From ba532b230b633283e1cde01d4aff81c1a1253090 Mon Sep 17 00:00:00 2001 From: Paul Miller Date: Mon, 18 Nov 2024 02:05:19 +0000 Subject: [PATCH] docs update --- README.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 40ebab5..290214a 100644 --- a/README.md +++ b/README.md @@ -70,10 +70,9 @@ Network policies are hard to implement efficiently and in large clusters this is Most of the existing implementations use the same approach of processing the APIs and transforming them in the corresponding dataplane implementation: iptables, nftables, ebpf or ovs, ... -This project takes a different approach. It uses the NFQUEUE functionality implemented in netfilter to process the first packet of each connection in userspace and emit a verdict. The advantage is that the dataplane implementation does not need to represent all the complex logic, allowing it to scale better. The disadvantage is that we need to pass each new connection packet through userspace. +This project takes a different approach. It uses the NFQUEUE functionality implemented in netfilter to process the first packet of each connection (or udp flows) in userspace and emit a verdict. The advantage is that the dataplane implementation does not need to represent all the complex logic, allowing it to scale better. The disadvantage is that we need to pass each new connection packet through userspace. Subsequent packets are accepted via a "ct state established,related accept" rule. -There are some performance improvements that can be applied, such as to restrict in the dataplane the packets that are sent to userspace to the ones that have network policies only, so only -the Pods affected by network policies will hit the first byte performance. +For performance only the Pods selected by network policies will be queued to user space and thus absorb the first packet perf hit. ## Testing