►
Description
Replacing iptables rules with eBPF allows transporting data directly from inbound sockets to outbound sockets, shortening the datapath between sidecars and services. In this hoot livestream, Xiaopeng and Kebe from DaoCloud will join Lin to discuss the Merbridge project and how users can accelerate their service mesh adoption with eBPF and Merbridge, along with live demos!
#istio #servicemesh #ebpf #merbridge #livestream
00:12-2:20 Welcome + speaker intro
2:20-6:10 service mesh and Istio news
6:10-8:45 Discussion related to DaoCloud, why Istio for DaoCloud
8:45-24:54 Dive into why Merbridge and how Merbridge works + Answer live questions
24:54-37:59 Live DEMO
38:10-48:24 Challenges when building merbridge, mixed nodes, ready for production?
48:25-51:07 how to contribute to merbridge? wrap up: https://join.slack.com/t/merbridge/shared_invite/zt-11uc3z0w7-DMyv42eQ6s5YUxO5mZ5hwQ
https://github.com/merbridge/merbridge
To learn more about us, please visit https://www.solo.io
We are hiring! https://www.solo.io/company/careers/
Questions? https://slack.solo.io
Code Samples: https://github.com/solo-io/hoot
Suggest a topic to cover here: https://github.com/solo-io/hoot/issues/
A
Okay,
I
believe
we
are
live
if
I
click
on
the
button
correctly.
Welcome
to
hoot
live
stream
today,
service,
mesh
and
evpf.
These
are
super
hot
topics
right.
Are
they
competing
to
with
each
other
or
are
they
complementary
to
each
other?
Can
you
actually
add
ebpf
support
to
istio
without
changing
istio
at
all,
so
in
this
hood
live
stream?
We
are
going
to
explain
all
this
to
you
with
the
murderers
team.
A
A
A
A
A
If
you
are
interested
in
the
steps
from
our
previous
episode,
we
also
have
a
episode
scheduled
for
next
week
on
how
to
increase
the
application
resilience
for
kubernetes
services
running
on
spot
vm.
So
check
join
us
next
week,
we're
not
going
to
have
a
hoot
on
april
12
and
because
I'm
on
vacation-
and
you
know
we-
we
also
have
another
hood
scheduled
for
for
the
24th,
so
stay
tuned.
A
Also
thanks
to
my
coworker
wheel
and
who
brought
up
to
me.
This
interesting
news
about
89
percent
of
organizations
says
kubernetes.
Ransomware
is
a
problem
today,
so
check
it
out.
In
fact,
only
33
of
those
deployed
kubernetes
have
protection
in
place
to
help
mitigate
data
a
lot.
So
this
is
a
lot
of
work.
You
know
a
lot
of
help
needed
in
this
in
this
area.
For
sure
I
also
want
to
give
a
shout
out
to
your
friends
at
spectrocloud.
A
That's
all
the
news
by
the
way,
a
little
bit
news
about
istio,
kong
and
servicemeshcon,
the
speakers
are
out.
The
schedule
is
going
to
come
out
of
israel.com
really
soon,
so
I'm
so
excited
about
the
the
lineup
of
the
speakers
and
the
agenda.
So
congratulations
to
all
of
our
speakers
for
istio
khan
and
service
mexico.
A
A
That's
awesome,
so
why
is
still
for
dark
cloud?
I've
noticed
you
guys,
I
mean
started
to
contribute
a
lot
right.
You
become
a
maintainer
and
you
guys
are
the
third
largest
contributor
to
istio
in
terms
of
merged
pr.
So
that's
significant
because
I
guess
many
of
us
haven't
heard
about
doubt
cloud
before
so.
A
B
Actually,
I
think
there
are
like
maybe
several
reasons.
The
first
one
should
be
that
ebpf's
popularity
and
community
acceptance,
I
think
for
now.
Ebpf
becomes
a
really
hard
training
topic
and
a
lot
of
companies
have
tried
all
would
like
to
try
evpf
and
make
it
work
in
different
kinds
of
areas,
and
I
think
our
our
community
also
has
some
voices
about
ebpf
to
be
implemented
in
the
match
scenario.
B
B
Currently,
there
is
no
open
source
solution
that
can
be
directly
used
in
the
community
for
this
ebpf
technology,
and
I've
heard
that
some
of
the
companies
have
already
implemented
this
ebpf
in
the
mesh.
