff:ff prog/xdp id 4 tag 57cd311f2e27366b obj prog.o # ip link show [...] 6: em1: mtu 1500 xdpoffload qdisc mq stat link/ether be:08:4d:b6:85:65 brd ff:ff:ff:ff:ff:ff prog/xdp id 8 tag 57cd311f2e27366b

xdpdrv obj prog.o # ip link show [...] 6: em1: mtu 1500 xdp qdisc mq state UP mode DORMANT group default qlen 1000 link/ether be:08:4d:b6:85:65 brd ff:ff:ff:ff:ff:ff obj prog.o # ip link show [...] 6: em1: mtu 1500 xdpgeneric qdisc mq state UP mode DORMANT group default qlen 1000 link/ether be:08:4d:b6:85:65 brd ff:ff:ff:ff:ff:ff obj prog.o # ip link show [...] 6: em1: mtu 1500 xdpoffload qdisc mq state UP mode DORMANT group default qlen 1000 link/ether be:08:4d:b6:85:65 brd ff:ff:ff:ff:ff:ff

xdpdrv obj prog.o # ip link show [...] 6: em1: mtu 1500 xdp qdisc mq state UP mode DORMANT group default qlen 1000 link/ether be:08:4d:b6:85:65 brd ff:ff:ff:ff:ff:ff obj prog.o # ip link show [...] 6: em1: mtu 1500 xdpgeneric qdisc mq state UP mode DORMANT group default qlen 1000 link/ether be:08:4d:b6:85:65 brd ff:ff:ff:ff:ff:ff obj prog.o # ip link show [...] 6: em1: mtu 1500 xdpoffload qdisc mq state UP mode DORMANT group default qlen 1000 link/ether be:08:4d:b6:85:65 brd ff:ff:ff:ff:ff:ff

xdpdrv obj prog.o # ip link show [...] 6: em1: mtu 1500 xdp qdisc mq state UP mode DORMANT group default qlen 1000 link/ether be:08:4d:b6:85:65 brd ff:ff:ff:ff:ff:ff obj prog.o # ip link show [...] 6: em1: mtu 1500 xdpgeneric qdisc mq state UP mode DORMANT group default qlen 1000 link/ether be:08:4d:b6:85:65 brd ff:ff:ff:ff:ff:ff obj prog.o # ip link show [...] 6: em1: mtu 1500 xdpoffload qdisc mq state UP mode DORMANT group default qlen 1000 link/ether be:08:4d:b6:85:65 brd ff:ff:ff:ff:ff:ff

xdpdrv obj prog.o # ip link show [...] 6: em1: mtu 1500 xdp qdisc mq state UP mode DORMANT group default qlen 1000 link/ether be:08:4d:b6:85:65 brd ff:ff:ff:ff:ff:ff obj prog.o # ip link show [...] 6: em1: mtu 1500 xdpgeneric qdisc mq state UP mode DORMANT group default qlen 1000 link/ether be:08:4d:b6:85:65 brd ff:ff:ff:ff:ff:ff obj prog.o # ip link show [...] 6: em1: mtu 1500 xdpoffload qdisc mq state UP mode DORMANT group default qlen 1000 link/ether be:08:4d:b6:85:65 brd ff:ff:ff:ff:ff:ff

xdpdrv obj prog.o # ip link show [...] 6: em1: mtu 1500 xdp qdisc mq state UP mode DORMANT group default qlen 1000 link/ether be:08:4d:b6:85:65 brd ff:ff:ff:ff:ff:ff obj prog.o # ip link show [...] 6: em1: mtu 1500 xdpgeneric qdisc mq state UP mode DORMANT group default qlen 1000 link/ether be:08:4d:b6:85:65 brd ff:ff:ff:ff:ff:ff obj prog.o # ip link show [...] 6: em1: mtu 1500 xdpoffload qdisc mq state UP mode DORMANT group default qlen 1000 link/ether be:08:4d:b6:85:65 brd ff:ff:ff:ff:ff:ff

xdpdrv obj prog.o # ip link show [...] 6: em1: mtu 1500 xdp qdisc mq state UP mode DORMANT group default qlen 1000 link/ether be:08:4d:b6:85:65 brd ff:ff:ff:ff:ff:ff obj prog.o # ip link show [...] 6: em1: mtu 1500 xdpgeneric qdisc mq state UP mode DORMANT group default qlen 1000 link/ether be:08:4d:b6:85:65 brd ff:ff:ff:ff:ff:ff obj prog.o # ip link show [...] 6: em1: mtu 1500 xdpoffload qdisc mq state UP mode DORMANT group default qlen 1000 link/ether be:08:4d:b6:85:65 brd ff:ff:ff:ff:ff:ff