There is some much great technology on display at Cisco Live, and one of the really deep ones, like in the kernel deep, is Isovalent. I had the opportunity to chat with Duffie Cooley about Isovalent, eBPF, Cilium, and Tetragon. You can do some amazing things at the packet and OS level with this technology, and Duffie gives us some insight into the capabilities in this video.

Transcript

Auto-generated captions, lightly cleaned. Speakers are not separately labeled.

Hey everybody, we’re out here at Cisco Live in Amsterdam and I ran into Duffy and we’ve been talking about isovalent and ebpf and why that’s so awesome. Now give us some more information of why that’s so cool. >> Yeah, so I’m the I’m Duffy. I’m the field CTO at ISO.ent. I spent a lot of my time doing exactly this explaining everything and I don’t think that any introduction to isalent would be uh would should would be remiss without mentioning something like EDPF. Let’s talk about EDPF for just a second. And I’ll give you some context about what it actually is. So if you were to think of the Linux kernel as an event- driven API, right, where I want to open a file, I want to open a socket, I want to, you know, interact with any of the devices that Linux knows about, all of those things. What EVPF allows us to do first is to instrument what happens in that lake, right? So one of the big challenges that like has happened in our world of containerization is that there are all these abstractions, things like name spaces and containers and all of those things. And with all of those abstractions, it’s become very difficult to understand like the security space around all of these things. This is why container escapes are a thing. This is why Kubernetes security is super challenging. There there’s all these, you know, uh good good examples. What ebpf allows us to do is actually capitalize on the context that the Linux kernel knows about as it relates to those security problems. As it relates to that context about what’s running, what access do they have, what permissions do they have, what can it do, right? So that event driven API example, right? If I go back to that with dbtf and I say inside of this inside of all of the containers running inside of my Kubernetes environment, I do not want to allow them to write to particular files or sensitive files on the underlying host. I only want to allow them to write to file systems that are contained within the same container name spaces that the processes itself exists in. It’s very difficult to do that without being able to sit in the Linux kernel and make dynamic decisions about whether a thing whether whether an API call is allowed or denied directly in the kernel. And that’s what EVPF enables us to do. That’s the big payoff. Right now bringing this a little bit farther forward, let’s talk about like how EVPF actually relates to isovalent and we’ll also talk about how it all ties together with selenium. So EVPF is a foundational technology for everything that we’ve built as part of isobalance.ent isalent has this thing called the isobalent enterprise network or enterprise platform which is comprised of a few components. Psyllium, a network security and observability component which is implemented directly in EVPF which means that we’re you know using EVPF to actually make decisions about whether to allow or deny traffic all the way down to the socket layer and um and tetragon which is actually giving us that same capability but at runtime security layer. So file access whether the permissions of a process have changed and what do we want to do to respond to that. So like if there is a container escape, the Linux colonel knows about it because it has to still give you that access to whatever you’re going to escape into. >> So given that context, we can actually say I don’t want to allow container scapes. I don’t want to allow any know any of these things like a really great decision point. >> So that ties is enterprise platform. That’s what we had before we were acquired into Cisco. Now, when I look around the floor here at Cisco Live, I see a variety of different efforts that are trying to also leverage EVPF in conjunction with the work that we’re doing, right? So, we’re working with all of these teams to actually really bring EVPF as a technology into all of these other spaces. >> It’s just incredible, right? Like that means that when I look at Splunk, I have all of that context I mentioned in the kernel. How can Splunk better represent contextually what’s happening at runtime? How can I combine that with what’s happening at the at the network layer? How can I use these primitives to better secure like AI [laughter] workloads and things like that, right? All of these things pin around this core technology of EBF and the experts in it which is what which is what they acquired when they acquired. So that should give you some insight into what we’re doing. It’s a really great time and you know I’m I’m just continually excited that all of this is still just an incredible opportunity here within Cisco and to change the world not just for ourselves but for everybody and it’s really amazing what you shared with me and from the kernel level all the way to the context and the observability piece and just how it all really ties together in the whole one Cisco story. Now, yep, >> if I want to go get some more information and educate myself further, how could I do that? >> There’s a few different places you could jump in. Uh, one place is evbf.io. >> That’s a website that we manage because we’re the contributors and the maintainers of EVPF and Linux kernel. We maintain evpf.io as a place to just learn more about that specific technology and what’s available, what’s what’s uh what people are doing with it and all of that stuff. And you can go to isurveillent.com. is surveillance.com has a few different resources available to you including hands-on labs where you can actually explore psyllium and tetragonon hands-on and instruct and learn and and find out exactly what we’re able to do in those scenarios. Um there there’s also a ton of white papers, a ton of resources. We usually have webinars and events and maybe in cities near you where you can come and join us and kind of learn about all of those things. >> Thanks so much. Really amazing. Thank you.