►
Description
eBPF is quickly becoming one of the rising stars within the cloud-native observability and security ecosystem. eBPF is a Linux kernel sub-system that allows you to develop and execute sandboxed programs within the Linux kernel, without ever having to touch the kernel source code. eBPF has applications in the areas of networking, performance profiling, monitoring, and security.
In this talk, attendees will learn how they can get started with leveraging the power of eBPF in Kubernetes cluster security. We'll be starting with an introduction to eBPF and its architecture, then we'll learn how we can write our first eBPF program. From there, we're going to jump into some of the practical security applications of eBPF within the context of a Kubernetes. The possibilities are many, but time is unfortunately few - but by the end of this session you will be equipped with the requisite knowledge and inspiration to get started with eBPF in your own Kubernetes environments!
B
B
B
So
obviously,
a
very
self-explanatory
piece
of
technology,
but
really
sort
of
begs
the
question
seriously.
What
is
ebpf
well
ebpf
stands
for
the
extended
berkeley
packet
filter,
the
berkeley
packet
filter
was
created
as
part
of
the
linux
kernel
a
long
time
ago
was
originally
used
for
mostly
around
networking,
so
picking
up,
networking,
packets,
detecting
and
actioning
on
certain
things
within
the
kernel
from
a
networking
point
of
view,
but
that's
not
really
what
bpf
is
anymore
or
ebp
for
that
matter.
Ebpf
is
a
technology.
B
They
both
mean
the
same
thing
really
when,
when
we
talk
about
it
these
days,
ebpa
programs
allow
application
developers
to
run
custom
code
in
the
kernel
to
respond
to
events,
and
we
can
now
do
this
without
having
to
write
things
like
kona
modules,
where
you'd
have
to
recompile
your
kernel,
all
this
kind
of
stuff.
We
can
load
them
in
at
runtime
and
off.
We
go.
B
We
need
to
ensure
some
very
strict
safety
of
that
code,
and
so
things
like
loops,
for
example,
are
out.
We
can't
have
loops
because
we
can't
hold
up
the
kernel
anyway.
We
can't
cause
the
machine
to
to
seize
up
to
stop
working,
and
so
we
we
have
to
avoid
writing
our
programs
in
a
way
that
could
leave
lead
to
some
sort
of
unsafe
execution.
B
Programs
are
loaded
into
the
kernel
via
a
system
call,
and
that
system
call
is
the
bpf
system
call
where
they
run
through
a
verifier.
The
verifier
does
all
those
kinds
of
things.
It's
basically
a
static
static
code
analysis
to
ensure
that
you
know
the
code
that
we're
running
isn't
breaking
any
rules
basically,
and
then
it's
compiled
into
a
machine
specific
instruction
set
via
the
just
in
time.
Compiler.
B
Ebpf
maps
are
used
to
short
store
and
share
data
between
the
program
in
the
kernel
and
the
user
space
application,
and
we
can
also
use
maps
to
you
know,
share
data
even
between
different
ebpf
programs,
which
of
which
we
can
run
multiple.
So
this
is
a
bit
of
a
diagram
to
show
you
sort
of
how
it
works,
so
we
have
an
application.
B
B
So
what
are
some
of
the
events
that
we
can?
We
can
attach
to
and
I'll
go
into
this
a
little
bit
in
a
little
bit
more
detail
down
the
road,
but
we
can
do
k,
probes,
k,
rep
probes,
new
probes,
trace
points,
network
events
and
there's
sort
of
a
whole
bunch
more
as
well.
There's
trace
events,
perf
events
stuff,
like
that
the
kernel
provides
us
with
helper
functions
that
allow
developers
to
call
into
the
kernel
itself
to
retrieve
and
store
data
to
do
certain
things
that
would
be
generally
considered
unsafe
to
do.
B
B
B
So
what
are
some
basic
tools
and
basic
in
this
particular
case
does
not
mean
that
they're,
simple
or
easy
to
make
what
it
means
is
that
they're
easy
to
use?
Really
you
can,
you
know,
pull
them
from
a
reaper
or
install
them
into
your
linux
machine
through
like
apt-get
or
something
like
that
and
then
run
them.
