►
From YouTube: Cilium: Welcome, Vision and Updates - Thomas Graf & Liz Rice, Isovalent; Laurent Bernaille, Datadog
Description
Don’t miss out! Join us at our upcoming hybrid event: KubeCon + CloudNativeCon North America 2022 from October 24-28 in Detroit (and online!). Learn more at https://kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
Cilium: Welcome, Vision and Updates - Thomas Graf & Liz Rice, Isovalent; Laurent Bernaille, Datadog
If you’re interested in using Cilium, or contributing to the project, this session is for you. Our agenda for this session: 1. Introduction to Cilium A brief overview of the origin and vision for Cilium. 2. Working with Cilium An end user's perspective of using Cilium. 3. Cilium Service Mesh Cilium can be used as a highly efficient service mesh data plane. Let’s discuss the learnings from our beta, and the upcoming roadmap. We will leave time for Q&A, and an opportunity to meet Cilium maintainers and contributors.
A
A
A
Okay,
how
many
of
you
have
contributed
prs
to
psyllium
a
few
of
you?
How
many
of
you
would
like
to
contribute
prs
to
sidion
excellence?
Wonderful,
have
I
failed
to
ask
any
questions?
I
think
that's
yeah,
that's
great!
So
without
further
ado,
I'm
going
to
hand
over
to
thomas
who
is
going
to
explain
a
little
bit
about
what
psyllium
is
so
welcome.
Thomas
thank.
B
All
right
welcome
hello.
My
name
is
thomas
graf,
as
liz
mentioned,
I
was
one
of
the
creators
of
psyllium.
I
also
co-founded
isurvalent
the
company
behind
psyllium,
because
this
is
the
first
time
for
many
of
you
that
you
hear
about
psyllium.
I
want
to
do
a
quick
introduction,
very
briefly
on
what
is
psyllium
and
what
is
ebpf,
because
both
are
tightly
connected
together.
B
So
what
is
psyllium
silium
is
a
cncf
project.
At
incubation
stage
it
uses
ebpf
and
we'll
talk
about
what
ebpf
is
to
provide
networking
security,
observability,
very
new
service,
mesh
and
ingress.
As
mentioned
it's
in
the
cloud
native
foundation
and
as
underlying
technology,
it
uses
ebpf
and
envoy
and
we'll
see
where
envoy
gets
into
the
picture.
Cylin
today
is
used
by
many
many
users
from
all
sorts
of
verticals
sas
companies
will
hear
an
end
user
with
floral
later
on,
but
also
telcos
cloud
providers,
for
example,
gke
and
porterville
will
talk
about.
B
Ebpf
is
in
one
sentence
to
the
kernel.
What
javascript
is
to
the
browser?
What
I
mean
by
that
is
evpf
makes
the
linux
kernel
programmable,
which
means
we
can
extend.
We
can
change
the
behavior
of
the
linux
kernel
by
loading
evpf
programs
and
very
similar
to
javascript.
They
run
in
a
safe,
sandbox
environment.
The
difference
is,
they
run
a
lot
faster
than
a
javascript
program.
B
We
can
do
this
for
a
variety
of
events
in
the
slide.
We're
seeing
an
example
where
this
is
done
for
a
system
call.
We
can
do
this
for
network
packets,
for
storage
access
for
file
access
for
a
variety
of
trace
points,
k,
probes.
U
prompts
silly
muses,
obviously,
networking
related
endpoints
psyllium
is
not
just
a
cni,
though,
because
many
of
you
have
probably
heard
about
psyllium
as
a
cni
first,
which
provides
very
scalable
and
we'll
hear
about
scale
from
laura,
secure
and
high
performance.
Cri
working
for
kubernetes
psyllium
is
also
a
service
mesh.
B
Now
so
psyllium
can
provide
a
side,
car
free
service,
mesh
and
ingress.
