►
From YouTube: Emissary + Linkerd: A Guide to End-to-end Encryption for your Cluster - Flynn & Jason Morgan
Description
Don’t miss out! Join us at our upcoming hybrid event: KubeCon + CloudNativeCon North America 2022 from October 24-28 in Detroit (and online!). Learn more at https://kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
Emissary + Linkerd: A Guide to End-to-end Encryption for your Cluster - Flynn, Ambassador Labs & Jason Morgan, Buoyant
In this workshop, members of the Emissary-Ingress and Linkerd teams show the painless way to get four CNCF projects (Emissary, Linkerd, Kubernetes, and Envoy) running smoothly together to provide end-to-end encryption for application calls. They'll guide you through the best practices for using Linkerd and Emissary to give you capabilities like advanced L7 routing, in-cluster mTLS, embedded authentication, rate limiting, and much more. They’ll take you on a tour of each project and show you how they complement each other and make a great addition to your Kubernetes stack. Finally, they'll introduce a reference architecture for running Linkerd and Emissary together and walk you through how to implement it in practice.
A
B
A
A
B
We
are
going
to
be
using
emissary
ingress
to
do
the
tls
termination,
and
that
means
we're
also
going
to
be
using
emissary
ingress
to
handle
the
certificate
that
secures
your
communication
between
the
cluster
and
the
browser
and
then
we'll
get
onto
using
linker
d
within
the
cluster,
but
important
to
note
that
you
cannot
do
tls
in
any
meaningful
way
without
certificates.
So
we're
going
to
come
back
and
talk
about
that.
A
couple
of
points
here.
B
So
if
you're
not
familiar
with
emissary
ingress,
it
is
an
open
source
cloud
native,
self-service,
developer,
centric
api
gateway.
So
if
you
have
a
cluster
where's,
my
laser
pointer
there
we
go.
If
you
have
a
cluster
over
there
with
a
bunch
of
services
in
it-
and
you
have
users
who
want
to
use
it
from
outside
emissary's
purpose
in
life,
is
to
sit
right
at
the
edge
of
the
cluster
and
mediate.
All
of
that
conversation,
it
is
a
cncf
incubating
project.
B
We
started,
as
I
said,
in
2017
since
then,
we've
seen
pretty
wide
adoption
we're
running
in
thousands
of
different
places,
and
I
want
to
emphasize
that
focus
on
self-service.
That
turns
out
to
be
an
important
factor
in
our
adoption,
and
it
turns
out
to
be
something
that
really
does
work
out.
Well,
so
I
said:
there's
an
api
gateway.
B
One
of
the
kind
of
fundamental
things
about
api
gateways
is
routing
traffic.
So
if
we
have
our
user
jane
out
in
the
cloud
and
she
wants
to
request
a
quote,
then
emissary
can
field
that
request
and
hand
it
off
to
an
upstream
service
that
actually
provides
it.
If
a
user
marco
hits
the
same
endpoint,
he
can
get
over
depending
on
how
you
have
things
set
up,
it
might
be
the
same
pod
handling
that
it
might
be
a
different
pod.
It
might
be
a
different
service
entirely.
B
B
However,
that
is
not
the
only
thing
that
api
gateways
do
they're,
not
just
dumb
proxies
they're,
also
a
good
place
to
set
up
things
that
you
want
to
manage
centrally,
so
that
your
developers
don't
have
to
worry
about
them,
probably
the
most
obvious
application.
There
is
application
security,
so
maybe
jane
is
allowed
to
update
quotes,
but
mark
is
not,
and
rather
than
making
the
person
who
wrote
the
quote
service
worry
about
authentication.
B
You
can
bundle
that
in
with
emissary
it's
not
the
only
thing.
You
can
also
worry
about
observability
about
rate
limiting
about
resilience.
If
things
go
down,
you
can
worry
about
hooks
that
make
life
easier
for
developing
applications
and,
if
you're
thinking
about
this
a
bit,
you
might
think
that
some
of
these
overlap
with
things
that
you
can
do
in
the
service
mesh,
that's!
Okay!
B
B
This
is
a
quick
example
of
some
of
the
emissaries
configuration
language.
All
of
these
resources
are
things
that
you
would
use
really
things
that
an
application
developer
or
a
person
in
the
developer's
role
would
use
to
configure
traffic
routing
through
to
their
service,
and
then
there
are
other
crds
for
things.
