North-South Load Balancing of Kubernetes Services with eBPF/XDP Martynas Pumputis (Isovalent) October 28, 2020 10.0.0.1 10.0.0.2 10.0.0.3 httpd httpd “httpd” service 10.0.0.1:30000 10.0.0.2:30000

individual containers getting started or destroyed as the application scales out / in to adapt to load changes and during rolling updates that are deployed as part of continuous delivery. This shift toward cycle of containers causes these approaches to struggle to scale side by side with the application as load balancing tables and access control lists carrying hundreds of thousands of rules that need to be conjunction with cloud network routers If you are already running routing daemons Load Balancing Cilium implements distributed load balancing for traffic between application containers and to external services

individual containers getting started or destroyed as the application scales out / in to adapt to load changes and during rolling updates that are deployed as part of continuous delivery. This shift toward cycle of containers causes these approaches to struggle to scale side by side with the application as load balancing tables and access control lists carrying hundreds of thousands of rules that need to be conjunction with cloud network routers If you are already running routing daemons Load Balancing Cilium implements distributed load balancing for traffic between application containers and to external services

individual containers getting started or destroyed as the application scales out / in to adapt to load changes and during rolling updates that are deployed as part of continuous delivery. This shift toward cycle of containers causes these approaches to struggle to scale side by side with the application as load balancing tables and access control lists carrying hundreds of thousands of rules that need to be In conjunction with cloud network routers If you are already running routing daemons Load balancing Distributed load balancing for traffic between application containers and to external services. The loadbalancing

individual containers getting started or destroyed as the application scales out / in to adapt to load changes and during rolling updates that are deployed as part of continuous delivery. This shift toward cycle of containers causes these approaches to struggle to scale side by side with the application as load balancing tables and access control lists carrying hundreds of thousands of rules that need to be In conjunction with cloud network routers If you are already running routing daemons Load balancing Distributed load balancing for traffic between application containers and to external services. The loadbalancing

individual containers getting started or destroyed as the application scales out / in to adapt to load changes and during rolling updates that are deployed as part of continuous delivery. This shift toward cycle of containers causes these approaches to struggle to scale side by side with the application as load balancing tables and access control lists carrying hundreds of thousands of rules that need to be conjunction with cloud network routers If you are already running routing daemons Load Balancing Cilium implements distributed load balancing for traffic between application containers and to external services

individual containers getting started or destroyed as the application scales out / in to adapt to load changes and during rolling updates that are deployed as part of continuous delivery. This shift toward cycle of containers causes these approaches to struggle to scale side by side with the application as load balancing tables and access control lists carrying hundreds of thousands of rules that need to be In conjunction with cloud network routers If you are already running routing daemons Load balancing Distributed load balancing for traffic between application containers and to external services. The loadbalancing

with individual containers ge�ng started or destroyed as the applica�on scales out / in to adapt to load changes and during rolling updates that are deployed as part of con�nuous delivery. This shi� toward cycle of containers causes these approaches to struggle to scale side by side with the applica�on as load balancing tables and access control lists carrying hundreds of thousands of rules that need to be In conjunc�on with cloud network routers If you are already running rou�ng daemons Load balancing Distributed load balancing for traffic between applica�on containers and to external services. The loadbalancing

echo service configured on this port? get echo server socket dispatch the packet to echo server Load echo_dispatch program $ make echo_dispatch.bpf.o clang -I…/linux/usr/include -I…/linux/tools/lib -I…/linux/tools/lib -g -O2 -Wall -Wextra -target bpf -c -o echo_dispatch.bpf.o echo_dispatch.bpf.c # bpftool prog load echo_dispatch.bpf.o /sys/fs/bpf/echo_dispatch_prog # bpftool prog show pinned /sys/fs/bpf/echo_dispatch_prog xlated 304B jited 197B memlock 4096B map_ids 28,29 btf_id 32 build the prog load & pin the prog Pin BPF maps used by echo_dispatch # mount -t bpf none ~vagrant/bpffs # sudo chown

28, 2020 ● Debugging is useful to understand how things work ● Sometimes, eBPF programs can’t even load ● I couldn’t find good resources on this, so, here I am ● I break lots of eBPF programs ● The BPF bpf/syscall.c:796 (gdb) b bpf/syscall.c:121 (gdb) b kernel/bpf/ringbuf.c:159 Debug! Remember to: - Load the eBPF program and see if the breakpoint hits ● We can use it in bpf/verifier.c to do printf based