0

Production ready eBPF, or how we fixed the BSD socket API

As we develop new products, we often push our operating system - Linux - beyond what is commonly possible. A common theme has been relying on eBPF to build technology that would otherwise have required modifying the kernel. For example, we’ve built DDoS mitigation and a load balancer and use it to monitor our fleet of servers.

This software usually consists of a small-ish eBPF program written in C, executed in the context of the kernel, and a larger user space component that loads the eBPF into the kernel and manages its lifecycle. We’ve found that the ratio of eBPF code to userspace code differs by an order of magnitude or more. We want to shed some light on the issues that a developer has to tackle when dealing with eBPF and present our solutions for building rock-solid production ready applications which contain eBPF.

For this purpose we are open sourcing the production tooling we’ve built for the sk_lookup hook we contributed to the Linux kernel, called tubular. It exists because we’ve outgrown the BSD sockets API. To deliver some products we need features that are just not possible using the standard API.

• Our services are available on millions of Continue reading

0

Combating Increased Complexity

Organizations need an enterprise-wide data and observability strategy, and standardization of visibility to combat the complexity of the digital world.

0

Using cert-manager with Kuma for mTLS

When configuring mutual TLS (mTLS) on the open source Kuma service mesh, users have a couple of different options. They can use a “builtin” certificate authority (CA), in which Kuma itself will generate a CA certificate and key for use in creating service-specific mTLS certificates. Users also have the option of using a “provided” CA, in which they must supply a CA certificate and key for Kuma to use when creating service-specific mTLS certificates. Both of these options are described on this page in the Kuma documentation. In this post, I’d like to explore the use of cert-manager as a “provided” CA for mTLS on Kuma.

Currently, Kuma lacks direct integration with cert-manager, so the process is a bit more manual than I’d prefer. If direct cert-manager integration is something you’d find useful, please consider opening an issue to that effect on the Kuma GitHub repository.

Assuming you have cert-manager installed already, the process for using cert-manager as the CA for a “provided” CA mTLS backend looks like this:

1. Define the root CA in cert-manager.
2. Prepare the secrets for Kuma.
3. Configure the Kuma mesh object for mTLS.

I know these steps are really too high level to be useful Continue reading

0

DEVASC Study Resources and Plan

0

How to Pass DEVASC

0

What is DEVASC

0

Who is Squatting IPv4 addresses?

Who is Squatting IPv4 addresses?

It’s an established fact on the internet that we have ran out of IP(v4) addresses, and we are st

0

Who is squatting IPv4 addresses?

Who is squatting IPv4 addresses?

It’s an established fact on the internet that we have ran out of IP(v4) addresses, and we are st

0

The Impact of Jumbo Maximum Frame Size on Data Center Switches

Sander Steffann sent me an intriguing question a long while ago:

I was wondering if there are any downsides to setting “system mtu jumbo 9198” by default on every switch? I mean, if all connected devices have MTU 1500 they won’t notice that the switch could support longer frames, right?

That’s absolutely correct, and unless the end hosts get into UDP fights things will always work out (aka TCP MSS saves the day)… but there must be a reason switching vendors don’t use maximum frame sizes larger than 1514 by default (Cumulus Linux seems to be an exception, and according to Sébastien Keller Arista’s default maximum frame size is between 9214 and 10178 depending on the platform).

0

The Impact of Jumbo Maximum Frame Size on Data Center Switches

Sander Steffann sent me an intriguing question a long while ago:

I was wondering if there are any downsides to setting “system mtu jumbo 9198” by default on every switch? I mean, if all connected devices have MTU 1500 they won’t notice that the switch could support longer frames, right?

That’s absolutely correct, and unless the end hosts get into UDP fights things will always work out (aka TCP MSS saves the day)… but there must be a reason switching vendors don’t use maximum frame sizes larger than 1514 by default (Cumulus Linux seems to be an exception, and according to Sébastien Keller Arista’s default maximum frame size is between 9214 and 10178 depending on the platform).

0

Cisco faces a $14B backlog thanks to component scarcity

Cisco, like many of its competitors, has found increased revenue from pent-up demand, but chip shortages and other supply constraints continue to loom large over the industry.“We remain one of the largest software companies in the world,” Cisco CEO Chuck Robbins told investment analysts on an earnings call for its fiscal second quarter ended in January. "In Q2, our software revenue grew by 6% to $3.8 billion, total subscription revenue accelerated to $5.5 billion, up 7% year over year."To read this article in full, please click here

0

CIsco faces a $14B backlog thanks to component scarcity

Cisco, like many of its competitors, has found increased revenue from pent-up demand, but chip shortages and other supply constraints continue to loom large over the industry.“We remain one of the largest software companies in the world,” Cisco CEO Chuck Robbins told investment analysts on an earnings call for its fiscal second quarter ended in January. "In Q2, our software revenue grew by 6% to $3.8 billion, total subscription revenue accelerated to $5.5 billion, up 7% year over year."To read this article in full, please click here

