eBPF - Kubernetes Network Security without the Blind Sides!
Nov 30, 2023
auto_awesome
The podcast explores the challenges of network security in managed Kubernetes environments and the benefits of using tools like eBPF and Cilium. It discusses the initial approach to networking in Kubernetes and the need for the next generation of networking tools. The chapter also explores how eBPF revolutionized the kernel field and the network security capabilities of Cilium. It discusses the process of graduating a project within the CNCF and the importance of having a company backing an open source project. The speakers engage in a light-hearted conversation, sharing their personal interests and aspirations.
Cilium, an open-source project developed by Isovalent, provides comprehensive network security solutions for Kubernetes deployments, addressing limitations in built-in security capabilities.
The graduation of Cilium as a Cloud Native Computing Foundation (CNCF) project signifies its maturity and recognition, with widespread adoption by cloud service providers and essential functionalities in Kubernetes deployments.
Deep dives
The Importance of Network Security in Kubernetes
In this podcast episode, Thomas Graf, the CTO of Isogueland, discusses the significance of network security in the context of Kubernetes. He highlights the limitations of the built-in network security capabilities of managed Kubernetes environments and introduces the open-source project called Selium, which was developed by Isogueland. Graf explains that Selium offers solutions for network segmentation, encryption, and mutual authentication, providing a more comprehensive and identity-based approach to network security. He also emphasizes the need for organizations to integrate their Kubernetes infrastructure with existing on-premise or cloud-based networks, and how Selium's egress gateway simplifies this process. Overall, the episode emphasizes the importance of considering network security as an essential component of Kubernetes deployments.
Graduation of Selium as a CNCF Project
The podcast also touches on the graduation of Selium as a Cloud Native Computing Foundation (CNCF) project. The graduation process involves demonstrating the project's production use cases, undergoing security audits, ensuring open governance, and receiving a vote from the CNCF Technical Oversight Committee (TOC). With its graduation, Selium has reached a higher level of maturity and recognition. It is widely adopted by cloud service providers, such as Azure, GKE, and EKS, and is used for essential functionalities like network segmentation, encryption, and observability in Kubernetes deployments.
Building an Open-Source Business Model
Thomas Graf discusses the challenges and considerations of building an open-source business model. He emphasizes the importance of being fully committed to open source and ensuring that it is a core value of the company. Graf also highlights the need for transparency and clarity regarding the company's commitment to open source, as well as the added value and support that the company can provide to users of the open-source project. By building trust and offering additional services, a company can successfully complement an open-source project and provide users with faster platform development, support, and bug fixing.
eBPF is recent graduate in the CNCF family and this means that the world of Cloud and Kubernetes, networking looks very different with more security capabilities. Cilium the project from Isovalent has been gaining traction for network security for kubernetes as blindsides have been called out in the managed kubernetes deployments. This episode was recorded at KubeCon NA with Thomas Graf from Isovalent to share what the blindsides are and why eBPF provides better network security capability for kubernetes deployments of any scale.