Like
configuring
reports,
you
listen
on
protocols
and
host
names,
authentication
all
that
kind
of
stuff.
Those
are
things
that
are
sort
of
more
of
the
ops
role,
and
you
know
you
can
have
one
person
filling
both
of
those
roles
in
a
lot
of
organizations.
B
Since
emissary
does
these
with
separate
resources,
it's
very
easy
to
separate
these
re
separate.
These
concerns
separate
these
roles
and
arrange
it
so
that
the
developers
don't
have
to
wait
for
the
ops
role.
The
ops
role
doesn't
have
to
wait
for
the
developers
to
do
things
for
their
apps
and
neither
of
them
steps
on
each
other's
toes
and,
on
that
note,
over
to
jason
to
talk
about
liquor,
d,
yeah.
A
It
is
in
my
opinion-
and
I
work
for
the
company
that
makes
it,
but
it
is
the
lightest
fastest
and
most
secure
service
mesh
that
you
can
use
in
kubernetes
and
again
feel
free
to
email
me.
If
you
have
thoughts
about
that
and
we're
going
to
try
and
try
and
show
you
some
of
that
today,
so
it's
created
by
the
folks
at
buoyant,
it's
been
in
production
for
a
really
long
time
and
we
have
an
active
community.
A
We
are
in
use
by
all
sorts
of
folks,
including
microsoft,
and
I
think,
just
in
an
hour,
you
can
listen
to
the
folks
from
xbox
live
talk
about
how
they're,
using
linguity
at
massive
scale,
to
connect
a
bunch
of
clusters
together
and
how
it's
made
their
lives
easier.
Yeah
we
do.
If
you
want
to
check
out
the
edge
you
can
see.
What's
coming
up,
there
are
weekly
edge
releases
where
you
can
try
all
the
various
features
and
that's
all
I've
got.
A
But
the
thing
I'd
say
is
that
the
theme
of
this
talk
is
that
emissary
ingress
is
a
really
solid
gateway
in
ingress
that
you
can
use
for
all
sorts
of
stuff
and
we're
going
to
integrate
it
with
linker
d
in
a
really
seamless
fashion
right.
So
we
don't
make
expectations
on
the
ingress
or
what
they're
going
to
do
linger
d
focuses
on
doing
the
job
of
a
service
mesh,
not
the
job
of
an
ingress,
not
the
java,
an
api
gateway.
We
leave
that
to
others
who
have
more
expertise
in
that
space.
A
A
So
the
way
we
integrate
with
emissaries
emissary
sits
there
at
the
front
door,
your
cluster
and
handles
that
that
north-south
traffic
and
then
we're
going
to
add
a
lingerie
proxy
to
emissary
and
that's
going
to
put
it
in
the
mesh
I'll
talk
about
adding
things
to
the
mesh.
All
I
mean
is
sitting
a
proxy
beside
it
and
letting
it
begin
to
handle
their
traffic.
A
A
A
B
The
question
was:
is
there
a
performance
hit
going
through
emissary?
The
answer
is
that
yeah,
but
it's
tiny,
the
part
of
emissary
that
wrangles
your
data
is
actually
envoy.
Emissary
is
serving
more
in
the
control
plane,
role,
wrangling
the
envoy
configuration
envoy
is
really
really
fast.
So
can
you
measure
it?
Yes,
but
it's
very,
very
small.
A
All
right
so
we're
gonna
hop
into
the
demo,
and
thank
you
very
much
for
asking
that
yeah
we're
gonna
hop
into
the
demo.
There's
gonna
be
more
opportunities
to
ask
questions
as
we
go,
so
we're
starting
off
we're
just.
Oh
I'm
sorry,
actually
you
you
can
talk
through
this.
Just
to
just
give
you
a
heads
up,
it
looks
like
I'm
typing,
I'm
not
typing,
but
it
is
happening.
Live
you
can
see
on
the
right
hand,
side
here.
These
are
all
the
pods
running
in
my
cluster.
A
How's
that
yeah
it's
going
to
be
hard
to
see,
but
there's
just
a
bunch
of
pods
running
on
the
right.
So
I'm
not
tricking
you
about.
What's
going
on
the
bottom
right
here
is
going
to
be
the
custom
resources
that
we're
using
for
emissary
to
get
our
routing
to
work
so
that
we
can
get
traffic
from
the
browser
to
our
environment
and
the
left-hand.
