Anyone using this in their prod set-up and has a scenario where they found this useful?
Although, Cilium is pretty great, so not sure why you wouldn’t run it, given the option…
Also, not everyone needs to implement a service mesh.
In this case, we had a couple services talking to 3rd party services running on AWS so it wasn't obvious from generic flow logs.
I also used Lacework a couple years ago which is eBPF based and it was pretty trivial to see things phoning home or one off maintenance where a new connection was being initiated.
--
1. https://deepflow.io 2. https://github.com/deepflowio/deepflow
That is a very interesting ask, let me raise an issue against the repo and see how we can solve this with eBPF in this repo. I am pretty sure this is a very common problem for a lot of kube admins.
Good old silos are alive and well, and ownership is not always part of the culture.
So at least in theory things are somewhat well set up, but there's too much siloing at our level (wildly separate network teams, teams for specific clouds, etc.)
Cilium is a CNI - the functionality that provides the K8s cluster inter-pod networking. The fact that it uses eBPF to deliver its functionality is what gives it the impressive observability you usually only get from a service mesh. I agree that not everyone needs a service mesh.