We
have
network
observability
with
project
hubble,
which
provides
open,
telemetry,
prometheus
metrics
and
very
new
recently
announced
tetragon,
providing
security,
observability
and
runtime
enforcement.
So
let's
look
into
all
of
them
a
little
bit
silly
on
cni.
What
are
all
the
things
it
can
do,
there's
a
lot.
B
Obviously
it's
a
cni
and
it
provides
a
variety
of
networking
functions
so
for
the
for
the
networking
people
in
here,
ipv4
ipv6,
of
course,
but
then
also
things
like
net46
translating
ipv4
ipv6.
So
we
can
bootstrap
an
ipv6
only
cluster,
but
still
make
parts
addressable
like
ip4
but,
for
example,
for
telcos
also
provides
srv6,
so
a
very
wide
range
of
networking
capabilities.
B
It
supports
various
topologies,
overlays
pgps
and
integration
into
all
cloud
provider,
sdns
at
least
all
major
cloud
providers.
It
can
replace
q
proxy
so
it
can
provide
kubernetes
service
implementation
and
it
has
its
own
north,
south,
low
balances
or
low
balancing
traffic
into
the
cluster
and
very
new
kubernetes
ingress
layer.
Seven
traffic
management
load,
balancing
cilium,
has
extensive
network
security
controls,
obviously
support
for
kubernetes
network
policies,
but
they
can
then
be
extended
with
psyllium
or
policies
to
provide,
for
example,
dns
based
policies.
B
So
a
policy
where
you
can
use
dns
names
or
wild
cards
to
define
what
is
allowed
and
also
layer,
seven
http
kafka
and
so
on.
Where
you
can,
where
you
can
provide
even
better
security
policies
on
top
of
segmentation,
we
can
also
do
transparent
encryption
with
ipsec
and
wireguard
widely
popular
is
also
the
multi-cluster
and
external
workload.
So
we
can
connect
mod
clusters
together
with
psyllium,
using
standard
kubernetes
resources.
So
we
don't
need
to
use
the
additional
crds
or
anything.
B
You
can
use
kubernetes
services
to
define,
for
example,
global
services
and
do
service
discovery
across
multiple
clusters.
Of
course,
network
policies
will
work
as
well.
Fascinating
as
well
is
the
egress
gateway
and
external
workloads.
Because,
often
not
everything
can
be
moved
into
your
kubernetes
cluster
egress
gateways
allow
you
to
represent
paw
traffic
behind
stable
source
ips,
which
make
the
life
of
traditional
network
firewalls
a
lot
easier,
because
all
they
understand
are
ip
addresses
and
cylim
can
also
run
on
virtual
machines
and
metal
machines.
B
So
you
can
integrate
external
machines
that
you
don't
want
to
run
as
part
of
containerized
workloads
and
integrate
from
a
network
perspective.
Integrate
them
into
your
kubernetes
hubble,
in
a
nutshell,
provides
metrics
locks
and
the
service
map
layer,
3
layer,
4
on
the
network
level,
but
also
layer,
7.
we're
seeing
an
example.
How
hubble
is
parsing
http
requests
and
provides,
for
example,
http
latency
to
build
a
golden
signal
dashboard.
B
We
also
have
a
service
map
where
you
can
see
what
services
are
talking
to
each
other,
and
then
you
can
export
all
of
these
metrics
and
these
logs,
like
via
prometheus
fluentd,
just
as
json,
you
can
build
grafana
dashboards
elasticsearch
and
what
we've
added
recently
open,
telemetry
support
as
well
psyllium
service
mesh
is
moving
to
stable
in
1.12.
That
was
will
be
released
in
a
couple
of
weeks,
which
adds
a
native
service
mesh
capability.
B
Selem
service
mesh
offers
two
options
to
implement
service
mesh.
The
option
we
had
so
far
was
option
number
two
where
selim
integrates
with
istio
and
enforces
its
layer,
seven
policies
in
the
side,
cars
of
what
of
the
of
the
site
of
the
sidecars
managed
by
istio.