C
A
B
B
Doesn't
have
a
resource
type
ambassador
crds,
because
we
haven't
installed
them
yet
because
we
haven't
installed
emissary
so
off
we
go.
Let's
get
ms
area
installed,
we're
doing
this
in
the
way
that
we
document,
so
the
first
step
is
to
add
the
helm,
repo,
the
datawire
home
repo,
which
is
where
the
emissary
home
chart
lives,
we
kind
of
lied.
We
already
did
that
earlier,
so
error
message,
that's
okay!
B
B
E
E
B
That
handles
conversion
between
the
msr
get
ambassador
dot,
io,
slash,
v2
crds
and
the
get
ambassador.
I
o
slash
v3
alpha
one
crds.
It
needs
to
be
running.
You
shouldn't
have
to
worry
about
it.
Just
we
do
need
to
make
sure
that
we
wait
at
this
point
to
make
sure
that
it's
running
so
that
everything
works.
B
So
we
will
wait,
and
since
it's
already
running
this
won't
really
do
anything.
But
that's
all
right.
I
should
also
point
out
actually
nevermind
come
back
to
that
in
a
minute
we're
going
to
actually
install
help
or
install
emissary
using
helm
right
now.
This
command
looks
kind
of
ugly.
It's
not
actually
that
bad
we're
going
to
install
into
the
emissary
namespace
which
we
are
willing
to
create.
A
B
B
Oh
no,
let's
do
tls
first
tls
we
mentioned
earlier
that
to
do
tls
in
any
meaningful
way.
You
must
have
a
certificate
for
that.
There
are
a
lot
of
different
ways.
You
can
get
a
certificate.
This
one
happens
to
be
one
that
we
generated
ahead
of
time
from
let's
encrypt.
Let's
encrypt
is
cool
strongly
recommended.
Since
we
are
at
a
conference
with
conference
wi-fi,
we
downloaded
it
ahead
of
time
and
saved
it
on
the
laptop
for
emissary
to
be
able
to
use
the
tls
secret
tls
certificate.
B
And
now
we're
going
to
actually
configure
emissary.
So
this
is
what
the
configuration
looks
like
I'm
not
actually
going
to
read
this
line
by
line,
but
a
couple
of
relevant
things.
The
host
record.
There
is
telling
us
that,
for
this
demo,
we're
going
to
be
using
this
emojivoro.k8s.59s.io
hostname
you'll
see
that
in
the
browser
we
have
a
mapping
where
any
prefix
arriving
at
that
host
module.k8s59s.io.
B
Anything
there
is
going
to
get
routed
to
the
web
service
in
the
emojivo
namespace.
If
you
could
page
down
please
and
right
at
the
very
bottom,
we
have
some
listeners
that
say:
yeah
we're
going
to
do
http
on
port
8080
and
we're
going
to
do
https
on
port
8443,
so
happy
to
take
questions
about
that.
We
can
talk
about
that
in
as
much
detail
as
you
want
right
now.
Let's
go
ahead
and
get
it
applied.
B
B
Talking
to
emissary
emissary
is
terminating
tls,
feeding
back
the
certificate
to
make
it
happy
and
then
emissary
is
going
ahead
and
sending
it
through
to
the
upstream
emoji
about
service,
and
this
all
works.
We
can
vote
for
emojis.
We
can
view
the
leaderboard
we
can
do
all
of
our
stuff
and
nothing.
I've
said
so
far
has
anything
to
do
with
linker
d,
because
this
has
all
been
about
getting
emissary
running.
A
A
A
So,
first
off
I'm
going
to
install
linker
d,
we're
going
to
do
a
curl
to
bash.
I'm
sure
folks
have
opinions
about
that
and
we're
going
to
entirely
sidestep
them
for
this
conversation,
but
again
feel
free
to
put
in
an
email.
I'm
happy
to
happy
to
listen
to
you
there
so
we're
doing
the
install
so
there's
a
little
bit
of
us
lying
to
you,
but
we're
we're
lying
to
you
in
an
honest
way.
B
A
So
I'm
running
the
latest
linker
d2
11.2,
that's
on
the
client
side,
and
I
have
nothing
on
my
nothing
on
my
kubernetes
cluster
gonna
make
this
smaller
because
we're
gonna
see
I'm
gonna,
install
it
and
a
bunch
of
stuff
is
gonna
happen,
but
first,
let's
validate
that
this
actually
is
gonna
work.
