From 40eff4ec52664237d53a336535a519ccd1acda54 Mon Sep 17 00:00:00 2001 From: Nicholas Dille Date: Wed, 3 May 2023 00:10:26 +0200 Subject: [PATCH] Final slides for 20230503 --- 120_kubernetes/cilium/agents.drawio.svg | 81 +++++++++ 120_kubernetes/cilium/hubble.drawio.svg | 155 ++++++++++++++++ 120_kubernetes/cilium/hubble.md | 18 +- 120_kubernetes/cilium/monitoring.demo | 4 - 120_kubernetes/cilium/monitoring.md | 4 +- 120_kubernetes/cilium/network_policy.demo | 15 +- .../cilium/network_policy.drawio.svg | 169 ++++++++++++++++++ 120_kubernetes/cilium/network_policy.md | 26 ++- 120_kubernetes/cilium/slides.md | 30 +++- 120_kubernetes/dns/slides.md | 6 - 120_kubernetes/network/overlay.md | 6 +- .../network_policy/network_policy.demo | 22 ++- .../network_policy/network_policy.drawio.svg | 55 +----- 120_kubernetes/network_policy/slides.md | 14 +- ...ise-Webinar-KubernetesNetworkPolicies.html | 15 ++ 15 files changed, 532 insertions(+), 88 deletions(-) create mode 100644 120_kubernetes/cilium/agents.drawio.svg create mode 100644 120_kubernetes/cilium/hubble.drawio.svg delete mode 100644 120_kubernetes/cilium/monitoring.demo create mode 100644 120_kubernetes/cilium/network_policy.drawio.svg diff --git a/120_kubernetes/cilium/agents.drawio.svg b/120_kubernetes/cilium/agents.drawio.svg new file mode 100644 index 0000000..e6ac31b --- /dev/null +++ b/120_kubernetes/cilium/agents.drawio.svg @@ -0,0 +1,81 @@ + + + + + + + +
+
+
+ Node1 +
+
+
+ + + Node1 + + + + + + + +
+
+
+ Node2 +
+
+
+ + + Node2 + + + + + + + +
+
+
+ cilium-agent +
+
+
+ + + cilium-agent + + + + + + + +
+
+
+ cilium-agent +
+
+
+ + + cilium-agent + + + + + + + + + Text is not SVG - cannot display + + + + \ No newline at end of file diff --git a/120_kubernetes/cilium/hubble.drawio.svg b/120_kubernetes/cilium/hubble.drawio.svg new file mode 100644 index 0000000..e697362 --- /dev/null +++ b/120_kubernetes/cilium/hubble.drawio.svg @@ -0,0 +1,155 @@ + + + + + + + +
+
+
+ Node1 +
+
+
+ + + Node1 + + + + + + + +
+
+
+ Node2 +
+
+
+ + + Node2 + + + + + + + +
+
+
+ cilium-agent +
+
+
+ + + cilium-agent + + + + + + + +
+
+
+ cilium-agent +
+
+
+ + + cilium-agent + + + + + + + +
+
+
+ hubble server +
+
+
+ + + hubble se... + + + + + + + +
+
+
+ hubble server +
+
+
+ + + hubble se... + + + + + + + + + + + +
+
+
+ hubble-relay +
+
+
+ + + hubble-relay + + + + + + + + + +
+
+
+ hubble-ui +
+
+
+ + + hubble-ui + + + + + + + + + Text is not SVG - cannot display + + + + \ No newline at end of file diff --git a/120_kubernetes/cilium/hubble.md b/120_kubernetes/cilium/hubble.md index 391c1b4..4110587 100644 --- a/120_kubernetes/cilium/hubble.md +++ b/120_kubernetes/cilium/hubble.md @@ -1,9 +1,23 @@ ## Hubble +![](120_kubernetes/cilium/hubble.drawio.svg) + Observability for network flows [](https://docs.cilium.io/en/stable/gettingstarted/hubble/) +Agents include Hubble server + +Hubble relay collects flow info from agents + Trace flows on the console using `hubble` CLI -Trace flows in the web UI +Trace flows in the Hubble (web) UI + +Costs up to 15% performance + +### Demo [](https://github.com/nicholasdille/container-slides/blob/master/120_kubernetes/cilium/hubble.demo "hubble.demo") + +Check flows from previous demos + +Check service map -### Demo [](https://github.com/nicholasdille/container-slides/blob/master/120_kubernetes/cilium/hubble.demo "hubble.demo") \ No newline at end of file +Filter flows \ No newline at end of file diff --git a/120_kubernetes/cilium/monitoring.demo b/120_kubernetes/cilium/monitoring.demo deleted file mode 100644 index 1730c10..0000000 --- a/120_kubernetes/cilium/monitoring.demo +++ /dev/null @@ -1,4 +0,0 @@ -# Cilium Monitoring - -# XXX -# \ No newline at end of file diff --git a/120_kubernetes/cilium/monitoring.md b/120_kubernetes/cilium/monitoring.md index 637759e..e7a4ee3 100644 --- a/120_kubernetes/cilium/monitoring.md +++ b/120_kubernetes/cilium/monitoring.md @@ -2,7 +2,9 @@ OpenMetrics are exposed -Several dashboard for Grafana are offers [](https://grafana.com/grafana/dashboards/?search=Cilium) +Several dashboard for Grafana are offered [](https://grafana.com/grafana/dashboards/?search=Cilium) + +Metrics reference [](https://docs.cilium.io/en/stable/observability/metrics/#metrics-reference) ### Demo [](https://github.com/nicholasdille/container-slides/blob/master/120_kubernetes/cilium/monitoring.demo "monitoring.demo") diff --git a/120_kubernetes/cilium/network_policy.demo b/120_kubernetes/cilium/network_policy.demo index fe137a8..d1f54f6 100644 --- a/120_kubernetes/cilium/network_policy.demo +++ b/120_kubernetes/cilium/network_policy.demo @@ -96,16 +96,26 @@ EOF # Check pods and services kubectl --namespace test1 get all kubectl --namespace test2 get all +kubectl --namespace test3 get all # Test IP connectivity between test1 and test2 TEST1_IP="$(kubectl --namespace test1 get pod web -o json | jq --raw-output '.status.podIP')" TEST2_IP="$(kubectl --namespace test2 get pod web -o json | jq --raw-output '.status.podIP')" +TEST3_IP="$(kubectl --namespace test3 get pod web -o json | jq --raw-output '.status.podIP')" kubectl --namespace test1 exec -it web -- curl -s "http://${TEST2_IP}" +kubectl --namespace test1 exec -it web -- curl -s "http://${TEST3_IP}" kubectl --namespace test2 exec -it web -- curl -s "http://${TEST1_IP}" +kubectl --namespace test2 exec -it web -- curl -s "http://${TEST3_IP}" +kubectl --namespace test3 exec -it web -- curl -s "http://${TEST1_IP}" +kubectl --namespace test3 exec -it web -- curl -s "http://${TEST2_IP}" # Test connectivity using DNS between test1 and test2 kubectl --namespace test1 exec -it web -- curl -s http://web.test2 +kubectl --namespace test1 exec -it web -- curl -s http://web.test3 kubectl --namespace test2 exec -it web -- curl -s http://web.test1 +kubectl --namespace test2 exec -it web -- curl -s http://web.test3 +kubectl --namespace test3 exec -it web -- curl -s http://web.test1 +kubectl --namespace test3 exec -it web -- curl -s http://web.test2 # Check correct cilium-agent NODE="$(kubectl --namespace test1 get pod web --output json | jq --raw-output '.spec.nodeName')" @@ -260,7 +270,4 @@ spec: - ports: - port: "80" protocol: TCP -EOF - -# XXX cluster-wide -# \ No newline at end of file +EOF \ No newline at end of file diff --git a/120_kubernetes/cilium/network_policy.drawio.svg b/120_kubernetes/cilium/network_policy.drawio.svg new file mode 100644 index 0000000..5df7ff2 --- /dev/null +++ b/120_kubernetes/cilium/network_policy.drawio.svg @@ -0,0 +1,169 @@ + + + + + + + +
+
+
+ Namespace "test1" +
+
+
+ + + Namespace "test1" + + + + + + + +
+
+
+ Pod "web" +
+
+
+ + + Pod "web" + + + + + + + +
+
+
+ Svc "web" +
+
+
+ + + Svc "web" + + + + + + + +
+
+
+ Namespace "test2" +
+
+
+ + + Namespace "test2" + + + + + + + +
+
+
+ Pod "web" +
+
+
+ + + Pod "web" + + + + + + + +
+
+
+ Svc "web" +
+
+
+ + + Svc "web" + + + + + + + +
+
+
+ Namespace "test3" +
+
+
+ + + Namespace "test3" + + + + + + + +
+
+
+ Pod "web" +
+
+
+ + + Pod "web" + + + + + + + +
+
+
+ Svc "web" +
+
+
+ + + Svc "web" + + + + + + + + + + + + Text is not SVG - cannot display + + + + \ No newline at end of file diff --git a/120_kubernetes/cilium/network_policy.md b/120_kubernetes/cilium/network_policy.md index 56550c9..03b6874 100644 --- a/120_kubernetes/cilium/network_policy.md +++ b/120_kubernetes/cilium/network_policy.md @@ -12,4 +12,28 @@ Deny policies [](https://docs.cilium.io/en/stable/security/policy/language/#deny Host policies [](https://docs.cilium.io/en/stable/security/policy/language/#host-policies) -### Demo [](https://github.com/nicholasdille/container-slides/blob/master/120_kubernetes/cilium/network_policy.demo "network_policy.demo") \ No newline at end of file +--- + +### Demo [](https://github.com/nicholasdille/container-slides/blob/master/120_kubernetes/cilium/network_policy.demo "network_policy.demo") + +![](120_kubernetes/cilium/network_policy.drawio.svg) + +Check endpoints in cilium agent + +Check dropped packets + +### Egress + +Allow DNS from `test1` + +Allow HTTP from `test1` to `test2` + +### Ingress + +Allow HTTP from `test2` to `test3` + +Filter based on HTTP info + +### Other + +Filter DNS requests \ No newline at end of file diff --git a/120_kubernetes/cilium/slides.md b/120_kubernetes/cilium/slides.md index 52ad8e7..1e14616 100644 --- a/120_kubernetes/cilium/slides.md +++ b/120_kubernetes/cilium/slides.md @@ -1,21 +1,37 @@ ## Cilium -CNI plugin +![](images/cilium.svg) -Based on eBPF [](https://ebpf.io/) +CNI plugin based on eBPF [](https://ebpf.io/) CNCF incubation project [](https://www.cncf.io/projects/cilium/) -### Features - -Ingress Controller (using Envoy [](https://www.envoyproxy.io/)) +### Additional Features Network Policy kube-proxy replacement -Hubble for observability +Hubble for visibility + +Metrics for observability Multi-cluster connectivity -Service Mesh \ No newline at end of file +Service Mesh + +CNI chaining for policy features on top of other CNI plugins, e.g. AWS VPC CNI + +--- + +## Cilium Internals + +![](120_kubernetes/cilium/agents.drawio.svg) + +Cilium agent manages the network + +All pods are an endpoint + +Endpoints are assigned an identity + +Identities have labels to describe them \ No newline at end of file diff --git a/120_kubernetes/dns/slides.md b/120_kubernetes/dns/slides.md index 4159e81..36bb17d 100644 --- a/120_kubernetes/dns/slides.md +++ b/120_kubernetes/dns/slides.md @@ -14,12 +14,6 @@ Add DNS server for custom domains [](https://coredns.io/2017/05/08/custom-dns-en --- -## Demo - -XXX https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config - ---- - ## Services Internals 1/ Services hide infrastructure diff --git a/120_kubernetes/network/overlay.md b/120_kubernetes/network/overlay.md index 32f35ca..562f56b 100644 --- a/120_kubernetes/network/overlay.md +++ b/120_kubernetes/network/overlay.md @@ -16,4 +16,8 @@ Host uses source network address translation (SNAT) Source IP is replaced by host IP -New source port is selected for mapping to pod \ No newline at end of file +New source port is selected for mapping to pod + +Mapping table for connections is maintained + +Response packets are translated back \ No newline at end of file diff --git a/120_kubernetes/network_policy/network_policy.demo b/120_kubernetes/network_policy/network_policy.demo index 8682a88..2eabf2e 100644 --- a/120_kubernetes/network_policy/network_policy.demo +++ b/120_kubernetes/network_policy/network_policy.demo @@ -78,19 +78,30 @@ kubectl --namespace test2 exec -it web -- curl -s "http://${TEST1_IP}" kubectl --namespace test1 exec -it web -- curl -s http://web.test2 kubectl --namespace test2 exec -it web -- curl -s http://web.test1 -# Create network policy +# Create deny network policy cat < + @@ -103,60 +103,7 @@ - - - - -
-
-
- Namespace "test3" -
-
-
- - - Namespace "test3" - - - - - - - -
-
-
- Pod "web" -
-
-
- - - Pod "web" - - - - - - - -
-
-
- Svc "web" -
-
-
- - - Svc "web" - - - - - diff --git a/120_kubernetes/network_policy/slides.md b/120_kubernetes/network_policy/slides.md index c2a8d63..78b11bb 100644 --- a/120_kubernetes/network_policy/slides.md +++ b/120_kubernetes/network_policy/slides.md @@ -6,13 +6,13 @@ Must be implemented by CNI plugin ### Resource `NetworkPolicy` -Allow all trafic without policies +Allow all traffic without policies Deny by default when a policy exists Policies only allow traffic -Supports layer 3 and 4 +Supports layer 3 and layer 4 There is an editor [](https://editor.networkpolicy.io) @@ -60,6 +60,12 @@ Based on eBPF [](https://ebpf.io/) with extended network policies [](https://doc ![](120_kubernetes/network_policy/network_policy.drawio.svg) -Filter connections between them +Filter connections between pods -XXX \ No newline at end of file +### Egress + +Control HTTP from `test1` to `test2` + +Requires DNS to work + +Enable access to Kubernetes API \ No newline at end of file diff --git a/2023-05-03_heise-Webinar-KubernetesNetworkPolicies.html b/2023-05-03_heise-Webinar-KubernetesNetworkPolicies.html index 2c0689b..8488864 100644 --- a/2023-05-03_heise-Webinar-KubernetesNetworkPolicies.html +++ b/2023-05-03_heise-Webinar-KubernetesNetworkPolicies.html @@ -85,6 +85,8 @@ Isolate team resources +Understand communication + Prevent apps from calling home @@ -127,8 +129,21 @@ - No audit to understand network traffic - Network policies allow traffic explicitly - Cilium provides valuable features +- eBPF enables fast, low-overhead CNI plugin +- Cross-node flow visualization with Hubble +- Integrated observability + +Cilium Performance Benchmark [](https://docs.cilium.io/en/stable/operations/performance/benchmark/) + + +