Securing Cloud Native Applications with eBPF

Chapter 1. What is eBPF, Why Is It Important?

A Note for Early Release Readers

With Early Release ebooks, you get books in their earliest form—the authors’ raw and unedited content as they write—so you can take advantage of these technologies long before the official release of these titles.

This will be the 1st chapter of the final book. Please note that the GitHub repo will be made active later on.

If you have comments about how we might improve the content and/or examples in this book, or if you notice missing material within this chapter, please reach out to the editor at [e-mail].

In this chapter, we’ll introduce eBPF, explain why it was created, and discuss its evolution over the years. We’ll explain how eBPF works in detail and why it is considered to be the most innovative Linux technology of this decade. Chapter 2 will describe why it is essential for the Cloud Native industry and how it can revolutionize the legacy Runtime Security Observability and Enforcement tools.

To make this book more interesting, we’ll describe and illustrate the different technological concepts through a sophisticated Kubernetes attack that touches each layer of a software lifecycle. This attack will start from the supply chain layer during the pre-deployment and end at the runtime layer during the post-deployment process.

Now let’s briefly explore the hypothetical attack scenario in your Kubernetes build environment! You don’t need to understand the details of this attack now, but ...