So
here
we've
got
a
situation
where
I'm
running
a
k-3s
cluster
on
docker
desktop
using
wsl
on
windows
11,
because
I
like
to
live
dangerously.
A
So
what
I'm
hoping
to
see
is
a
bunch
of
check
marks
and
I
got
my
final.
All
checks
are
checked
and
with
that
we're
going
to
install
linker
d,
so
here
the
linker
dcli
is
going
to
generate
a
bunch
of
yaml
right.
You
all
are
probably
used
to
it
here.
If
you're
a
kubecon,
it's
going
to
generate
it
and
I'm
going
to
submit
it
directly
to
the
kubernetes
api,
you
can
install
linkerd
via
the
cli.
A
So
less
talk
more
action,
so
we
can
see
some
pods
popping
into
existence
on
the
bottom
here.
These
are
the
pon
the
components
of
the
core
lingerie
install.
So
we
have
an
identity
service.
It's
actually
going
to
generate
the
certificates
that
our
individual
workloads
are
going
to
use
as
they
identify
themselves
and
work
together
on
the
network,
we
have
a
proxy
injector,
which
is
a
mutating
web
hook.
That's
actually
going
to
go
when
we've
added
an
annotation
to
a
workload
or
a
namespace.
That
says
please
add
the
linkerity
proxy.
A
It's
going
to
go
ahead
and
add
the
proxy
for
you
and
all
you're
going
to
do
is
is
one
line
a
and
last
but
not
least,
we
have
the
destination
controller,
which
is
going
to
help
you
decide
or
help
linkery
decide
what
to
do
with
your
traffic
and
now
that
our
check
marks
are
once
again
happy
face
here
with
the
green
check
mark
we're
gonna
go
forward,
so
this
is
the
demo
and
linkedin
is
broken
up
into
a
couple
parts.
So
I
wanna
show
y'all
what
you
know.
A
A
fancy
dashboard
looks
like
with
linker
d.
You
don't
need
to
use
it,
but
I
use
it
every
time
I
demo
it
so
I'm
gonna
use
the
linker
d
visualization
component
and
I'm
going
to
install
it
here
with
lingard
dcli
exact
same
process.
You
saw
before
we're
going
to
present
you
audience
with
an
option.
You
can
ask
a
question
here
or
you
can
hear
me
tell
a
terrible
joke
while
we're
waiting
all
right,
don't.
A
E
B
A
Right,
oh,
that's
the
next
one.
So
what
we've
got
here
is
the
visualization
components
are
being
installed,
so
we
have
a
little
metric
server.
We
have
a
grafana
and
a
prometheus,
so
this
is
an
in-memory
prometheus.
When
you
go
to
production
with
linker
d,
we
recommend
and
have
documentation
for
how
you
can
use
your
own
prometheus
instance
or
federate.
This
in-memory
prometheus
with
the
rest
of
your
permissions
infrastructure
right,
that's
a
bit
of
advice.
Otherwise
you
can
get
like
four
six
hours
of
metrics
at
best,
which
isn't
necessarily
what
you
want.
A
We've
got
our
green
check
marks,
so
we're
going
to
go
forward
up
until
now.
All
I've
done
was
get
linker
d
running,
so
we're
going
to
actually
integrate
linkery
or
we're
going
to
add
some
things
to
the
mesh.
So
we've
got
that
emoji
photo
application
and
it
works.
We
have
emissary
ingress
and
it
works,
and
our
idea
here
is
that
if
you
use
a
service
mesh,
you
should
be
able
to
add
your
applications
that
work
in
kubernetes
and
after
you
do
it,
they
still
work
right,
just
marginally
better.
A
A
So
here
is
the
horror
of
integrating
emissary
ingress
with
linker
d,
we're
going
to
get
the
deployment
again,
there's
tons
of
ways
you
can
do
it
I'm
going
to
do
it
very
manually,
I'm
going
to
get
the
deployment
I'm
going
to
output
it
as
yaml,
then
I'm
going
to
send
it
to
the
link
or
dcli
and
the
link
or
dcli
is
going
to
look
like
all
right.
Is
this
yaml?
A
Yes,
awesome
is
a
deployment,
yes
awesome
and
it's
going
to
add
one
line
of
annotation,
that's
going
to
say:
linker,
dot,
io,
slash
proxy
or
slash
inject
colon
enabled
that's
it
and
then,
when
we
run
it,
we
get
ourselves
a
couple
things.
The
thing
I'm
going
to
tell
you
about.
