2 minutes on Security: eBPF

Showing posts with label eBPF. Show all posts

Sunday, July 21, 2024

eBPF: The Secret Weapon for Achieving Network Performance Breakthroughs

I wrote an article about using eBPF based service-mesh in EKS ( eBPF with AWS ) The main benefit is in with high performance networking by shortening the network path . But How does it work ? How is it done otherwise ? Lets talk about it

How is it done traditionally ?

Service mesh uses Kube-Proxy that runs on every Node takes care of routing all the request from the Kubernetes nodes to the pod. It also takes care of service abstraction , and load balancing for all the pods that are part of the service .It uses Linux routing and updates the routing rules based on the pods deployed in the Node .When new service is created it updates the iptable rules to redirect traffic from the service Cluster IP to the backend pods.

So this is good what's the issue ?

Its the network path and latency associated with it. Also the updates that needs to be done in the iptables whenever pods get deployed /removed . eBPF allows packet processing directly in the linux kernel eliminating the need for packet-to-packet NAT transformation with iptables. eBPF can also optimize the service network and facilitate direct pod-to-pod communication without intermediate NAT processing

But what about TLS ?

Applications offload the network encryption requirements to the service mesh or the underlying network . Simply using transparent encryption ensures that the traffic is encrypted with in the cluster.Both IPSec and Wireguard are supported by Kubernetes networking by Cilium and Calico. There is also option to use TLS for initial certificate exchange and endpoint authentication , this way the application is used for identity rather than the node .

Containerization Github List -> Github Containers

eBPF with AWS

I have initially talked about eBPF and how it can be used for security tooling refer - ebpf. One of the main advantages is high performance networking you can see that Facebook adopted this in 2017. Performance being a main advantage there . Want to know how read here high-performance-networking

Cilium has worked on bringing the high performance networking to the Kubernetes service mesh and private setups have already started using it . But you are using Amazon EKS or other cloud provider you are also dealing with compatibility requirements as well . High performance networking is now part of AWS . If your application is using EKS there may be workloads that require high performance networking it's worth trying them out .

Why Sidecars are less favored ?

Sidecars was a way to include additional features with security tooling and observability but soon the resources become a concern . Sidecars consume additional CPU, memory, and network bandwidth, which can be significant, especially in large-scale deployments. Each sidecar runs as a separate container, which means more resources are required per pod

Step by Step instructions

https://github.com/aws-samples/cilium-service-mesh-on-eks

Sunday, June 18, 2023

eBPF: Redefining the Boundaries of Security, Networking, and Observability

eBPF is extended packet filter that is used to run custom code in the Kernel. Its used for monitoring and security tooling . But as I looked more into this the capabilities are much more than that.Lets see why ..

Everything goes through the Kernel !

All the apps , irrespective of if its a docker container , host program or AWS lambda needs to run in the Kernel . Anything to do with the Network , Files , Processes and Memory are handled by the Kernel . So it provides a single point to add a global capability rather than in the application or a specific to implementation e.g k8s service mesh

How does it run ?

Runs in user space , eBPF has helper functions to integrate with kernel . kprobe ( Kernel Probe) allows to attach the custom functionality to System calls

How does program Interface ?

Helper functions facilitated by kernel probe helps to read data back . Data structures such as BPF maps and Hash table maps are also used to store data that can be also used for integrating with other BPF programs

How is it powerful ?

No need to restart , redeploy the apps . You get the benefits immediately

Where else its used ?

Katran uses it for high performance load balancer . Used by FB since 2017 ( https://engineering.fb.com/2018/05/22/open-source/open-sourcing-katran-a-scalable-network-load-balancer/ ) on a side note , the service mesh model used by Containers may not be performant as it needs to access network layer often .

K8s using side cars may not cover all the applications in organization . eBPF can solve the problem since everything needs to go through the

Where else it can be used ?

Used for Monitoring , Security tooling and High performance networking . It can be much more effective in reducing the number of calls when compared to sidecars used in container security .

Root User?

Need to have sudo access to setup and run the eBPF modules.New permissions introduced in kernel 5.3 for specific permissions with respect to running eBPF

CAP_BPF
CAP_PERFMON
CAP_NET_ADMIN

Perfmon and bpd are required for tracking NetAdmin and Bpf privileges are required for networking

What about Kernel upgrades?

Kernel upgrades are usually backward compatible , and don't change that often . Also the latest versions add more capabilities to eBPF .

SecComp

Secure computing is a module that is used to run the kernel in a strict and restrictive mode . It a utility powered by eBPF that limits the set of instructions that can be performed by kernel . This allows the user to run untrusted code

Systracking

Falco is setup in all kernels and has configs that are used to enable and configure the eBPF programs. User will be able to leverage the capabilities without using the eBPF code . LSM hooks LSM hooks can also be used to track the system calls. As the linux upgrades are backward compatible And not much has been altered over the years .Its relatively safe to use the hooks for security tooling