B
So
here
is
a
nice
lovely
diagram
showing
a
whole
bunch
of
different
tools
available
to
us.
I
didn't
recreate
this.
This
diagram
myself,
so
you're
gonna,
have
to
put
up
with
the
sort
of
ugly
image
on
an
otherwise
nice
looking
slide.
That
was
just
going
to
be
too
much
work,
so
these
are
the
bcc
tools.
B
Bcc
stands
for
the
bpf
compiler
collection
and
basically
these
are
just
a
whole
bunch
of
python
tools
that
you
can
install
into
your
environment,
into
your
linux
environment
and
just
run
them,
and
so
an
example
of
that
is.
We
have
exec
snoop,
and
this
allows
us
to
basically
capture
and
output
processes
that
are
run
on
the
system
by
any
user
and
and
get
things
like
return
codes,
and
things
like
that.
B
B
And
this
is
just
running
on
a
linux
machine
with
the
bcc
tools
installed,
you
do
have
to
run
bpf
programs
as
a
privileged
user,
so
you
do
have
to
suited
them.
For
obvious
reasons,
I
mean
they're
code
running
in
the
kernel.
So
next
up
we
sort
of
have
another
program.
That's
it's
kind
of
similar
called
bpf
trace.
B
B
In
this
particular
case,
here's
an
example,
so
I
run
bpf
trace
and
I
actually
give
it
the
command
that
I
want.
I
want
to
get
the
raw
syscall
for
sysenter
and
then
I
want
to
count
basically
the
commands
that
have
been
run,
and
so
I
ran
this,
for
you
know
30
seconds
to
a
minute
on
one
of
my
machines,
and
we
can
see
that
you
know
it
basically
counts
the
number
of
times
a
certain
command
was
run
in
this
particular
case.
B
B
So
the
first
one
is
psyllium.
Psyllium
is
an
open
source
sort
of
networking
security
and
observability
tool.
You
can
use
psyllium
for
things
like
load,
balancing
network
policy
flow
and
policy
logging
and
even
get
metrics.
You
can
it's.
It's
often
used
as
a
as
a
cni
provider
within
kubernetes,
and
I
think
joseph
yesterday
actually
did
a
talk
talking
about
how
rvu
uses
psyllium
to
do
cross-cluster
networking,
which
is
pretty
cool.
B
B
Next
up
is
falco.
I
don't
think
from
what
I
understand.
Falco
didn't
originally
utilize
ebpf,
it's
what
they
call
a
cloud
native
runtime
security
product
by
systig.
It's
now
a
cncf
project,
but
in
more
recent
times,
they've
they've
started
to
utilize
ebpf
to
implement
a
whole
bunch
of
functionality.
B
B
The
next
up
is
tracy
by
aquasec.
This
is
a
sort
of
newer
project,
same
sort
of
idea
as
as
falco
the
the
tracy
project
has
sort
of
two
sub
projects.
The
tracy
ebpf,
which
utilizes
the
lib
bpf
go
library
that
aquasec
themselves
wrote
which
is
sort
of
a
wrapper
around
lib
bpf
go,
oh
sorry,
libby
pf
and
it
attaches
to
evpf
events.
And
then
you
can
use
open
policy
agent
to
detect
behavioral
patterns
and
then
notify
you
can
print
standard
out
post
to
web
hooks.
That
kind
of
stuff.
B
And
I
think
this
is
the
final
one.
Inspector
gadget
inspector
gadget
is
a
project
that
is
actually
sort
of
wrapping
a
whole
bunch
of
tools
rather
than
being
sort
of
one
tool
on
its
own.
It
takes
some
of
the
ideas
from
the
sort
of
previous
bcc
tools
and
bpf
trace
that
we
saw
before
and
creates
a
project
that
is
able
to
be
deployed
into
your
cluster.
B
So,
as
I
mentioned
before,
ebpf
programs
attach
to
events
within
the
kernel.
You'll
see
these
referred
to
as
hooks
or
events
or
things
like
that.
But
effectively,
ebpf
is
an
event-based
system,
so
a
k-probe
is
a
is
basically
a
kernel
probe
and
a
k-rep
probe
is
a
return
probe.