First:
is
we're
going
to
get
a
new
instance
of
the
emissary
ingress
right?
That
now,
instead
of
one
container
per
pod,
has
two
the
emissary
instance
itself
and
the
linker
d2
proxy.
A
A
So
that's
that's
the
emissary
integration
100
of
it
we're
not
modifying
the
emissary
crds.
We're
not
changing
certificates
out
we're
not
doing
anything
beyond
that
now
to
get
it
all
the
way
through
to
our
emoji
photo
application.
We're
going
to
do
the
same
thing
we
just
did,
but
we're
going
to
do
it
for
the
emoji
photo
components
once
again
we're
going
to
add
an
annotation.
A
A
Let's
load
up
the
app
and
see,
if
that's
still
true,
so,
let's
vote
on
our
favorite.
Oh
it
still
works.
You
see
that
I've
still
got
my
valid
tls
certificate.
My
connection
is
secure.
I
can
I
can
vote
on
my
sunglasses.
That's
good.
We
lost
all
our
votes
from
before,
because
this
was
everything
was
stored
in
memory
and
it's
gone,
but
that's
life
we're
going
to
turn
on
a
little
auto
refresher.
A
Yes,
please,
and
so
this
is
just
going
to
refresh
the
page
over
and
over
again,
so
we
can
run
some
traffic
through
and
we're
going
to
watch
the
browser
to
emissary
to
our
various
emoji
photo
components
to
the
dashboard,
speaking
of
which
we
have
the
lingerie
dashboard
right
before
there
was
no
backing
service.
Once
we
configured
emissary
to
talk
to
the
dashboard,
all
we
have
to
do
is
actually
make
a
dashboard
exist.
A
Hit
refresh,
and
now
I've
got
a
bunch
of
metrics
about
my
environment
that
I
didn't
have
before
I
haven't
modified,
the
emoji
photo
app,
you
can,
you
can
take
it
on
faith
or
you
can
actually
go
play
with
the
app
itself.
There's
nothing
linkery
specific
happening
here
at
all
right.
We
added
the
proxy
and
now
we're
ready
to
go
a
little
little
fun
fact.
Well,
no,
no
fun
facts
where
you
don't
have
enough
time:
we've
got
a
graph
of
the
way
it
works.
A
We've
got
a
view
of
all
of
our
components
and
we
can
go
look
at
our
web
front
end
and
we
can
see
that
the
web
front
end
sees
that
it's
talking
to
emissary,
ingress
right
and
going
all
the
way
through.
We
can
see
the
individual
api
calls
that
are
being
made
to
our
environment
right
both
from
emissary
and
from
the
other
components
within
the
environment.
We
can
see
whether
or
not
those
calls
are
successful.
A
A
A
great
question:
that's
a
great
question
to
the
service,
so
I'm
telling
you
you
know,
there's
there's
mtls
here,
but
how
do
we
know
for
sure?
That's
going
on
well,
you're!
Still,
I'm
still
actually
going
to
ask
you
to
trust
me,
but
I'm
going
to
show
you
some
output
from
the
linker
dcli.
That's
going
to
look
at
the
various
requests
and
tell
you
what
it
believes
the
tls
status
is
so
I'm
going
to
do
a
tap.
I
just
want
to
grab
the
metadata
about
every
single
request:
that's
flowing
through
the
environment.
A
B
One
thing
I
want
to
reiterate
through
all
this
is
that
after
we
installed
linkery,
we
started
off
by
installing
emissary
configuring
and
configurating
the
routing
for
emissary
configuring,
the
routing
for
emissary.
Then
we
installed
linkery.
We
did
not
touch
the
emissary
configuration
after
we
installed
linkery
other
than
injecting
the
one
annotation
that
you
were
talking
about
on
the
emissary
deployment
itself.
We
didn't
go
back
and
touch
the
mappings
or
any
of
the
other
stuff
for
the
cluster.
A
B
D
F
F
A
Yeah
absolutely
so
the
question
was,
I
believe,
how
does
lingerie
do
cross-cluster
communication
yeah,
so
we
use
those
linguity
proxies
and
essentially,
when
you
add
lingerie
multi-cluster,
you
get
into
more
complex
linguity,
but
it's
not
brutally
complex
you're
going
to
install
a
component
called
the
lingerity
multi-cluster
component.