The
new
option
is
a
completely
side.
Car
free
service
mesh,
where
evpf
and
unvoid
together
provide
a
service
mesh
data
path
that
does
not
require
to
run
side
cars
in
each
pot.
B
We
want
to
support
all
of
that
and
obviously
for
the
observability
that
we
can
provide
support
the
ecosystem
in
the
cloud
native
space
tetragon
introduced
this
week
was
part
of
our
enterprise
offering
so
far,
and
this
week
we
have
open
sourced
tetragon,
and
with
this
it
has
moved
into
the
cloud
native
foundation.
It
is
the
ability
to
provide
runtime
visibility
so,
for
example,
ability
to
see
what
system
calls
are
being
made,
what
files
are
being
accessed.
B
We
can
see
privilege
escalation,
so
when
a
part
gains
security
privileges,
we
can
see
when
a
part
breaks
out
of
a
container
namespace
and
then
even
more
importantly,
we
can
actually
mitigate
some
of
that.
So
when
we
see
these
events
happen,
we
have
an
in-kernel
ebpf
implementation
to
react
to
that
and
automatically
terminate
a
process
that
violates
the
rules
for
the
observability,
of
course,
the
usual
ecosystem
that
we
can
provide.
B
Last
but
not
least,
very
briefly,
on
like
what's
coming
in
113.
So
we're
about
to
release
112,
so
we're
in
feature
freeze
for
112,
which
will
move
service
mesh
out
of
beta
into
stable
in
1.13.
We
will
focus
heavily
on
adding
additional
service.
Mesh
control,
plane,
integrations
gateway.
Api
support
will
be
coming,
spiffy
integration,
the
pr
is
out
there.
We
want
to
merge
that
in
time
for
113,
as
well
as
a
new
architecture
for
providing
mutual
authentication
with
mtls.
That
will
work
not
only
for
tcp
but
for
all
variety
of
network
traffic.
B
Obviously
a
lot
more,
but
these
are
the
high
level
points,
but
even
more
importantly,
what
is
missing?
Tell
us
and
liz
will
be
speaking
a
bit
oops.
This
will
be
speaking
a
bit
more
about
how
you
can
actually
influence
the
roadmap,
how
you
can
tell
us
what
we
should
be
doing
next
and
with
that
I
would
like
to
introduce
laura
from
datadock
talking
about
datadoc's
journey
with
cilium.
D
C
C
C
We
currently
run
tens
of
thousands
of
nodes
and
hundreds
of
thousands
of
pods
and
and
the
challenges
we
have
a
lot
of
communities
clusters
because
of
course
we
can't
run
clusters
that
big
but
they're,
already
pretty
big,
as
you
can
see,
because
our
biggest
clusters
are
close
to
I
mean
this
slide
says
4
000
node,
but
we
now
have
closest
close
to
five
to
six
thousand
nodes
to
make
things
even
more
complex.
We
run
on
multiple
cloud
providers
and
we're
growing
pretty
fast.
C
So
this
is
a
very
high
level
view
of
our
infra,
so
we
run
on
different
cloud
providers
with
different
constraints
and
and
of
course,
what
we
want
is
we
want
communications
to
be
secure
within
clusters,
but
also
between
clusters,
right
because
we
have
so
many
so
many
so
many
clusters.
We
also
have
a
lot
of
communication
between
clusters
and
we
need
ways
to
to
make
this
config
these
communications
secure.
C
So
one
of
the
thing
one
of
the
constraints
that
comes
with
our
design
is
because
we
have
workloads
running
in
multiple
clusters.
We
want
to
be
able
to
efficiently
route
traffic
between
workloads
right,
for
instance,
imagine
you
have
a
kafka
cluster
running
in
one
communities,
cluster
and
you
have
cloud
clients
in
another
cluster.
You
want
this
communication
to
work
and
for
this
to
work
you
can't
use
load
balancers.
