Summit
2020

• Differences in some network related BPF programs
• Extend RedBPF to support building tc_cls_act BPF programs
• Build a stateful BPF program using maps
• Test things out and drawbacks...

In this session we will cover the design an implementation of a Ruby profiler & tracer that runs in the BPF runtime. We will go through what advantages – such as being low-overhead and requiring no code modification – and tradeoffs a BPF profiler offers…

You've written some incredibly sophisticated BPF, and it works on your laptop. Now what? I'll show you how to use bpf2go to embed your BPF in a Go binary for maximum ease of use.

Cilium has been widely used in modern Cloud Native developing. This talk will introduce the status of Cilium on the Arm64 platform and its future work; we're excited to start the journey of Cilium Arm64 support in Cilium v1.8: fixed compilation and runtime...

Traditional network-layer tools based on only IP addresses and ports are severely limited when it comes to threat detection and incident investigation in cloud-native environments like Kubernetes. They are facing with the challenge that workloads are containerized...

In this lightning talk I will present how to integrate custom BCC tools and bpftrace scripts to gather eBPF metrics and integrate them into the Performance Co-Pilot performance analysis toolkit. By integrating them into PCP, users can configure logging, alerting...

eBPF was born for networking, and it shows! The ability to access, modify and drop in-flight packets is just one of the many eBPF superpowers. But how are packet operations different from file I/O, and why is it relevant to answer this question now?...

While working with eBPF it can happen that after successfully compiling your program you find yourself in a situation where the program can't be loaded in the kernel and bpf_prog_load just result in an error. The error can be either a verifier error or...

MasMovil is the fourth telecom provider in Spain with 10M customers and also provides communication to more than 700 local telco providers as a wholesale service.

A cloud native stack is orchestrated by Kubernetes using Google’s GKE managed service with...

In Linux v5.9 we have introduced a new type of BPF hook for attaching BPF programs to L4 socket lookup, specifically to listening socket lookup for TCP, and to unconnected socket lookup for UDP.

The user-provided BPF socket lookup program looks at the pac...

After years working with cloud environments, having seen born microservices architectures, DevOps paradigm, and recent observability with the era of applications instrumentation, you know eBPF is the next big thing and you’ve heard it all: performance opti...

In this talk, Vlad will present the reasons Palantir choose Cilium as their CNI plugin for their ephemeral Kubernetes infrastructure, how their InfoSec team uses Hubble for monitoring workloads, and their future plans for injecting authentication material...

eBPF is transitioning from an in-kernel monitoring engine to a powerful platform for the development of complex services. In the security space, the Linux 5.8 addition of the KRSI framework is a prime example of this paradigm shift, enabling users to write...

In this talk we present how we use eBPF to trace container images in a sandbox, in order to detect malicious behavior that might appear later at runtime. We will present an open source tool that we have built for that task, and how we analyze the system le...

Okteto Cloud is a developer platform, powered by Kubernetes. The biggest benefit that our users get from our platform is the ability to easily deploy any type of workload with one click. A group of Crypto Bandits discovered us, and decided to set up camp o...

Datadog deploys eBPF code to our agents at scale. Our customers expect a minimal CPU footprint across releases. Join us to discover how we measure eBPF CPU overhead across multiple platforms and operating systems. You’ll see a demo Go library, demonstratin...

twagent is a daemon that runs on every Facebook server and manages Facebook containers.

BPF, and more specifically cgroup-bpf, has been in heavy use by twagent for 2.5 years providing solutions for use-cases such as container IP assignment, topology-aware...

Hardware breakpoint is an interesting feature, known as memory breakpoint provides an elegant mechanism to monitor memory access or instruction executions. Such monitoring is vital in debugging the system for data corruption. It can be used to understand...

Kubernetes service load balancing has relied far too long on netfilter and iptables - two technologies which carry legacy accumulated over 20 years of development grounded in a more traditional networking environment that is typically far smaller...

LINE is one of the most famous messaging services in Asian countries like Japan, Taiwan, Thailand, and Indonesia, accommodating 185 million global MAU and 3Tbps+ network traffic in total.

In this talk, we'll introduce two topics regarding eBPF at LINE's OpenStack-based private cloud infrastructure...

In this talk, we will use BPF to trap the data produced by the system events generated by execution of binaries and process them to build information and represent the information contextually to build a Knowledge graph. Knowledge Graph brings the ability...

Learn how to leverage GitLab's integrations with Cilium and Falco to harden your Kubernetes cluster and protect against security threats.

When we were building our Kubernetes based Platform as a Service for multiple teams, we had to ensure that our platform aligned with our company's security policies, could scale to meet our customer base, minimized additional overhead, and continued to dri...