Envoy Mesh Acceleration: From Iptables to Fully BPF

This talk examines how iptables traffic redirection affects Envoy and container communication through eBPF sockmaps, then presents an approach that uses eBPF for inbound and outbound traffic without iptables. It also describes control-plane support for DaemonSet deployment and configuration.

Syllabus

Intro
Istio Architecture
Agenda
Pod Initialization
Iptables Rules
Traffic hijacking
Envoy VirtualOutbound
What is eBPF?
Cilium
eBPF Architecture
eBPF Hello World
TCP Inbound
eBPF Map
Smart DNS Proxying
UDP Outbound
Sockmap
eBPF Prog
Duplicate Sock Key
Linux kernel Patch
Deploy
Performance