Cloud Native Computing Foundation Online Programs, 8 Aug 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Unlocking the Power of Programmable Data Planes in Kubernetes with eBPF #WordsUnplugged

Description

In a recent article, Lakmal Warusawithana, Senior Director for Cloud Architecture at WSO2, wrote how programmable data planes offer dynamic control for cloud native applications and how technologies like the extended Berkeley Packet Filter (#eBPF) and #kubernetes provide an abstraction to improve flexibility, scalability, and performance. In this WordsUnplugged episode, Lakmal, and Kanchana Wickremasinghe, VP and GM for Choreo at WSO2, sit down to talk about eBPF and its role in creating effective programmable data planes in Kubernetes. They also discuss benefits, challenges, best practices, as well as future trends and opportunities.
Link to Lakmal’s article: https://wso2.com/blogs/thesource/unlocking-the-power-of-programmable-data-planes-in-kubernetes-with-ebpf/

0:00 - Introduction to eBPF
2:20 - Is eBPF safe in production?
3:11 - Programmable data planes in Kubernetes
4:30 - Improving performance and scalability with eBPF
7:03 - Enhancing security with eBPF
9:03 - Impact of eBPF on observability
10:53 - Impact on cloud native architecture and Linux kernel ecosystems
12:50 - Platform vs. DIY approach
15:00 - Overcoming eBPF challenges
17:20 - Learning more about eBPF
20:00 - Conclusion

A

A

Good to talk to you today, the recent blog post you have written, which had lots of views. Even my report said lots of views as well. More than ten thousand, um you know the title says: unlocking the power of programmable data planes in kubernetes with ebpf. So let's talk, you know a few things about it. First of all, I think it's important for us to tell people who are new to ebpa, for some people may have not known about ebpf, maybe a quick summary about what is the cbpf about sure.

B

Yeah in simple terms, eppf is a tool that allows us to add custom features to the Linux kernel. Without changing the Kernel's original code, you can think of it as adding books into the kernels operation.

B

This will get triggered by certain actions like system calls or network events Etc, for instance, ep5, can be taken to a system called like read or write made by a program. It can also look at all change network packets makes custom Network rules or collect Network stats.

B

Similarly, and it can also monitor action on file like open, read or write. This is to keep ion click on the file, access, set, access rules or collect data on input, output, action and so on.

A

Cool, thank you. Thank you and and I think we should all celebrate what the ebpf stands for. You and I probably know, but maybe a lot of the community would sure.

B

Yeah, yes, BPF originally stood for Berkeley packet filter, but now that edpf extended BPF can do so much more than the packet filtering and the acronym no longer makes sense. So ebpf is now considered a standalone term, but doesn't stand for anything I see I.

A

See thanks um is ebpf safe because it's talking to the kernel and making you know listening.

B

Yeah, this is a common question, yeah I, think absolutely, even if it is designed to to Safe in use in production environment. So I can give you two reasons right right. Firstly, ep5 program are checked or verified by a git compiler before they use into the kernel. I, see, uh and also this verification ensure the program is safe and won't have the system, and, secondly, uh eppv programs run in their own virtual machine indicator.

B

This means they are isolated, so they can't negatively affect the rest of the systems right.

A

So it's pretty okay to say it's safe to use in in production as well. Right, yes,.

B

A

Think yeah! Okay, perhaps you could also elaborate a little bit more with the article you wrote in programmable data planes in kubernetes means in.

B

A

In terms of communities.

B

Yeah, so programmable data pane is a concept, it's not specific to the kubernetes, but we have first or network in general, so uh we can think of like a programmer data brain uh as a smart and flexible Network system, unlike the old way. So we, where you had a manual Ledger settings on a specific equipment like routers, this new method use software to control the network, so it's more flexible can grow easily and it works on normal equipment.

B

So no need any anything fancy and in the world of kubernetes is it uses an easier way to control network using things like deployments, sports services and more and also by using take like ebvf or outside this simpler controls. We can make a strong adjustable Network system and that can easily adapt to the new Cloud applications needs I, see.

A

Thanks, um how can ebpf be used in to improve the performance and scalability of kubernetes applications.

B

Okay uh to answer this question, uh I will need to like tell into some technical aspects. Let me attempt to give a concise explanation. Sure in in kubernetes, a service used to study, virtual IPA and a port number and representing a group of ports.

B

Ip doesn't tie to a fiscal interface, but it gives a consistent endpoint for a service. If a client send a data to this IP and Port Network proxy, we call it proxy on each cluster node catches it this proxy uses rules to divert the data from a virtual IP to a relevant port.

B

So when we send a request, the data is chopped into packets, each having an IP heading right, and this heading is altered to a process called Network address translation. We call it net. Everybody knows net yeah, which change the IP headings.