But
I
think
they
are
only
for
internal
use
and
and
also
the
last
reason
which
I
was
mentioning
before,
like
our
company
had,
our
company
has
had
the
technology
accumulation
for
for
some
years
in
the
service
match
field,
and
we
would
like
to
provide
our
technology
and
to
promote
the
development
of
this
new
technology
in
the
community.
A
That's
great,
I'm
really
excited
you
guys
are
doing
this
because
I
know
I
think
it
was
three
years
ago
sirium
published
your
blog
regarding
ray.
How
do
you
use
ebpf
specifically
using
psyllium
to
shortcut
on
the
network
connectivities,
but
it
was
kind
of
like
something
inside
to
the
istio
project
right,
because
it's
not
easy
for
is
your
user
to
endorse,
and
it's
not
something
you
know
published
on
the
issue
io
as
a
as
like
a
community
thing,
so
so.
B
A
Excited
you
guys,
actually
publish
this
blog
and
make
it
available
to
the
istio
user
so
with
that
we're
going
to
dive
into
a
little
bit
more
of
about
the
murbridge
project.
So
so
in
case
you
guys
haven't
read
sir
kirby
and
xiaopong
from
dark
cloud
actually
wrote
a
blog
regarding
murbridge
how
to
use
murbridge
to
accelerate
the
service
mesh
by
replacing
the
ip
table
rules.
So
let's
dive
into
that.
So
let's
see
a
first
question
I
have,
I
guess
is
regarding
murbridge.
A
I
I
actually
read
the
blog
a
few
times.
What
puzzles
me
really
is
how
murbridge
actually
works
without
modified
issue,
because
a
few
years
ago,
when
syrian
project
published
their
thing,
I
believe
they
had
to
make
some
changes
to
istio
regarding
the
cycle
injection
the
init
container.
So
what
puzzles
me
the
most
about
murbridge
is
how
mubridge
works.
You
know
without
modified
istio
and
also
what
is
the
role
of
the
init
container
in
the
context
of
when
istio
works
with
murbridge.
B
B
And
this
means
that
the
socket
does
not
need
to
go
through
the
several
network
stacks
and
reach
to
the
destination
circuit,
for
example
like
the
tcp
protocol,
the
the
ip
tables
and
the
ethernet
and
etc,
and
with
this
part
of
works,
actually,
we've
already
finished
the
acceleration
part.
But
how
can
we
like
run
the
merge
rate
in
the
mesh
scenario
and
for
this
question
and
the
next
part
should
the
the
next
part
should
be
to
simulate
and
replace
what
iptables
does
to
the
mesh
like
like
for
the
easter
project?
B
B
And
here
here
is
the
thing
we
cannot
actually
bootstrap
using
the
host
network
mode,
because
our
murbridge
project
should
be
run
in
the
demon
set
demons
demonstrate
deployment
and
since
using
this
kind
of
mode
will
result
in
more
bridge,
we
are
resulting
murbridge
not
doing
anything
with
the
ip
tables
or
ebpf
at
all,
because
we
cannot
reach
out
to
the
cluster
ip
service
from
a
host
host
network
pod.
So
we
use
the
you
need
container
to
obtain
the
ip
address
and
using
this
thing
will
also
like
be
more
secure.
A
A
A
A
Yeah,
that
makes
sense,
so
let
me
clarify
one
thing
with
you
so
basically,
because
you
didn't
make
any
modification
to
the
issue
project
as
of
right
now,
so
the
role
of
the
init
container
still
remains
well.
The
ip
table
would
continue
to
be
set
up,
but
maybe
perhaps
in
the
future.
You
are
looking
at
disable
that
iptable
setup
with
murbridge,
because
it's
not
needed
right.
That
ip
table
setup
is
unnecessary.
B
Yeah
currently,
the
murbridge
project
is
is
running
with
ip
tables
in
the
compatible
mode
and
right
now
it
will
not
affect
anything,
because
I
think
currently,
eco
do
not
have
like
has
a
great
way
to
disable
the
ip
tables,
but
you,
if
you
disable
it
manually
like
do
not
start
the
unit
container
or
clean
all
all
the
cleaning
up
all
the
iptables
rules,
then
with
murbridge.
