Issuu

APR | 2022

w w w. t e c h f a s t l y. c o m

In conversation with

Liz Rice Chief Open Source Officer at Isovalent

eBPF

Step into the SuperWorld with

Hrish Lotlikar Co-Founder & CEO SuperWorld

Potential Global Cyber Warfare Due to Russo-Ukrainian War

eBPF to Enhance Kubernetes Monitoring

How to Add eBPF Observability to Your Project

by Toulika Das

by Md. Sohail

by Rehan Hussain

What’s Inside p.4

Introduction to eBPF Revolutionizing Linux Kernel Technology by Toulika Das

p.16

In Conversation with Liz Rice, Chief Open Source Officer at Isovalent

p.24 An Easy-to-Understand

Overview of Popular extended BPF Tools – BCC, Falco, and More by Saipriya Iyer

p.40 How to Add eBPF

Observability to Your Project by Rehan Hussain

p.48 eBPF to Enhance

Kubernetes Monitoring by Md. Sohail

p.56 Is eBPF Foundation

Molding the Future of Infrastructure Software Space? by Kunal Mehta

p.62 Step into the

SuperWorld with Hrish Lotlikar, Co-Founder & CEO - SuperWorld

p.76

Russia Ukraine Conflict and What It Means for The Internet by Aftab Alam

p.82 Potential Global Cyber

Warfare Due to RussoUkrainian War by Toulika Das

p.90 Russia-Ukraine War: How

It Affects the World’s Economy by Yash Modi

Editor’s note

Dear Readers, eBPF is a ground-breaking technology derived from the Linux kernel that allows sandboxed programmes to operate within an operating system kernel. It stands for Extended Berkeley Packet Filter (eBPF). eBPF was first published in diminished capacity with Linux 3.18 in 2014, however full functionality needs Linux 4.4 or above. eBPF is used to enhance the functionality of the kernel in a robust and reliable manner without the need to update kernel source code or, for that matter, load kernel components. eBPF is now widely used to support a wide range of use cases. Take for instance delivering superior collaboration and network capacity in modern data centres and cloud native or container-based environments, eBPF is well-equipped to carry these out. It also helps in extracting fine-grained surveillance observability data with low overhead, assisting software developers in tracing applications, offering insights for efficiency troubleshooting, and preventive application and container runtime security enforcement, among others. The prospects are boundless, and eBPF has only just started to unleash creativity. In this issue, we have shared our insights about how we think eBPF can revolutionize Linux Kernel Technology. The ongoing Russian invasion of Ukraine has posed a number of threats to the digital world as well, with cyberattacks and other global impacts like microprocessor chip shortage, software outsourcing issues on the cards. We have interviewed Liz Rice, Chief Open Source Officer at Isovalent and discussed about the powers of eBPF and how it could revolutionize the linux kernel technology. Also, in our conversation with Hrish Lotlikar, Co-Founder & CEO – SuperWorld, he talked all about the virtual world in augmented reality (AR) and its mission. According to experts, the Russo-Ukrainian war will have an influence on global energy markets, with a rippling effect on semiconductor shortages and inflation. As a response to serious outages in internet connection in Ukraine during the Russian invasion, Elon Musk declared that SpaceX's Starlink Service will offer internet connectivity. As always, we welcome your feedback on the topics discussed in this issue. We hope you enjoy reading it!

Srikant Rawat

Chief Operating Officer, Techfastly

Missed an Issue? Subscribe and access our Digital issues anytime. www.techfastly.com

Liz Ric Chief Open Source Officer at Isovalent

APR 2022

www.techfastly.com

Most of our readers might not understand the kernel. Can you explain what the kernel does?

Operating systems have two parts: userspace and the kernel. Userspace has lower privileges; kernel space is a fully privileged environment. The kernel is the only part that can directly access memory, files, network, or any other hardware component. Userspace applications where we typically operate have to ask the kernel to do things on its behalf.

Liz Rice is Chief Open Source Officer with eBPF specialists Isovalent, creators of the Cilium cloud native networking, security and observability project. She was Chair of the CNCF's Technical Oversight Committee 2019-2022, and Co-Chair of KubeCon + CloudNativeCon in 2018. She is also the author of Container Security, published by O'Reilly.

As developers, we write application software; and applications run in userspace. If you're writing an application and want to read from a file, send a network message, or display something to the screen, you can't do it directly; you have to ask the kernel to do it for you. Usually, that's hidden from you because we have language abstractions that hide the interface. But in practice, your application is making system calls to ask the kernel to act on its behalf. The kernel is also doing things like scheduling multiple applications to run concurrently.

She has a wealth of software development, team, and product management experience from working on network protocols and distributed systems, and in digital technology sectors such as VOD, music, and VoIP. When not writing code, or talking about it, Liz loves riding bikes in places with better weather than her native London, and competing in virtual races on Zwift.

How does the userspace interact with the kernel space?

There is an API called the system call or syscall interface, and there are over 300 different system calls. In most programming languages, we don't write directly to the system call; there's usually an abstraction. In the world of C, we talk about the standard library, and many other languages build on top of that. For example, if you open a file, you probably have a language-specific function called 'open'. When you call that, underneath the covers, it will make a system call to an open syscall to open that file on your behalf. 17

Techfastly enables leaders around the globe to dive deeper into technology insights, to drive results Simpler & Quicker