astoycos

Pre-requisites:

• A linux machine setup with KIND
• A local Checkout of https://github.com/bpfd-dev/bpfd/tree/kubecon-demo-2023

1. Setup a local KIND cluster

kind create cluster --name=kubecon-na-2023-bpfd-demo

astoycos

1. Create namespace

oc create ns openshift-bpfd

2. Install cert-manager bits

kubectl apply -f https://github.com/bpfd-dev/bpfd/releases/download/v0.2.1/bpfd-cert-manager-v0.2.1.yaml -n openshift-bpfd

astoycos

1. Deploy Cert manager

kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.11.0/cert-manager.yaml

2. Make bpfd ns

kubectl create ns bpfd

astoycos

1. Create Kind Cluster

kind create cluster --name=test-bpfd

2. Deploy Cert manager

kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.11.0/cert-manager.yaml

astoycos

// You can edit this code!
// Click here and start typing.
package main

import (
	"context"
	"fmt"
	"time"

	"net/http"

astoycos

This Describes how to spin up BPFD with IGNFW from https://github.com/astoycos/ingress-node-firewall/tree/bpfd-integration

1. (from https://github.com/redhat-et/bpfd) Spinup bpfd + Kind

cd bpfd-operator && make run-on-kind

2. (from https://github.com/astoycos/ingress-node-firewall/tree/bpfd-integration) Deploy the ignfw XDP program via bpfd

astoycos

astoycos@astoycos-mac ~ % sudo ./apex-installer.sh -i 

WARNING -- This script will install software on your system. It will:
  * Install Homebrew (brew) if not already installed.
  * Install wireguard-tools with brew.
  * Download the apex agent and install it to /usr/local/sbin/apex
Continue? (y/n): y
[ ACTION ] Wireguard is not installed. Installing WireGuard...
Error: Running Homebrew as root is extremely dangerous and no longer supported.
As Homebrew does not drop privileges on installation you would be giving all

astoycos

1. Spin up an ovn-k kind cluster

• git clone https://github.com/ovn-org/ovn-kubernetes
• ./contrib/kind.sh

2. Start the Aya Loader pod

cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: Pod

astoycos

Using Socket proxy from -> https://github.com/astoycos/netns-proxy 

Native Socket redirction from -> https://github.com/astoycos/net-ebpf-playground/tree/demo/socket-redirection

1. No bpf redirection

```
[astoycos@localhost net-ebpf-playground]$ iperf3 -4 -c 192.168.122.91 -p 8789 
Connecting to host 192.168.122.91, port 8789
[  5] local 192.168.122.1 port 58868 connected to 192.168.122.91 port 8789

astoycos

{
        "start":        {
                "connected":    [{
                                "socket":       5,
                                "local_host":   "192.168.122.1",
                                "local_port":   47192,
                                "remote_host":  "192.168.122.91",
                                "remote_port":  8789
                        }],
                "version":      "iperf 3.10.1",