Secure Egress In Serverless Compute-余皓伟.pdf

《Secure Egress In Serverless Compute-余皓伟.pdf》由会员分享，可在线阅读，更多相关《Secure Egress In Serverless Compute-余皓伟.pdf（21页珍藏版）》请在三个皮匠报告上搜索。

1、Secure Egress In Serverless ComputeHaowei YuAgenda Snowflake Introduction Serverless in Snowflake eBPF Introduction How to leverage eBPF to support secure egress ClosingSnowflake Introduction-ArchitectureServerless in Snowflake Snowflake Abstract Query Execution Resource as Virtual Warehouse“Semi Se

2、rverless”Users still need to configure warehouse size(number of servers in cluster)Data Loading Service v1 Auto-scalable Users only need to define transformation logic(by sql functions)Might co-allocation tasks from different customers on the same physical ec2 instances COGSData Loading Service-v3 U

3、sers want to define data transformation logic by writing Java/Python Code Snowflake expose UDF operator Implementation:need an untrusted user code execution environment Solution Sandbox user code execution in the local worker node Lock down network access from worker node by default All egress traff

4、ic needs to go through a fleet of egress proxies Proxies are also internet gateway Audit Prevent data exfiltrationThe problem not solved User code needs to connect to endpoint on public internet Geocode Weather Data SaaS Endpoint Connection Admin should be able to config which endpoints is(dis)allow

5、ed Packet that goes to un-desired endpoints should be dropped Proxy is transparent to user code eBPF comes to rescueeBPF Introduction Run sandboxed program in Linux kernel Without changing source code Event-driven on different hook points System calls Network Event KprobeHow to use eBPF?Write C code

6、 and compile with clang Target is eBPF byte code Load ebpf byte code with bpf syscall Libbpf wraps different bpf syscall Higher libraries like tc linked with libbpf Interact with your eBPF code from userspace with maps Configure the program Collect stats/results Verifier Null poi