Cilium leaves incubator, gets the nod from Cloud Native Computing Foundation
- Reference: 1697104989
- News link: https://www.theregister.co.uk/2023/10/12/cilium_graduated/
- Source link:
Cilium started as an eBPF-based implementation of the Container Networking Interface (CNI) to provide connectivity for container workloads. In the years since development kicked off, it has grown to add capabilities such as bandwidth management, BGP, and network encryption. It also encompasses the sub-projects Hubble and Tetragon, which focus on network observability and security observability, respectively.
The graduation nod means that the project has made it through a due diligence process with the CNCF technical oversight committee and completed a third-party security audit. It has also driven the process to allow CNCF projects to include GPL-licensed eBPF code to run in the kernel.
[1]
"eBPF has grown into a powerful technology for extending the Linux kernel to meet a variety of use cases," said Chris Aniszczyk, CTO of CNCF. "Cilium and the modern eBPF stack will help shape the future of cloud native networking and observability. Cilium has demonstrated really impressive growth in its nearly two years in the Incubator, and we're excited to watch as the ecosystem continues to push the benefits of eBPF even further."
[2]
[3]
eBPF allows code to be run in a privileged context – in the operating system kernel. It allows for extending the kernel's capabilities without requiring changes to the kernel itself. Security is via a verifier to check that the code won't interfere negatively with the kernel.
Intel fellow, Brendan Gregg, famously referred to the technology as a [4]superpower for Linux . [5]eBPF is also on its way into the Windows environment .
[6]
Initially created by Isovalent, Cilium joined the ranks of incubating CNCF projects in 2021 and is the second most CNCF project in terms of commits - behind only Kubernetes. It now has maintainers from seven different companies and over 800 individual contributors.
[7]Long-term support for Linux kernels is about to get a lot shorter
[8]The next deep magic Linux program to change the world? Io_uring
[9]Why securing East-West network traffic is so important – and how it can be done
[10]Zero Trust: What does it actually mean – and why would you want it?
"Graduation is not the end goal," noted the CNCF, "but rather the beginning of creating the ecosystem around Cilium."
Tim Hockin, distinguished software engineer at Google Cloud, said: "From the earliest days of Kubernetes, we knew that a thriving ecosystem was a critical ingredient, and Cilium is perhaps the most visible demonstration of this. Cilium taps into the power and excitement of eBPF to super-charge Kubernetes networking.
"While it may have started as 'just a network plugin', Cilium has evolved into much more than that, with a broad feature set which speaks to many types of users from startups to major enterprises. I'm thrilled to see Cilium be successful – it's really a win for Kubernetes users everywhere." ®
Get our [11]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/networks&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZSgYJprIIFjwtG3H24kXuAAAAI8&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/networks&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZSgYJprIIFjwtG3H24kXuAAAAI8&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/networks&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZSgYJprIIFjwtG3H24kXuAAAAI8&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://www.brendangregg.com/blog/2016-03-05/linux-bpf-superpowers.html
[5] https://github.com/Microsoft/ebpf-for-windows
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/networks&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZSgYJprIIFjwtG3H24kXuAAAAI8&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2023/09/26/linux_kernel_report_2023/
[8] https://www.theregister.com/2022/09/16/column/
[9] https://www.theregister.com/2023/08/16/datacenter_east_west_security/
[10] https://www.theregister.com/2022/06/30/zero_trust_expectations/
[11] https://whitepapers.theregister.com/
Re: So, what is it?
It allows developers to write custom code that can be loaded into the Linux kernel dynamically, changing the way the kernel behaves. Useful for observability, high-performance networking, and detecting and preventing malicious activity. There is a verification process that keeps it safe by checking every possible path through the program and every instruction is safe - done at the byte code level.
It’s actually pretty cool particularly given the utter impossibility of getting changes into the Kernel proper.
There’s a good, easy explanation here:
https://blog.container-solutions.com/how-ebpf-enables-cloud-native-innovation
Liz Rice’s book “Learning eBPF” is the best longer resource I know of should you want to learn it - short and well written.
Re: So, what is it?
Thanks, that's interesting. I was also looking at this, which is a specific implementation of Ambient Mesh in Istio.
https://istio.io/latest/blog/2022/introducing-ambient-mesh/
I can see that these things are going to be really useful for me as a DevOps Engineer (mTLS, Logging, Observability, Layer 7 routing, circuit breaking, etc.*), however I see myself as a user of them rather than a developer. For instance, years back when I got to benefit(?) from the latest SE Linux changes (like switching it on), I didn't then go and learn about the C code which has made that extra work for me, ahem, I mean extra security.
* You get all that with Istio anyway, but by using eBPF they can do it quicker and without sidecars.
Also, when I say "dangerous" I'm not talking about breaking the kernel, but I'm more worried about traffic leaking or perhaps just flooding my network with traffic, or something I haven't thought of yet. It makes supplier chain attacks harder to detect, or could make some really weird bugs.
So, what is it?
I've been hearing the hype about eBPF for some time now on various blogs and podcasts and have never actually quite figured out what it is, and why I need to know about it.
I'm guessing it can mess with traffic at the kernel level, which seems kind of dangerous. As a sysadmin / DevOps / SRE (or whatever they are calling it this week) is this something I need to go off and learn more about now, or should I leave that for the likes of Red Hat or Google who like to mess around at this level, and I'll just magically benefit somehow?
Can someone explain it in words that a lazy thicko DevOps engineer can understand? (I tried to do a little reading and just got totally lost in what seemed like marketing hype).
In the words of a famous Cat "So, what is it?"