C
Of
course
it's
not
as
easy
there's
a
reason.
Many
people
start
with
overlay,
because
overlays
are
very
simple.
To
set
up
all
your
clusters
are
independent.
You
don't
have
issues
managing
the
ip
space,
but
if
all
your
ips
are
routable,
then
you
need
to
be
very
careful.
How
you
allocate
ip
and
and
siding
clusters
is
a
bit
challenging.
Charging
subnet
is
challenging
and,
of
course,
even
if
you
have
ips
that
are
routable
between
clusters,
it's
not
because
ip
communication
works.
That
services
can
discover
themselves
right.
C
C
And,
and
with
this
solution
we
had,
we
had
no
network
policy
and
and
the
support
for
encryption
between
nodes.
Another
challenge
we
had
was
service
load
balancing.
So
I'm
sure
most
of
you
are
familiar
with
how
this
usually
works.
You
have
q
proxy
that
is
responsible
for
transforming
services
into
pod,
ips.
C
That
was
much
better,
but
it
was
very
new
and
it
didn't
have
all
the
features
iptables
had.
So
it
was
not
honoring.
Everything
kubernetes
was
supporting
and
connection
tracking
in
ipvs
proved
to
be
very,
very
difficult
for
us,
and,
as
a
summary
I
mean
we,
we
are
many
many
growing
paints
and
for
service
service
load,
balancing
ipvs
and
epitables
kind
of
worked
both
with
issues,
but
they
were
really
not
designed
to
do.
C
Also
getting
patches
in
the
kernel
and
improvement
was
pretty
slow
and
something
that
happened
pretty
recently
is
we
had
the
we
found
a
bug
in
the
kernel
in
the
vs
code,
which
impacted
performance
and
getting
this,
but
it
was
actually
easy
to
get
it
fixed.
But
of
course,
then
you
need
you
need
this
to
to
roll
out
right,
and
I
mentioned
network
policy
before
during
network
processes.
Website
was
possible,
but
of
course,
once
again
it's
a
lot
of
iptable
rules.
C
C
Something
I
wanted
to
mention.
Is
we
started
as
users
of
psyllium,
of
course,
but
we
have.
We
run
it
at
quite
quite
some
scale
and
we
have
a
few
specific
use
cases
based
on
our
on
our
design,
things
at
datadog,
and
so
we
after
sometimes
we
started
suggesting
features,
and
then
we
started
contributing
contributing
some,
some
small
fixes
and
some
larger
ones,
and
what
I
wanted
to
mention
is
we
really
felt
welcome.
C
So
in
terms
of
contribution
we
did
a
few.
I
wanted
to
mention
two
recent
one
that
might
be
of
interest
for
some
of
you.
One
is
prefix
delegation
on
aws,
so
we
run
serium
in
ipam
mode,
where
psyllium
is
allocating
ips
to
aws
interfaces,
and
the
problem
is
when
your
vpc
starts
to
get
big
and
you
allocate
ips
one
by
one.
You
start
having
issues
with
with
the
vpc
because
it
can
get
slower
and
adjust
heavily
recommended.
C
If
I'm
correct
another
one,
that's
that's
recently
is
we
had
interesting
issues
where,
when
you
delete
a
pod,
suddenly
the
ip
is
not
readable
anymore
and
it's
just
black
holes
and
it's
sometimes
very
interesting
to
notify
the
client
that
this
ip
is
not
readable
by
sending
an
icmp
error.
So
you
don't
get
into
a
scene
retry
loop,
and
so
this
is
a
new
feature.
We
we
added
and
another
another
one.
C
You
can
look
at
blocks
of
ips
and
it's
and
it's
much
faster,
so
yeah
I
mean
we
we've
been
using
cilium
for
for
some
time
for
some
time
now
and
we
really
plan
to
continue
and
and
to
use
it
and
to
and
to
contribute
to
it
because
it's
been
yeah.
It's
been
a
very
interesting
journey
for
us
and
on
this
I'm
going
to
welcome
proving.
