INFRA Signal 551
[$] Examining other network namespaces using BPF
↗
Illustration only Photo by U. Storsberg on Unsplash
Jordan Rife is proposing BPF programs in Cilium that can enumerate sockets across different network namespaces.
Cross-namespace socket visibility would let Cilium and other BPF-based tools observe traffic that currently remains hidden behind namespace isolation. Engineers would need to adjust permission models and possibly kernel configurations to grant BPF programs the required access. The approach may be blocked in environments that enforce strict namespace separation for security.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
The idea targets Cilium’s integration with Kubernetes networking.
It requires BPF programs to obtain permissions for iterating sockets in another namespace.
Adoption will involve changes to security policies and may be limited where namespace isolation is enforced.
THE CLUSTER