Here is an example policy file that extends our original policy by limi�ng �efighter to making only a POST /v1/request- landing API call, but disallowing all other calls (including PUT /v1/exhaust- port). - ports: - port: "80" protocol: TCP rules: http: - method: "POST" path: "/v1/request-landing" Update the exis�ng rule to apply L7-aware policy to protect Ports: Port: 80 Protocol: TCP Rules: Http: Method: POST Path: /v1/request-landing Status: Nodes: Minikube: Annotations:

is an example policy file that extends our original policy by limiting tiefighter to making only a POST /v1/request-landing API call, but disallowing all other calls (including PUT /v1/exhaust-port). apiVersion: toPorts: - ports: - port: "80" protocol: TCP rules: http: - method: "POST" path: "/v1/request-landing" Update the existing rule to apply L7-aware policy to protect Ports: Port: 80 Protocol: TCP Rules: Http: Method: POST Path: /v1/request-landing Status: Nodes: Minikube: Annotations: Kubectl

is an example policy file that extends our original policy by limiting tiefighter to making only a POST /v1/request-landing API call, but disallowing all other calls (including PUT /v1/exhaust-port). apiVersion: toPorts: - ports: - port: "80" protocol: TCP rules: http: - method: "POST" path: "/v1/request-landing" Update the existing rule to apply L7-aware policy to protect Ports: Port: 80 Protocol: TCP Rules: Http: Method: POST Path: /v1/request-landing Status: Nodes: Minikube: Annotations: Kubectl

is an example policy file that extends our original policy by limiting tiefighter to making only a POST /v1/request-landing API call, but disallowing all other calls (including PUT /v1/exhaust-port). apiVersion: toPorts: - ports: - port: "80" protocol: TCP rules: http: - method: "POST" path: "/v1/request-landing" Update the existing rule to apply L7-aware policy to protect Ports: Port: 80 Protocol: TCP Rules: Http: Method: POST Path: /v1/request-landing Events: and cilium CLI: $ kubectl -n kube-system

default/tiefighter:42690 -> default/deathstar- c74d84667-cx5kp:80 http-request FORWARDED (HTTP/1.1 POST http://deathstar.default.svc.cluster.local/v1/request-landing) May 4 13:23:40.502: default/tiefighter:42690 default/tiefighter:42690 <- default/deathstar- c74d84667-cx5kp:80 http-response FORWARDED (HTTP/1.1 200 0ms (POST http://deathstar.default.svc.cluster.local/v1/request-landing)) May 4 13:23:43.791: default/tiefighter:42742 is an example policy file that extends our original policy by limiting tiefighter to making only a POST /v1/request-landing API call, but disallowing all other calls (including PUT /v1/exhaust-port). apiVersion:

is an example policy file that extends our original policy by limiting tiefighter to making only a POST /v1/request-landing API call, but disallowing all other calls (including PUT /v1/exhaust-port). apiVersion: toPorts: - ports: - port: "80" protocol: TCP rules: http: - method: "POST" path: "/v1/request-landing" Update the existing rule to apply L7-aware policy to protect Ports: Port: 80 Protocol: TCP Rules: Http: Method: POST Path: /v1/request-landing Events: and cilium CLI: $ kubectl -n kube-system

default/tiefighter:42690 -> default/deathstar- c74d84667-cx5kp:80 http-request FORWARDED (HTTP/1.1 POST http://deathstar.default.svc.cluster.local/v1/request-landing) May 4 13:23:40.502: default/tiefighter:42690 default/tiefighter:42690 <- default/deathstar- c74d84667-cx5kp:80 http-response FORWARDED (HTTP/1.1 200 0ms (POST http://deathstar.default.svc.cluster.local/v1/request-landing)) May 4 13:23:43.791: default/tiefighter:42742 is an example policy file that extends our original policy by limiting tiefighter to making only a POST /v1/request-landing API call, but disallowing all other calls (including PUT /v1/exhaust-port). apiVersion:

com/torvalds/linux/blob/v5.9/tools/testing/selftests/bpf/progs/test_sk_lookup.c ● “It’s crowded in here” blog post https://blog.cloudflare.com/its-crowded-in-here/ ● Proof-of-concept tool for configuring BPF socket Linux Plumbers Conference 2019 https://www.youtube.com/watch?v=qRDoUpqvYjY Watch out for the blog post at https://blog.cloudflare.com/ … will cover setup for UDP Thank you!

扩展能力。 观测和跟踪 将 eBPF 程序附加到跟踪点以及内核和用户应用探针点的能力，使得应用程序和系统本身的 运行时行为具有前所未有的可见性 From:https://juejin.cn/post/7280746515525156918 安全 看到和理解所有系统调用的基础上，将其与所有网络操作的数据包和套接字级视图相结合，通 过检测来阻止恶意攻击行为，如 DDoS攻击等，实施网络策略、增强系统的安全性、稳定性。