Liz Rice, Isovalent | Open Source Summit Europe 2022

This is texturing TV. Hey guys, we're back at the open source Summit in Dublin. We're talking with Liz rice.

Who's the chief open source officer for ISO valent and we're talking about ebbf. Container security all kinds of other security and we're gonna jump into something called open UK, but more about that later and Liz welcome to show thanks for having me. Yeah, we hear a lot about eBPF and one of the things that is happening is as far as I can tell just about every security module in town is gonna get replaced by something that runs more efficiently on eBPF but I'm not sure that people know what ebf is so maybe you can walk us through that first.

And then what's its impact sure. Yes, say the letters the acronym stands for extended Berkeley packet filter, but people can forget that straight away because it The roots are packet filtering, but now you can do so so much more with it evpf. Lets us run programs in the kernel.

We can change the way the kernel behaves by attaching custom programs that we write to different events in the kernel. And that lets us build tracing tools. Brendon Greg did a whole load of pioneering work when he was at Netflix showing how you could use eBPF to build all these amazing tracing tools.

psyllium projects which is originated from isovalent uses eBPF to build a networking Connections in a cloud native environment and also to provide security so we can do things with eBPF like inspect every single Network packet as it arrives in different points in the network stack and perhaps discard it if it's an out of policy packet or redirect it really efficiently to wherever it's supposed to go in there in the cluster in one of the dirty little secrets of security in general is we don't really have the processing power right now to handle all the volume of attacks that are coming in and analyze that so this is a way to kind of get out that fundamental problem one of the Cool use cases actually for eBPF there's a thing called xtp which stands for Express data path and it's looking at a network packet. As soon as it arrives you think of it as as the packets being pulled off the off the wire and you can use it to filter out, you know, DDOS attacks, maybe packet of death mitigation by inspecting packets and dropping them build load balances. And the really cool thing about XDP is you can do it in the CPU.

But if you have a network driver or a network card that supports it you can actually offload that processing to the network card. So that saves a ton of CPU resources for your applications. And I think that's really fascinating.

So everything will be benefiting and will be more efficient is this computer science at this point or is it here now people can use it and they should be thinking about it like yeah, it's real we maybe four or five years ago was the first time that I heard about evpf and back then it was cutting-edge thing in the kernel it was you know available, but only if you were using the most recent kernels now pretty much every distribution that people are using in production has enough eBPF capability to be really useful. com has been through evpf since 2017. Well, so yeah, it's it's well established now, and we've got tons of people using the sillian project in All kinds of different vertical Industries and and using it at scale.

So it's here will we use it only in the cloud or will it be on premise or is it only going to be accessible from these new generation of cloud native applications running. How do I involve it? Yeah, so the answer is yes.

You can run it wherever you have. I was going to say wherever you have a Linux machine, but there's also working progress with Microsoft doing evpf on Windows. But yeah, absolutely great example would be aws's eks anywhere which is designed so that you can run your kubernetes workloads on your own hardware and or in the cloud identically and eks anyway uses cilium, which is based on eBPF by default.

So yeah, absolutely eBPF processing wherever you run your workloads. Yeah, we're gonna shift a bit of a gear because we're over here in Europe and there's this thing called open UK. So what is that about for all us folks who don't normally live here.

What do you guys up to? Yeah. So open UK is a body that's and pushing for more use of open Technologies in the UK and collaborating internationally and Really trying to explain to particularly the public sector and you know, the World At Large the benefits of using open technology and particularly for sustainable.

It's a better sustainability. Yeah. Are there different levels of adoption and open source Technologies by regions or are they somewhere different and as UK have any particularly unique attributes or challenges?

Yeah, I mean the answer is yes, there are Regional variations and one of the things that open UK does is an annual report on the state of open focusing on on the UK and how it's being used by different. Industries and different organizations. So yeah, the report has the first part of the report for this year's recently been published.

So that's available on the open UK website. How smart will all of this get in the future because one of the issues with using any type of AI and security or networking for that matter, is that processing power that's available? So are we going to see some Leaps and Bounds and in terms of features and capabilities on stuff that we never might have thought possible.

Yeah. I mean, it's always going to be an arms race and security. So I'm sure we will this amazing work being done.

There's a whole conference here about you know open ssf there are lots of people doing amazing work on supply chain security. There's the real-time security tooling that we can build using eBPF. There's I think a bright future for people using and also just taking security.

Seriously. I think we've seen a lot more realization that things like patches, you know need to be applied and and you need to keep your software up to date. So yeah, there's this progress.

So what's your best advice to folks about how to get engaged with this or start with this? I mean do I just buy products and services that use it or should I be engaged with it more deeply or how do I think about it? io.

There's a really great slack Channel about eBPF and cilium very kind of welcoming Community. We've also got a virtual Free Conference coming up on the 28th and 29th of this month's called eBPF Summit. So people are interested in the technology or hearing about how it's being used.

We've got quite a few case studies where people are going to be talking about their use of evpf-based tools in production. So yeah come along to EVPs Summit and find out more folks. You heard it here first, perhaps.

I'm still coming days soon where the new king will be hanging out at the open UK and saying hey, this is the way to go. But Liz thanks for being on the show. Thanks very much for having me.

All right, and thank you all for watching and we'll be right back.