D
D
So
we
launched
the
gke,
the
top
lane
version
2
in
based
on
ebpf
psilium
in
2020,
and
from
very
early
on.
We
saw
the
ebpf
and
celium's
disruptive
innovation
in
enabling
the
or
exposing
the
programmability
in
the
stack
network
stack
of
linux
so
based
on
celium
gk
data,
plane
v2
is
our
opinionated
and
fully
managed
and
kubernetes
compliant
network
stack.
D
So
you
all
know
we
have
been
fully
committed
to
kubernetes
community
and
kubernetes
open
source,
and
with
this
we
were
and
committed
to
celium
community
and
celium
open
source,
as
as
many
of
us
know
that
one
of
the
hidden
superpowers
of
kubernetes
is
really
the
developer
first
networking
model
and
with
data
plane
v2.
What
we
did
was
we
harnessed
the
power
of
ebpf
celium
and
the
kubernetes,
and
this
is
very
important
for
us
and
we
have
seen
great
feedback
from
the
customers.
D
D
D
A
A
A
Psyllium.Io
is
the
website
there's
a
page
on
there,
with
a
collection
of
pointers
to
beginner
materials,
whether
that's
the
documentation,
whether
it's
our
weekly
introduction
sessions
with
thomas
and
other
contributors
and
maintainers
from
the
city
and
project
who'll,
answer
your
questions
and
help
point
you
in
the
right
direction.
If
you
have
some
initial
questions,
we
have
documentation
with
a
number
of
getting
started
guides
and
we
now
have
some
interactive
tutorials
that
will
show
you
some
of
the
basics.
A
Maybe
it's
going
to
work.
Maybe
it's
not.
Maybe
I'll
use
the
button.
Okay.
So
if
you
do
ask
for
assistance
on
slack
you'll
find
a
number
of
channels
related
to
some
subtopics,
I
mean.
Obviously,
people
have
a
tendency
to
just
put
everything
in
general
and
and
then
things
get
lost.
So
if
you
do
realize
that
your
question
is
very
specific
to
service
mesh
or
hubble
or
some
other
feature
of
psyllium,
then
it's
great.
A
If
you
can
use
those
specific
channels,
I'd
also
really
recommend
you
to
help
answer
questions
in
those
slack
channels,
because
after
all,
this
is
a
community
project
and
your
experiences
as
an
existing
user
are
really
valuable.
You
know
this
has
to
be
a
community
where
we
can
help
each
other
solve
problems.
A
A
A
We
have
a
new,
a
cfp
template.
If
you
go
to
the
issues
part
of
github,
and
you
raise
a
feature
request,
you
can
fill
that
in
at
a
high
level
or
if
you
have
like
a
strong
opinion
on
how
it
could
be
implemented,
or
you
want
to
provide
a
lot
of
details.
There's
a
google
doc
template
that
you
can
use
to
sort
of
give
us
a
bit
more
expansive
idea
on
what
it
is
that
you'd
like
to
achieve
and
for
a
bigger
feature.
A
We
use
those
cfp
templates
as
a
kind
of
way
of
asynchronously
debating
how
larger
features
could
be
implemented.
If
you
want
to
see
the
the
roadmap
now,
there's
no
real
replacement
for
github
issues.
Github
issues
is
the
set
of
things
that
we
know
about
that.
We
would
like
to
implement
the
kind
of
higher
level
set
of
broader
features
that
we
want
to
tackle.
We've
started
publishing
in
a
community
roadmap.
A
We
deliberately
don't
put
time
frames
on
those
because
it's
a
community
project.
So
if
there's
something
specific
that
you
really
want,
you
can
help
contribute
to
that
feature,
or
you
can
at
least
give
us
the
feedback
on
why
it's
urgent
and
what
you
could
possibly
do
to
help
us
bring
items
in
in
the
time
frame
that
you
need
them.