It
can
still
like
function
well
for
the
requests.
A
B
Yeah,
I
I
think
easter
singer
is
doing
kind
of
similar
thing
like
it's
initiate,
initiate
the
ip
tables
and
do
the
like
the
traffic
redirection,
but
for
the
murder
bridge
it
will
not
use
ip
tables
at
all,
so
it
it.
It
does
not
need
the
estee
lcr
and
we
also
plan
to
support
murbridge
as
a
kind
of
like
istio
cni,
or
something
that
maybe
maybe
this
is
in
the
future
plan.
A
B
A
B
A
Yeah,
so
so
this
is
an
interesting
question.
So
last
year
I
think
I
actually
went
through
sillim's
website
and
I
was
trying
to
you
know:
do
what
cilium
published
your
blog
three
years
ago
right.
They
use
psyllium
to
to
kind
of
eliminate
the
need
to
config
ip
tables,
but
I
couldn't
find
the
instruction
to
do
that.
I
couldn't
figure
out
how
to
do
that
to
not
needing
iptable
just
using
psyllium
cli
with
istl.
A
A
I
think
we
talked
about
how
mobile
you
work
for
services
in
the
match
was
not
in
the
mesh
by
determining
the
pad
ip,
the
side
car.
You
know
the
ip
from
the
init
container.
How
do
I
know
murbridge
is
working.
That's
actually
one
thing.
I've
heard
people
repetitively
asking
right
because,
especially
with
the
ip
table
rules
here
in
place,
can
you
quickly
tell
us
you
know?
What's
the
best
way,
if
you
have
anything,
you
want
to
show
feel
free.
B
B
And
next
we
can
like
try
to
enter
the
specific
pod
program
namespace
and
see
the
iptables
rules
with
mortgage
enabled.
We
will
see
that
the
steel
redirect
chain
will
not
be
increased,
but
without
mortgage
it
will
increase,
because
traffic
will
be
redirected
through
the
ip
tables
and
also
if,
if
we,
if
we
try
to
clean
up
all
of
the
ip
tables
rules
and
the
requests
can
be
still
re,
finished
and
redirected.
A
Okay,
great,
I
think
that's
the
key
thing
right.
It's
flash
the
ep
table
right
because
a
lot
of
us
have
performance
concerns
with
ip
tables,
especially
with
a
large
amount
of
services
and
the
ip
table
keep
growing.
So
yeah,
that's
exciting,
to
hear
you
know
flash
the
ip
tables.
You
know
you
we
can
continue
validate
murbridge
continue
working.
A
A
B
So
right
now
I
just
have
a
clean
kind
of
cluster
and
you
can
see
that
we
have
things
in
the
coop
system
and
also
we
have
holes
like
in
the
steel
seats
and
only
stealthy
and
the
ingress
gateway,
and
I'm
going
to
apply
the
the
murder
bridge.
So
we
only
need
to
apply.
These
is
one
yama
and
apply
our
resources,
and
here
it
creates
a
demon
set.
A
A
B
B
I
think
the
the
we
just
need,
like
the
raw,
the
pod
watch,
the
what
what
watch
law,
because
we
need
to
watch
that
which
parts
are
currently
in
the
node,
because
we
need
this
information
to
determine.
If
we
need
to
redirect
the
traffic,
because
if
the,
if
the
service
may
in
another
node,
then
we
cannot
redirect,
because
we
do
not
have
this
information
in
the
kernel
like
for
ebpf.
B
A
B
B
B
B
B
B
B
B
B
B
B
A
B
B
Maybe
do
another
one
each
time
you
will
show
the
redirect
log
here
and
also
when
I
try
to
look
at
the
ip
tables
again.
This
is
still
redirect
chain
where
not
did
not
increase,
and
here
I'll
do
a
thing
to
flash
all
the
ip
tables
rules
temporarily
save
your
tooth
10
max
and
I'll
just
clean
up
all
the
ip
tables
rules
and
see.
Currently
we
do
not
have
any
rules
right.
A
B
A
So
when
you
say
compatible,
that's
with
the
ip
table
rules
set
up
by
the
unit
container
along
with
murbridge,
so
they
coexist.
Okay,
can
you
explain
on
the
right
side?
You
have
two
terminals.
I
think
you,
you
were
typing
command
very
fast.