B

As this change occurs for every packet, it can slow things down when many packets need to alter it. To improve this performance. Cereal celium is a open source. Cncf project offer offers a different method called circuit, based load, balancing.

A

B

Yeah celium Excel listening socket link to a service IP, so as a packet arrived, celium checked them to decide where to send them and users epvf to steer the packet to a correct soccer. I should- and this only happened per connection, not for every packet which.

A

B

The network work faster, okay,.

A

So that improves the the performance of.

B

A

Right yeah: what about the scalability side? So how do how do ebpf address the scalability side on that? One.

B

So that's also coming with the same concept. So when we're having when you can handle the low latency Network, so it can scale much larger number of nodes so earlier case with the proxy. uh It's like uh can't handle the much uh Pro code. So it's scalable this lesser less.

A

Okay right, so next I was I'm. Gonna ask you like. um Can we also use ebpf to enhance the security, because I mean this is something that keeps coming up in the kubernetes world right enhance the security of kubernetes applications? Yes,.

B

Exactly so ebf like uh can improve the security of kubernetes application like it helping keep our communication and that uh data we're safe, so uh usually network security users IP addresses to decide who get access right. It's like having a special key for each device like, but people can trick the system and change this IP address because uh problem in a system like kubernetes, where the IP addresses can often change. Yes, so EPF work differently.

B

It users, identity, based policies, making like a decisions based on the post, specific detail like labels and annotation, not just its IP, addresses right I think we can think of like a security guard who doesn't just rely on ID card, but also personally know each individual. So when ports in a packet, epcf functions like security card check, the ports, individual details right so based on this assessment, like it decide whether the port should be granted access to the service, thus like providing a level of control in both precise and the secure.

A

Right right so, regardless of the IP address changes, it doesn't matter as far as the right identities. It's the one. That's going to access it right.

B

Yes, it's in building to the packet, so it's you can't change the identity. In that case, yeah.

A

Yeah, which makes sense in the kubernetes world right when ever keep on changing the IP address whenever it's on restart a pond Etc right.

B

Yes, that's that's the main advantage having this uh identity based uh like a firewalls.

A

Yeah, okay, so next one is kind of leading from there. So one of the other key things in kubernetes, as well as in the community world, is the observability right observed very crucial right and yeah. Can you elaborate how we could possibly use ebpf in this domain?.

B

Yeah, so uh if you're the observability like helps us to understand system Behavior like using data like metrics, logs and traces right, so the traditional way to do this in all manual adding code. Together this analysis and analyze, the data which can be a complex and also time consuming right, uh popular method in microservices is using a service mesh with a sidecar process like this proxies automatically collect and analyze data.

B

Giving insight to application Behavior but running a separate proxy for each service can slow things down and also use more resources, yeah, so Epp of a better solution for a service mesh environment. So it's allow data collection at the kernel level, I mean no need for separate boxes, serving and saving resources and reducing overhead.

B

So ep5 can capture Network traffic check and modify packets and also generate data for centralized analysis, and this gives a deeper understanding of replication, behavior and also infrastructure without an extra work of a sidecar proxy right right. The tools like pixie Hubble use, epvf technology for better observability in uh modern Cloud native environments, right.

A

Right is Hubble the the one that the psyllium project that you mentioned.

B

Earlier, yes from yeah.

A

Yeah, thank you. Okay, so um you know. Obviously you know we talk a bit about. You know the the use of it. You know what it stands for ETC now um you know this significant popularity like ebvf in the recent days right I mean you and I probably know the BPF actually was long running.

B

A

Right, can you discuss a little bit about that like and um you know, especially in the cloud native application architecture, you know and Linux kernel ecosystem right.

B

Sure yeah I think the most of uh Cloud infrastructure like over 90 percent Linux kernel, because it's strong, stable and dependable right. So we we all, have a servers running on Linux servers, so it's allowed application to run and share resource efficiently.

B

So, however, that apps are quickly changing, we all know at Cloud, Network apps are changing very rapidly absolutely so it needs more functionality from the car. Traditionally we only had two choices: one change, this kind of source and wait for the enough Community to include your changes and which could take a yes right.

A

Right second option: yeah.

B

So and the second option uh write a kind of module, but this may need a regular fixing, as each new kernel release could break it yeah. So these challenges made it to evolve the modern like Cloud native application like, but now with the evpf, we can have a new option.

B

It's allow us chain how the Linux kernel behave without needing to change the source code or loading a kernel, module.

A

I see I see so that's a massive advantage over the kernel modules and having to wait for the new releases to.

B

Come out, yes, that's changed. The cloud native application work dramatically right.

