eBPF for Telco : A New Approach to Observability, Networking and Security
The extended version of the Berkeley Packet Filter (eBPF) is to the Linux kernel (and now MS Windows) as Javascript is to a Web browser. eBPF enables programs to run in the kernel of the host operating system and to instrument the kernel without changing the kernel source code. This revolutionary technology allows us to program the kernel safely and dynamically without rebooting or crashing the machine. When Kubernetes (K8s) or other cloud platforms are used for running multiple applications on containerized environments, eBPF provides excellent visibility of all programs running in the user space and policy enforcement capabilities in the kernel space to mitigate vulnerabilities. Also, due to its low overhead, eBPF programs enable us to efficiently simplify the kernel networking stack, reducing latency between end points. eBPF is ideal for Telco cloud as its programs, with little effort, can be made portable between kernel versions and can be updated atomically, avoiding disruption of workloads and the need to reboot nodes in thousands of clusters. Most kernel versions used in production currently do support most relevant eBPF features and more kernel subsystems become extensible using eBPF. Cloud-native architecture is one of the key drivers of eBPF-based applications. An example of a cloud-native radio access network is the Open virtual Radio Access Network (Open vRAN), defined by the O-RAN Alliance,1 and the next generation of mobile communication systems (6G) will inherit all cloud-native architectural and operational principles, including K8s lifecycle management, agility, resilience and observability. This is where eBPF comes into play.
assets-global.website-files.com/...Telco_Whitepaper_final.pdf
The extended version of the Berkeley Packet Filter (eBPF) is to the Linux kernel (and now MS Windows) as Javascript is to a Web browser. eBPF enables programs to run in the kernel of the host operating system and to instrument the kernel without changing the kernel source code. This revolutionary technology allows us to program the kernel safely and dynamically without rebooting or crashing the machine. When Kubernetes (K8s) or other cloud platforms are used for running multiple applications on containerized environments, eBPF provides excellent visibility of all programs running in the user space and policy enforcement capabilities in the kernel space to mitigate vulnerabilities. Also, due to its low overhead, eBPF programs enable us to efficiently simplify the kernel networking stack, reducing latency between end points. eBPF is ideal for Telco cloud as its programs, with little effort, can be made portable between kernel versions and can be updated atomically, avoiding disruption of workloads and the need to reboot nodes in thousands of clusters. Most kernel versions used in production currently do support most relevant eBPF features and more kernel subsystems become extensible using eBPF. Cloud-native architecture is one of the key drivers of eBPF-based applications. An example of a cloud-native radio access network is the Open virtual Radio Access Network (Open vRAN), defined by the O-RAN Alliance,1 and the next generation of mobile communication systems (6G) will inherit all cloud-native architectural and operational principles, including K8s lifecycle management, agility, resilience and observability. This is where eBPF comes into play.
assets-global.website-files.com/...Telco_Whitepaper_final.pdf