eBPF-based CNI Implementation

eBPF-based CNI Implementation An architecture diagram generated by Archify. Kubernetes · container orchestration · Architecture component Kubernetes container orchestration Container Network Interface · CNI spec · Architecture component Container Network Interface CNI spec Cilium · CNI plugin · Architecture component Cilium CNI plugin eBPF · kernel programs · Architecture component eBPF kernel programs Linux Kernel · data path · Architecture component Linux Kernel data path Hubble · flow observability · Architecture component Hubble flow observability invokes CNI plugin implementation loads eBPF programs runs in kernel network flows Legend Observability Kubernetes / Cilium Interface / kernel

How Cilium Uses eBPF

  • • Network data path: processes and routes packets
  • • Policy enforcement: enforces network policies
  • • Load balancing: balances traffic for Services
  • • Observability: collects metrics on network flows

Key Features of eBPF

  • • In-kernel execution for high performance
  • • The verifier keeps programs from damaging the kernel
  • • Dynamic loading without a reboot
  • • Maps share data between user space and kernel space