liveBook · Manning

Dataplane v2

As explained in Google Anthos in Action

Dataplane V2 is a GKE networking dataplane architecture based on eBPF and Cilium for implementing pod networking and network policy.

GKE Dataplane v2 uses eBPF and Cilium to provide a programmable path for Kubernetes Service traffic and NetworkPolicy enforcement. eBPF hooks let the Linux kernel use workload context when handling packets, addressing observability, scalability, and functional requirements. section 10.2.1

Two Cilium components take over responsibilities previously handled by Calico and kube-proxy:

  • The cilium-agent DaemonSet programs the eBPF data path, resolves Services, and enforces NetworkPolicies. section 10.2.1
  • The cilium-operator Deployment manages Cilium-internal CRDs and reduces the need for agents to watch every Pod. section 10.2.1
Table 10.1

Network feature

Existing

New Dataplane

ClusterIP service resolution

kube-proxy using iptables

cilium-agent using eBPF on sockets

NodePort service resolution

kube-proxy using iptables

cilium-agent using eBPF on eth0 TC hooks

Load balancer service resolution

kube-proxy using iptables redirecting to service chain

cilium-agent using eBPF on eth0 TC hooks (same hook as previously)

Network policy enforcement

Calico using iptables

cilium-agent using eBPF on socket as well as eth0 TC hooks

Compare the implementations before and after the switch: ClusterIP resolution moves from kube-proxy iptables rules to eBPF socket hooks; NodePort, load-balancer resolution, and policy enforcement use the hooks shown in the table. section 10.2.1

How Google Anthos in Action covers it

How deep it goes
Explains component responsibilities and compares eBPF hooks with iptables implementations, without providing deployment steps.
Examples
Compares ClusterIP, NodePort, load-balancer, and NetworkPolicy implementations in a feature table.
What it assumes
Assumes familiarity with Kubernetes Services and NetworkPolicies while introducing eBPF and Cilium component roles.
What you can do after
Evaluate/understand which components and packet hooks handle Service resolution and policy enforcement in Dataplane v2.
How it connects
Connects eBPF and Cilium to Kubernetes Services, NetworkPolicies, kube-proxy, and Calico.
Cover of Google Anthos in Action
liveBookmanning.com
Read Google Anthos in Action on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Google Anthos in Action. The section links point to the parts of the book it draws on.