L3AF Project Induction

Thank you for the review comments.

1. Sticky links corrected
2. Noted
3. There are a few governance processes that are in progress. Clarifications made.

Hey Ranny, thank you for going through the slides and posting your comments here. I have tried to answer your Qs below :-

Slide #3 - eBPF programs have the capability to instrument, inspect and interdict traffic while providing deep visibility into system and network performance. The use-cases of eBPF can broadly be classified into three main areas – networking, observability or tracing, and Security. At Walmart, we have leveraged eBPF and L3AF to develop several eBPF programs, such as flow exporter, rate limiting, traffic mirroring, load-balancing, and many others. These eBPF programs are then orchestrated into the kernel of target nodes using the APIs provided by the L3AF platform.

We have discussed Walmart's use of the eBPF and L3AF in a couple of tech conferences. You can view those here:

https://www.youtube.com/watch?v=wc8_KGh_JfA 

https://www.youtube.com/watch?v=thmAcyix8FM 

Slide #4 - In the initial version spec, the proposal is to simply have a GitHub repository to store eBPF program source code. This is to make sure that all the contributed eBPF programs can be made available in a single repository. The initial version doesn't have automation in place, so all submissions will be manually reviewed and published in this repo. The review process will also ensure that the code submissions conform to L3AF's eBPF program chaining mechanics.  Link to initial version: https://github.com/l3af-project/eBPF-Package-Repository. 

The idea is to build a future version on top of the initial version and include a fully automated build-release system that can perform reviews and build/upload the package to a storage repo. The proposal for the future version discusses the option of allowing contributors to upload the eBPF package without sharing the source code. It also aims to address various other challenges such as security (vulnerability detection, signing, semantic code analysis) and portability. We have an eBPF Package Repository Committee which meets bi-weekly to discuss the future spec in detail and draw agreements 

Proposal : https://github.com/l3af-project/l3af-arch/blob/main/discussions/prog_repo.md 

Open Issues with the initial version : https://github.com/l3af-project/eBPF-Package-Repository/issues 

Slide #5 - We have discussed this a few times internally at Walmart. Since many enterprises may have their own standard set of deployment and configuration management tools, we were unsure if sharing ours would be of significant value. However, we remain open-minded about this and would welcome any contributions while continuing to provide adopters the flexibility to use their own toolsets.

Slide #8 - L3AF is a platform to orchestrate and compose multiple, independent eBPF programs. We believe that eBPF users can benefit from the development and open distribution of modular eBPF programs. eBPF program chaining is the procedure of calling multiple eBPF programs in a sequence. In the case of network eBPF programs, only a single eBPF program can be attached to the network interface for each type (i.e., TC and XDP) in a linux kernel. We can, however, sequentially execute multiple eBPF programs per type by having eBPF programs call the next program in the chain. Chaining eBPF programs is a key feature of L3AF that empowers users to compose different, independent programs together to solve those unique business needs.

Any eBPF program can conform to the chaining mechanics of L3AF using the bpf_tail_call. We also have plans to develop an enhanced version of chaining that does not need any chain-specific logic in the eBPF programs. The proposal is available here -  https://github.com/l3af-project/l3af-arch/blob/main/discussions/chaining_enhancements.md