Can
you
explain
the
first
terminal
on
the
top
side,
the
cat
command,
which
log
are
you
trying
to
show?
I
assume
it's
some
ebtf
or
system
log,
okay,.
A
B
B
A
A
A
B
B
When
I
try
to
make
a
request
to
the
service,
you
still
will
redirect
the
traffic
to
the
proxy
inbound
by
applying
the
iptables
rules
and
in
the
in
the
evpf
scenario,
the
source
and
destination
information
are
stored
in
the
sock,
harsh
map
and
the
sidecar
will
see
the
information
with
the
source,
ip
address,
source
port
and
the
invoice
address,
and
the
invoice
inbound,
which
will
be
the
loopback
address
and
also
the
inbound
inbound
port.
I
think
it
should
be
1506
and
actually
it
still
requires
the
destination
address
to
be
determined
to.
B
B
B
So
here
is
also
the
the
code
like.
If
we
have
the
origin
information,
then
we're
gonna
send
it
to
the
socket
yep
and
here's
one
of
the
challenges
and
I'm
going
to
talk
about
one
more,
maybe
yeah.
This
is
a
quadruple
conflicts
and
we
we
solve
it
by
using
the
dynamic
ipl
location,
and
maybe
this
one
like
this
one
is
more
interesting
like
the
same
node
acceleration.
B
B
If
we
try
to
initiate
a
connection
and
redirect
it
to
the
nymph
ny
outbound
in
in
so
let
me
organize
if
we
try
to
initiate
a
connection
and
redirect
it
to
the
n-way
outbound
port,
the
original
destination
information
will
not
be
known
because
it's
not
saved
in
the
current
node
and
also
if
the
sidecar
is
trying
to
access
the
current
node.
The
redirection
should
be
disabled
to
prevent
the
recursive
calls
and
think
the
next
slide.
B
We
have
some
source
and
solutions
to
solve
this
challenge.
First,
we
will
add
a
small
control
plan
to
watch
all
the
parts
that
we
have
in
the
current
node
and
then
we
will
know
if
we
need
to
do
the
redirection
or
not,
and
then
we,
we
design
a
kind
of
like
a
feedback
mechanism
to
make
a
relation
between
the
current
process
and
its
ip
address.
For
the
first
time
the
sidecar
do
the
request.
A
A
B
A
A
B
I
think
modifying
estio
will
not
really
have
a
great
impact
to
our
project,
since
I
think
the
eco
c9
or
the
in
unit
container
or
doing
kind
of
like
the
similar
things
like
the
ip
tables
things
and
we
are
actually
not
using
ip
tables.
So
it
will
not
really
have
a
great
impact.
But
but
one
thing
is
like
maybe
modifying
the
envoy
and
improve
its
performance
will
be
helpful.
B
A
Okay,
we
also
have
another
question
from
world
jack
and
he
shared
with
me
on
linkedin
earlier,
so
he
certainly,
you
know,
tried
murbridge.
He
explored
the
murbridge
and
been
testing
it.
So
he
wants
to
ask:
is
murbridge
ready
for
production
from
your
perspective
or
you
know,
what's
your
guidance
on
that.
A
B
A
Yeah
we
can
send
that
to
the
chat
yeah,
maybe
in
the
show
notes
too
yeah
so
well.
I
guess
this
has
been
a
really
interesting
learning
experience
for
me
to
learn
murphrees
and
also
to
learn
a
little
bit
about
how
to
integrate
evpf
with
a
surface
mesh
like
istio.
So
I
want
to
take
a
minute
to
thank
you
sharper
and
also
kirby.
I
know
you've
been
silent
and
point
out:
hey
xiaomi,
you
need
to
add
the
namespace.
So
thank
you
guys,
because
this
is
almost
midnight
to
your
time.
A
So
we
really
really
appreciate
you
guys
pulling
time
forward
and
the
stand
up
at
night
of
your
time
to
do
this
hoot
with
us.
So
folks,
please
check
out
the
murbridge
project,
give
the
feedback.
I
engage
with
the
dark
cloud
team
and
if
you
guys
find
this
interesting,
you
know
feel
free
to
share
in
the
comments
and
the
chat
and
also
hit
the
like
button
and
subscribe
to
our
future
channel
subscribe
to
our
channel.