Cilium   Container Security and Networking Using BPF and XDP
Channel: Sniper Network
Date: 01/08/2019

Software-defined networking (SDN) technology is an approach to network management that enables dynamic, programmatically efficient network configuration in order to improve network performance and monitoring making it more like cloud computing than traditional network management.SDN is meant to address the fact that the static architecture of traditional networks is decentralized and complex while current networks require more flexibility and easy troubleshooting. SDN attempts to centralize network intelligence in one network component by disassociating the forwarding process of network packets (data plane) from the routing process (control plane). The control plane consists of one or more controllers which are considered as the brain of SDN network where the whole intelligence is incorporated. However, the intelligence centralization has its own drawbacks when it comes to security, scalability and elasticity and this is the main issue of SDN. 
SDN was commonly associated with the OpenFlow protocol (for remote communication with network plane elements for the purpose of determining the path of network packets across network switches) since the latter's emergence in 2011. However, since 2012 OpenFlow for many companies is no longer an exclusive solution, they added proprietary techniques. These include Cisco Systems' Open Network Environment and Nicira's network virtualization platform. 




SD-WAN applies similar technology to a wide area network (WAN).
The Linux Foundation 
Published on Sep 15, 2017
Cilium - Container Security and Networking Using BPF and XDP - Thomas Graf, Covalent This talk introduces Cilium, a fast emerging open source project leveraging BPF to provide networking and security for containers. We will do a quick deep dive into BPF, possibly the most promising low level technology to address challenges in application and network security, networking, tracing, and visibility. We will discuss how BPF became capable of universally extending and instrumenting both the Linux kernel and user space applications. The introduction is followed by a concrete example of how the Cilium open source project applies BPF to solve networking, security, and load balancing for highly distributed applications. We will discuss how Cilium can be combined with orchestration systems such as Kubernetes to provide security and networking for cloud native applications. About Thomas Graf Thomas Graf has been a Linux kernel developer for 15 years, working on a variety of networking and security subsystems. His current focus is on BPF/XDP and how it can be applied to solve challenges of distributed applications. This includes providing secure networking with transparent encryption, application aware security, tracing, visibility, and mitigation of DDoS attacks. Thomas is a contributor to various open source projects including the Linux kernel, Cilium, Open vSwitch, Docker, and Kubernetes.
Category 
Science & Technology 
License 
Creative Commons Attribution license (reuse allowed)