A

Now um these, what do you? Why do you think um you know people should look at a platform to provide this capability versus building something yourself? The reason I'm asking that question is how many BPF is a heavy technical.

A

um You know solution right, I'm, not saying that one cannot do it with it. But what are the advantages like of somebody using a platform versus kind of going and building your own one.

B

Yeah, absolutely this is a very important question. So building complex stores like even ebpf or programmer databane can be tough and try to consuming yeah. That's why some people are choose to use a ready-made platform right instead, so uh this platformer simpler, because uh experts have already built and tested it, they let you focus on making your app. Instead boarding up, they say, infrastructures right.

B

They also designed to grow easily with your user base and the plus point they come with the maintenance and support like which include bug, fixes and keep him up with the new tech.

B

Yeah, so also it might not give you a control, you would have if you build something yourself yeah, so you should decide whether to use the cloud platform or Not by considering your specific needs, the resource. You have your expertise and what trade-off you are willing to accept.

A

Right right and continue to maintain it as well right because I mean you can get anything up into production, but day two day, three operations also very key right: exactly yeah, okay, okay yeah, so um next one is kind of leading into it as well right in terms of the challenges right. So what are some of the challenges that you have seen and the others have seen in the BPA, and how would you recommend people would overcome some of these challenges.

B

Yeah I think I can think of three main challenges. Firstly, the complexity, so ep5 can be tricky to use, especially if we are not very familiar with Linux. So, however, they are. There are handy tools like BCC and BPF, which make epip easy to navigate.

A

B

Better, we have tools like celium BPF Trace that incorporate Epps to help us further right. That is second point is there's a issue of Kernel compatibility.

A

B

If you have need to be up to date with Linux kernel function properly right, this means we need to keep your kernel updated and stay informed about what you're gonna can do or can't do with Epp right. It's updating it's not an option. Then we may have have some limitation on using eppf.

B

Let's see if I think the last Point, uh we must consider security risk. Although ebpf is designed to be secure and safer yeah having uh customers for running uh kernel, it could possess risk right. uh So we need to make sure that our ep5 code is reviewed and follow safety protocols. I see also uh remember, always install any security updates like uh for your kernel and AP tools, right I think these are the things we need to keep in mind while working with evpf I.

A

See right so these challenges can be possibly overcome with the platform approach. Isn't it yes,.

B

A

Support and most experts working on it to help you, rather than you trying to build something yourself right. Yes,.

B

I think we're not we're not working with the specific tools we have to uh platform, which is very important, because that people are keep doing the same thing and they they become experts on that. Okay, that's helps a lot like to maintain these platforms exactly exactly.

A

Yeah and and lastly, what would what advice would you give someone who is interested in learning more about ebpf, whether to build something themselves or whether to you know, get to know what are the benefits Etc? What advice.

B

A

You give learning.

B

Specifically, yeah I think first uh started basic right, so understand the EPA and how it's work. It's in high level and basic understanding of Linux and system programming will be much helpful and my recommendation. First we see the eppf.io. It is the best place to start right and second I can think of like a Hands-On learning like uh once, you got a grass grasshop Basics start experimenting with epip right like there are many tutorials example available online, so you, for instance, the BCC repository on git tab uh GitHub.

B

It has a lot of sample APFT programs that you can try running and modifying and see how they work, I, see and third uh use tools and libraries. So, basically writing. Row. Ebpf code can be difficult right, but thankfully there are tools slide, please available, so it make easier to write the code and the another important thing is to participate in the community. The ep5 committee is vibrant and growing, and there are many resources available like blocks talks and online forums where you can ask questions and learn from others.

A

B

A

Was going to say, have we you've been involved with a lot of these communities as well right, Yes,.

B

Actually I I, I, I started learning. I I follow the same steps: I I, just type when I new to the ABP. If I look at the basics and then make my identity with the tutorials and engage with the community yeah, so I think the same things was I followed. The when I learned the nppa and one important thing to answer like a learning. Epp is not just about understanding the technology, but also about knowing when and how to use effectively. Absolutely.

A

B

You gain experience and try try to apply eppf to real world problem and see how it can add value to your your use. Cases.

A

Hundred percent hundred percent yeah uh any any last comments you wanted to leave for the people who are trying to learn and get to know about ebpf I.

B

Think this Epp is a very uh new technology and uh interesting technology uh like uh we can do much more things than what we're doing now. So I think uh I I I encourage everyone to look at the technology and uh try to use it and see what are the potential you can make out of it right.

A

Right now, thank you so much and it was absolute pleasure again to talk to you and uh an awesome article I think if people who have not read it and we will republish it and it's on the wso2 website, as well as it shared by many social media as well. Thank you. So much Luckman will soon talk a little bit more about ebpf in couple of moments.

A