It's
going
to
create
two
new
services,
one
on
each
cluster
and
those
services
are
going
to
have
an
external
load,
balancer
they're
linked
proxies
and
then
we're
going
to
link
those
those
clusters,
together
with
a
cli
command.
We're
we're
going
to
get
some.
C
A
Counts
and
permissions
and
role
bindings
and
all
that
goodness
from
one
class
there
we're
going
to
add
it
to
the
other
and
then
they're
going
to
begin
speaking.
They
require
a
layer,
7
https
connection
between
them,
so
no
routing
requirements,
no
assumptions
about
your
network
right
and
each
service
or
each
pod.
When
you
go
to
make
a
call
between
clusters
using
linkedin,
you
call
to
what
looks
like
an
in-cluster
service
right.
So
I'm
going
to
call
to
you
know:
remoteservice.mynamespace.cluster.local.
A
And
then
linkerd
is
going
to
handle
routing
you
to
your
gateway
in
your
cluster
across
that
https
connection
between
your
your
clusters
and
then
from
the
gateway
to
your
application
and,
if
you'd
like
to
know
more
I'd,
love
to
hit
you
up
on
email
and
just
give
you
a
whole
walkthrough
of
multi-cluster
yeah.
Thank
you
really
appreciate
the
question.
Anybody
else.
A
So
proxy
list
mesh
that
I
don't
know
but
linkery
you
wouldn't
there
wouldn't
be
a
lot
of
point
right.
Like
linker
d,
does
grpc
load
balancing
for
you
right,
it's
one
of
the
first
use
cases
that
it
tackled.
So,
if
you're
doing
grpc
in
kubernetes,
if
you
add
link
rd
to
it,
you
will
get
request
level
load,
balancing
you'll,
get
proper
distribution
of
your
grpc
request
across
all
of
its
servers
and
you'll
find
pretty
dramatic
performance
improvements.
In
fact,
there's
a
cncf
case
study
for
a
company
named
entane.
A
C
Thank
you
great
demo.
First
of
all,
I'm
really
interested
in
encryption
and
she
showed
us
how
to
inject
a
certificate.
I
was
wondering
if
you
could
integrate
self-manager
and
especially
how
secure
it
could
be
to
communicate
internally
service
to
service
and
if
you
could
generate
it
for
each
connection,
different
certificate.
A
Yeah,
so
we
do
already
so
you
you
do
get
a
unique
certificate
for
every
single
pod
right.
Those
certificates
by
default
last
24
hours
and
they're,
going
to
be
tied
to
the
kubernetes
service,
account
that
you
create
with
it.
We
recommend
for
production
users.
We
have
a
if
you're
looking
at
running
linkedin
production,
look
up,
lingerie
production,
runbook,
we
publish
it,
we
tell
you
what
to
check
and
what
to
do
before
you
go
to
production
with
with
linker
d
and
again
you
have
my
email
hit
me
up
I'll.
Just
talk
to
you
about
it.
A
I
get
you
ready
for
it.
One
thing
we
want
you
to
do
is
use
something
like
cert
manager
to
rotate
the
intermediary
certificate,
that
lingerie
uses
to
issue
workload
certificates
and
if
that's
a
lot
again
happy
to
talk
about
certificate
architecture
in
linguity
with
any
of
you
did
that
help.
Did
I
answer
your
question
awesome.
Thank
you
so
much.
E
A
Yeah
so
ebpf,
like
so
there's
kind
of
a
lot
here
right,
but
ebpf
is
a
way
to
get
stuff
into
the
kernel
without
getting
it
into
the
linux
kernel
right
and
so
there's
all
sorts
of
stuff.
You
can
do
with
ebpf
like
say,
you're,
using
something
like
psyllium.
You
can
replace
the
way
iptables
works
with
their
ebpf
module,
and
so
the
way
we
work
with
psyllium
actually
you're
going
to
be
doing
a
demo
on
it
tomorrow.
I
believe
right
that
shows
you
how
you
use
it
so
lingerie
consumes
the
network.
A
We
don't
make
assumptions
about
it.
We
just
write
it
we're.
You
know,
if
you
think
of
the
tcp
model,
we're
at
layers
four
through
seven,
we
don't
care
about
layer,
three,
we
let
you
do
it.
However,
you
want
so
if
you're
running
an
ebpf
module
that
replaces
the
way
networking
works
or
changes
it
to
make
it
more
efficient,
go
nuts,
we
love
it.
We
consume
it
natively
without
really
interacting
with
it.