A
A
A
I
strongly
recommend
getting
involved
in
slack
and
talking
about
a
pr
before
you
submit
it,
because
quite
often
there
might
be.
You
know,
half
a
dozen
different
ways
to
tackle
a
problem
and
there
may
be
some
strong
opinions
from
the
maintainers
about
which
of
those
approaches
is
the
best
so
we'd
much
rather
have
that
discussion.
First
help
point
you
in
the
right
direction
and
make
it
an
easy
process
for
getting
those
prs,
accepted
and
merged,
because
that's
what
we
all
want,
we
nobody
wants
pr's
sitting
there
unmerged.
A
A
If
everybody
takes
one
they're
great
and
of
course
you
might
want
to
actually
talk
to
people,
I
know
it's.
You
know
it's
been
amazing,
actually
seeing
people
in
real
life
this
week.
We
might
all
be
a
bit
fed
up
of
zoom
calls,
but
it
can
be
really
useful
to
have
a
conversation.
So
we
have
a
weekly
developer
call
you'll,
find
all
the
details
on
github
and
and
also
in
the
the
documentation.
A
A
A
We
have
a
form
that
you
can
fill
in
if
you'd
like
to
us
to
send
swag
and
also,
if
you
want
to
ask
one
of
the
maintainers
from
psyllium,
if
you'd
like
to
invite
them
to
speak
at
an
event,
you
know
I'm
not
going
to
guarantee
that
you'll
always
get
a
yes,
but
we
can
try
and
connect
you
with
people
in
your
local
area,
who
might
be
interested
in
having
a
discussion
and
sharing
the
psyllium
joy
locally
so
that
gel
get
help.
Paige
will
give
you
a
form
you
can
ask
for
all
kinds
of
help.
A
A
D
The
main
purpose
is,
as
we
said,
we
are
hearing
our
customers
where
they
would
like
to
be
like
they
would
like
to
have
things
from
open
source,
the
goodness
from
here
and
then
also
get
the
managed
and
the
differentiation
from
google
cloud.
Let's
say
on
gke,
so
for
us
it
is
important
to
have
that
kind
of
ecosystem
where
they
can
run
some
tools
that
they
can
get
from
celium
and
make
it
work,
and
maybe
even
actually,
if
everything
works
out
well
far
away
in
the
future.
B
Yes,
the
question:
well
just
to
repeat
the
question:
the
question
was
great
evp,
but
what
are
the
limitations?
So
the
answer
is
what's
specific
about
ebpf
is
that
it
can
run
in
the
linux
kernel.
That
was
it.
That's
what's
different
to
other
languages
such
as
webassembly
or
java,
or
just
c.
This
privilege
to
run
in
the
linux
kernel
comes
with
limitations
because
nobody
wants
their
kernel
to
crash,
which
means,
in
order
for
a
ppf
program,
to
be
loadable.
It
needs
to
be
verifiable.
B
This
means
it
needs
to
be
verified
by
the
kernel
verifier,
and
it
will
be
rejected
if
it
does
not
pass
this
check.
One
of
the
conditions
is,
for
example,
complexity.
We
cannot
run
a
10
megabyte
word,
processing
app
into
the
kernel
programs
need
to
terminate;
they
need
to
be
able
to
run
to
completion,
which
means
it
needs
to
be
known
that
they
will
eventually
end
so
it
doesn't
run
continuously
and
your
kernel
will
just
stall
and
there's
also
a
size
limit
to
the
program.
B
A
A
I
think
we
are
pretty
much
out
of
time,
we'll
probably
get
kicked
out
of
the
room.
I'm
just
going
to
add
one
more
point.
Well,
first
of
all
two
more
points
one
is:
there
is
obsidian
booze
do
come
and
ask
your
questions.
There
are
people
manning
that
booth
for
the
rest
of
today
and
tomorrow,
so
we'd
love
to
have
a
chat
with
you
there
and
also,
if
you're
interested
in
ebpf.