So
it
allows
you
to
create
programs
that
will
run
before
and
after
a
kernel
instruction
is
executed,
and
you
know
a
good
example
of
a
bunch
of
different
things
that
you
can
do
with.
B
B
Bpf
was
originally
created
as
a
networking.
You
know
a
kernel
subsystem
for
networking,
and
so
the
networking
aspect
of
bpf
is
huge.
There's
a
host
of
different
events
you
can
attach
to
xdp,
for
example,
provides
access
early
access
to
packets
before
the
kernel
stack,
actually
processes
them.
So
this
is
actually
really
useful
for
things
like
load
balancers,
where
you
can
have
an
ebpf
based
load,
balancer
and
there's
a
fantastic
talk
by
liz
liz
rice,
who
spoke
at
the
ebpf
summit,
who
actually
she
wrote
an
ebpf
based
load.
B
Maps
so
bpf
maps
are
basically
data,
storage,
they're,
a
generic
data
structure
and
we,
we
kind
of
know
what
maps
mean
in
as
programmers
but
maps
are
actually
a
whole
bunch
of
different
data
structures.
In
terms
of
of
how
bpf
considers
them,
you
can
utilize
maps
to
share
data
across
different
bpf
programs
between
bpf
programs
and
the
user
space.
B
When
you
create
a
map,
you
need
to
give
it
a
few
different
bits
of
information.
So
the
map
type
and
we'll
see
some
examples
of
those
in
a
moment,
and
then
you
know
the
sort
of
key
size
value
size
max
entries
that
kind
of
stuff,
so
keeping
in
mind
these
things
are
written
in
c,
so
we
need
to
provide
you
know
a
memory
footprint
for
these
for
these
different
aspects,
and
so
some
of
the
the
types
that
we
can
we
have
available
to
us
are
things
like
hash
maps
and
arrays.
B
B
Helper
functions
are
basically
exist
in
ebpf
in
order
to
ensure
that
we
have
safe
access
into
the
kernel
when
our
programs
are
executed,
we
can't
interact
directly
with
the
kernel
from
within
the
bpf
virtual
machine,
but
the
helper
functions
give
us
entry
points
into
the
kernel.
To
do
certain
things.
B
We
use
helper
functions
to
do
a
variety
of
different
things.
We
can
interact
with
maps,
we
can
manipulate
network
packets,
we
can
get
things
like
pids
and
and
see
the
you
know.
The
c
group
identifiers
network
packets,
that
kind
of
stuff
a
couple
of
examples
of
these
helper
functions.
We
have
bpf
get
current
com,
which
is
the
current
process,
name
pretty
self-explanatory
and
we
have
bpf
get
current
pid
and
tgid.
B
B
The
process
id
is
the
process
id
from
the
from
the
perspective
of
the
kernel.
So
the
process
idea
in
this
particular
case
is
actually
from
user
space
is
what
you'd
see
as
represented
as
the
thread
id
or
thread
group
id,
and
the
thread
group
id
is
in
user
space.
Actually
what
you'd
consider
to
be
the
pid
or
the
process
id.
So
it's
it's
important
to
understand
that
sometimes
there's
a
few
gotchas
with
these
with
these
helper
functions,
but
there's
tons
of
documentation
available
man
pages
and
all
that
kind
of
stuff.
B
B
B
So
this
is
a
more
recent
project.
It's
a
little
bit
less
mature
but
provides
some
more
low-level
functionality.
The
interface
is
quite
complex
and
can
be
confusing
at
times,
but
it
also
adds
some
functionality.
Some
sort
of
interesting
functionality
such
as
compile
once
run
everywhere,
which
has
been
a
pretty
significant
challenge
in
the
past
with
bpf
programs
because
they
need
to
be
compiled
for
the
specific
kernel
headers
for
the
machine
they're
running
on
so
having
compile
once
run
everywhere,
is
a
huge
step
forward.
B
You
know
as
support
for
that
continues
to
be
rolled
out
into
into
new
kernel
versions
and
things
like
that,
and
then
we
have
libraries
from
the
perspective
of
application
development.