0

Data-center spending is half that of cloud services

Spending on cloud services reached a total of $178 billion in 2021, a 37% increase over the $130 billion spent in 2020 and twice the amount enterprises are spending on their data centers, according to Synergy Research Group. For the fourth quarter of 2021, total cloud spending was $50.5 billion.When the COVID-19 pandemic hit in 2020, it drove a major shift in worldwide IT operational and spending to the cloud as company shifted to working from home. That trend is only continuing, even with the pandemic tapering off and companies calling people back into the office.John Dinsdale, principal analyst with Synergy, said he expects the cloud market to continue to grow at the considerable pace. “There is absolutely no doubt that the cloud market will continue to grow rapidly. That is an environment in which leading cloud providers ought to be able to continue aggressively growing their revenues,” he said via email.To read this article in full, please click here

0

How To Pass Environment Variables To A Remote SSH Deployment With PyCharm

I pass access tokens, authentication keys, and other secrets to Python scripts via environment variables rather than encode these values into the scripts themselves. If I was a real boy, I’d use a solution like Hashicorp Vault or other secrets management tool (there’s a bunch of them), but I haven’t yet found the motivation to learn such a tool.

I’m not sure I’d want to build and maintain such a tool if I did find the motivation. I’m sort of lazy sometimes is what I’m saying. So for now, environment variables it is.

PyCharm allows for the passing of environment variables from the IDE to a script, whether that script is running locally or in a remote SSH deployment you’ve configured for your project.

To set the environment variables, select Edit Configurations from the Run menu.

Or in the project bar above the code window, click the dropdown with your script name, and select Edit Configurations.

Either way brings up the following configuration window for the scripts in your project. In the Environment variables: field, click the icon.

That will bring up the following window you can use to configure the environment variables.

Fantastic. But how do we assign the Continue reading

0

Hedge 118: Integrating New Ideas with William Collins

When vendors build something new—or when you decide to go a different direction in your network—you have to figure out how to integrate these new things. Integration of this type often includes cultural, as well as technical, changes. William Collins joins Tom Ammon and Russ White to discuss his experience in integrating new technologies on Hedge 118.

0

Atos Defends Its Supercomputing Turf With New Exascale Iron

There are not many companies left on Earth that can field an exascale-class supercomputer. …

Atos Defends Its Supercomputing Turf With New Exascale Iron was written by Timothy Prickett Morgan at The Next Platform.

0

Connect and Secure your Apps with Antrea and VMware NSX-T 3.2

The release of VMware NSX-T 3.2 and VMware Container Networking with Antrea 1.3.1-1.2.3 delivers on VMware’s vision to have heterogeneous Antrea clusters running anywhere integrate with NSX-T for centralized container policy management and visibility.

 

NSX-T becomes the single pane of glass for policy management when connected to Antrea clusters. The Antrea clusters could be running on VMware Tanzu platform, RedHat OpenShift or any upstream Kubernetes cluster. Inventory management, tagging, dynamic grouping and troubleshooting can be extended to Antrea clusters along with native Kubernetes network policies and Antrea network policies to be centrally managed by NSX-T.

Integrating Antrea to NSX-T

Antrea to NSX-T interworking Architecture

Antrea NSX Adapter is a new component introduced to the standard Antrea cluster to make the integration possible. This component communicates with K8s API and Antrea Controller and connects to the NSX-T APIs. When a NSX-T admin defines a new policy via NSX APIs or UI, the policies are replicated to all the clusters as applicable. These policies will be received by the adapter which in turn will create appropriate CRDs using K8s APIs. The Antrea Controller which is watching these policies run the relevant computation and sends the results Continue reading

0

Don’t Fall Victim to Cloud Monitoring Blind Spots

By keeping a close eye on your cloud-based vendors, you can make sure you always have a clear picture of what’s happening and the information you need to respond.

0

Day Two Cloud 134: Simplifying Infrastructure Access With StrongDM (Sponsored)

Today's Day Two Cloud is a sponsored episode with StrongDM, which helps engineers and IT professionals get access to databases, servers, Kubernetes clusters, switches, Web apps, and more from a desktop or laptop. We dive into StrongDM's proxy model, integrations with directories and ID stores, audit features, and more.

0

Day Two Cloud 134: Simplifying Infrastructure Access With StrongDM (Sponsored)

Today's Day Two Cloud is a sponsored episode with StrongDM, which helps engineers and IT professionals get access to databases, servers, Kubernetes clusters, switches, Web apps, and more from a desktop or laptop. We dive into StrongDM's proxy model, integrations with directories and ID stores, audit features, and more.

The post Day Two Cloud 134: Simplifying Infrastructure Access With StrongDM (Sponsored) appeared first on Packet Pushers.