and detailed visibility as required by users. Hubble has been created and specifically designed to make best use of these new eBPF powers. Hubble can answer questions such as: Service dependencies & communication echo-b-795c4b4f76-9wrrx 1/1 Running 0 66s echo-b-host-6b7fc94b7c-xtsff 1/1 Running 0 66s host-to-b-multi-node-clus extracting it from the tarball. Similarly to the UI, use port forwarding for the hubble-relay service to make it available locally: kubectl port-forward -n $CILIUM_NAMESPACE svc/hubble-relay --address 0.0.0

please refer to the Troubleshooting section and / or seek help on the Slack channel. Requirements Make sure your Kubernetes environment is meeting the requirements: Kubernetes >= 1.9 Linux kernel >= 4 13m etcd-operator-5cf67779fd-hd9j7 1/1 Running 0 2m42s Troubleshooting Make sure that kube-dns or coredns is running and healthy in the kube- system namespace. A functioning } The contents can look different than the above. The specific configuration that matters is to make sure that in-addr.arpa and ip6.arpa are listed as wildcards next to cluster.local. You can validate

and detailed visibility as required by users. Hubble has been created and specifically designed to make best use of these new eBPF powers. Hubble can answer questions such as: Service dependencies & communication --zone us-west2-a gcloud container clusters get-credentials "${NAME}" --zone us-west2-a Note Please make sure to read and understand the documentation page on taint effects and unmanaged pods. AKS (BYOCNI) value: "true" effect: "NoExecute" EOF eksctl create cluster -f ./eks-config.yaml Note Please make sure to read and understand the documentation page on taint effects and unmanaged pods. kind Install

and detailed visibility as required by users. Hubble has been created and specifically designed to make best use of these new eBPF powers. Hubble can answer questions such as: Service dependencies & communication --zone us-west2-a gcloud container clusters get-credentials "${NAME}" --zone us-west2-a Note Please make sure to read and understand the documentation page on taint effects and unmanaged pods. AKS (BYOCNI) value: "true" effect: "NoExecute" EOF eksctl create cluster -f ./eks-config.yaml Note Please make sure to read and understand the documentation page on taint effects and unmanaged pods. kind Install

please refer to the Troubleshoo�ng sec�on and / or seek help on the Slack channel . Requirements Make sure your Kubernetes environment is mee�ng the requirements: Kubernetes >= 1.9 Linux kernel >= 4 } The contents can look different than the above. The specific configura�on that ma�ers is to make sure that in-addr.arpa and ip6.arpa are listed as wildcards next to cluster.local . You can validate 13m etcd-operator-5cf67779fd-hd9j7 1/1 Running 0 2m42s Troubleshooting Make sure that kube-dns or coredns is running and healthy in the kube-system namespace. A func�oning

unset, ${HOME}/.kube/config kubectl cluster-info --context kind-kind Install Cilium Note First, make sure you have Helm 3 installed [https://helm.sh/docs/using_helm/#install-helm]. If you have (or planning However we’re enabling managed etcd and setting both cluster-name and cluster-id for each cluster. Make sure context is set to kind-cluster2 cluster. kubectl config use-context kind-cluster2 helm install please refer to the Troubleshooting section and / or seek help on the Slack channel. Requirements Make sure your Kubernetes environment is meeting the requirements: Kubernetes >= 1.9 Linux kernel >= 4

and detailed visibility as required by users. Hubble has been created and specifically designed to make best use of these new BPF powers. Hubble can answer questions such as: Service dependencies & communication state NotReady until Cilium is deployed. This behavior is expected. Install Cilium Note First, make sure you have Helm 3 installed [https://helm.sh/docs/intro/install/]. If you have (or planning to However we’re enabling managed etcd and setting both cluster-name and cluster-id for each cluster. Make sure context is set to kind-cluster2 cluster. kubectl config use-context kind-cluster2 helm install

kernel 5.9+ ❏ bpftool 5.9+ ❏ libbpf headers ❏ kernel headers vm $ uname -r 5.9.1-36.vanilla.1.fc32.x86_64 vm $ bpftool version bpftool v5.9.1 Code and instructions at https://github.com/jsitn this port? get echo server socket dispatch the packet to echo server Load echo_dispatch program $ make echo_dispatch.bpf.o clang -I…/linux/usr/include -I…/linux/tools/lib -g -O2 -Wall -Wextra -target

t/linux-next.git /source/linux cd linux mkdir build make O=$PWD/build ARCH=x86_64 x86_64_defconfig make O=$PWD/build ARCH=x86_64 menuconfig make O=$PWD/build ARCH=x86_64 -j16 Kernel image Remember compile options git clone git://git.buildroot.net/buildroot /source/buildroot cd buildroot make menuconfig make -j16 Rootfs Remember to: - Select ext4 as filesystem image - Enable networking - Enable

“types” of BPF programs • Write BPF programs in Rust • Add new feature in RedBPF • Use BPF maps to make stateful decisions • Load the program and protect the Rabbit(MQ)! About Me • Software Engineer is 10 See it in Action! Can we protect the Rabbit? Without Limiter Attach `tc` Program $ cargo make release $ sudo tc qdisc add dev [device name] clsact $ sudo tc filter add dev [device name] ingress worthy tradeoff, especially in preventing misuse More on RedBPF • Plan to make RedBPF support more (all) program types - make it a generic compiler (BCC) • Add utility functions to help dealing with