So
we
have
quite
a
few
go
ones:
python
rust
and
a
few
others
in
various
other
languages,
sorry
to
the
sort
of
java
and
the
java
fans
out
there
and
and
things
like
that
or
php
you're,
a
bit
out
of
luck.
You'll
need
to
write
your
own
or
just
you
know,
write
code
in
a
good
language.
B
B
B
B
So
in
this
particular
case,
we
have
this
sec
function,
which
we
pass
in.
You
know
the
k
pro,
basically
that
we
want
to
execute
or
the
the
attach
to,
in
this
case
we're
attaching
to
a
system
call
of
exec
ve,
and
we
are
printing
hello
world
to
bpf
print
k,
which
is
basically
just
a
trace
pipe
that
allows
us
to.
We
can
then
capture
that
later
on
and
I'll
show
you
how
to
do
that,
and
this
is
my
go
code.
B
B
B
B
B
B
It
was
working
about
20
45
minutes
ago
so,
but
I
think
you
basically
get
the
idea,
I'm
not
sure
why
that's
working
now
and
I
don't
have
enough
time
to
troubleshoot
it,
but
I
will
have
this
code
I'll,
make
sure
it's
working,
then
I'll
have
this
code
up
on
github
and
I'll
post
it
for
everyone
to
have
a
look
at,
but
that's
a
real
simple
example.
I
also
have
another
example
which
I'll
post
as
well,
which
is
a
little
bit
more
complex.
B
I
know
this
one
works
for
sure,
which
is
actually
using
a
trace
point
to
capture
our
execv
system,
calls
and
actually
grab
a
whole
bunch
of
new
data,
a
whole
bunch
of
data
out
of
that
and
then
print
it
out
and
so
I'll
upload
both
of
those
to
github
and
make
them
available
for
everybody,
and
on
that
note,
I'm
out
of
time
so
I'll
leave
you
with
some
pictures
of
my
dogs
skye
and
maru
and
I'll
say.
Thank
you.
C
Okay,
thank
you
very
much
josh.
I
think
that
was
excellent
done
with
god's
aside.
I
think
we
all
got
where
you're
going
with
that
demo
yeah.
So
we've
got
a
little
bit
of
time.
So
as
a
as
a
quick
question,
one
thing
that
always
strikes
me
I'm
like
eppf,
really
seems
to
be
taking
off,
but
it's
quite
a
low
level
technology.
So
I'm
always
a
little
bit
surprised
by
that
yeah
and
I'm
kind
of
wondering
does
the
sort
of
average
kubernetes
developer.
B
Honestly,
I
I
think
for
the
for
the
for
the
average
kubernetes
administrator,
maintainer
or
in
terms
of
you
know,
people
maintaining
clusters
for
the
most
part.
You
know
unless
you
have
a
real
good
reason
to
do
so,
unless
you're
working
in
the
sort
of
runtime
security,
space
or
you're
working
in
the
you
know,
networking
you
know:
load
balancing
or
security
space
there
or
the
observability
space.
B
There's
a
ton
of
work
going
on
right
now,
especially
in
places
like
datadog,
where
and
like
elastic,
where
they're
doing
a
ton
of
work
with
ebpf
to
get
data
out
regarding
application,
runtime,
observability
and
performance.
So
for
the
most
part,
I
think
the
average
person
is
going
to
be
better
off
knowing
about
the
existing
tools
that
are
out
there
that
are
taking
advantage
of
ebpf
and
the
sort
of
power
that
it
brings.
C
Cool
okay,
I
don't
think
there
was
any
other
questions.
Let
me
double
check.
I
don't
see
anything.
Let
me
check
for
youtube.
Actually,
okay,
we
do
have
a
quick
sponsor
thing
before
I
hand
over
to
danny
so
yeah.
We
have
several
sponsors.
We
love
you
all:
control
playing
storage,
os
jet
stack,
snick,
what's
nick
sorry,
tram,
shed
sysdig
and
our
charity
partners
stimet
and
protectors,
but
storage,
os,
so
storage
os
is
a
software
defined
cloud
native
storage
platform.
Delivering
persistent
storage
for
kubernetes
storage.