eCHO news is your bi-weekly wrap up of all things eBPF and Cilium. If you want to keep up on the latest in cloud native networking, observability, and security this is your quelle

8th September 2026

This week we kicked off an exciting, in-depth blog series with Cloudflare on ebpf.io about how they've built their entire network on eBPF over the past eight years. Part one covers the original pivot to XDP-based DDoS mitigation, and part two digs into the eleven Linux networking gaps they had to fill themselves. We'll be releasing the rest of the series over the next couple of months so be sure to keep your eyes out for next installments.

This edition also includes a deep dive into Cilium Multi-Pool IPAM for vCluster tenant isolation. GKE's new cluster-wide network policy is also built directly on open-source Cilium, demonstrating how central the project has become to managed Kubernetes offerings.

The eBPF Foundation announced the recipients of its $100K in academic research grants. One project targets verifier error diagnostics, making it easier to understand why a program was rejected. The other focuses on secure cross-VM observability across VM boundaries in multi-tenant environments. Both aim to make it easier for teams looking to adopt eBPF in production.

I'm off to Portugal next week for some sun and need to pack for a toddler, so let's 🐝-gin.

The Technical

Cloudflare’s eBPF Replatforming Part 1: The eBPF Pivot – From Hardware Lock-in to Programmable Networking

The first of an 8-part series on Cloudflare's replatforming around eBPF

Cloudflare’s eBPF Replatforming Part 2: Filling Gaps in the Linux Ecosystem with eBPF

How they closed 11 Linux networking gaps, and auto-mitigated a 3.8 Tbps DDoS attack

The Eternal Tug of War: How io_uring & eBPF Are Changing Linux Malware Evasion

An io_uring issue exposes a recurring failure mode in cybersecurity

Host routing

Following a dropped packet back to a reverse-path filtering rule

Taking control of cluster security: A deep dive into GKE ClusterNetworkPolicy

GKE implementation of ClusterNetworkPolicy is built entirely on open-source Cilium

Squeezing Performance out of eBPF

Benchmarks showing what eBPF hooks and maps cost across cores

lazybpf/bpf-explorer

A cluster-wide web UI for browsing eBPF maps and programs across K8s nodes

Leaviss/ebpf-ssf-broker

Use Tetragon eBPF signals to revoke compromised workload identities

bensanmorris/security_observability

Track TLS certificate activity using eBPF without accessing private keys

🐝

The Ecosystem

eBPF Foundation Awards $100,000 in Academic Research Grants to Advance eBPF Developer Tools and Security

eBPF verifier error diagnostics and secure cross-VM observability

🐝

The How To

Cilium Multi-Pool Mode for vCluster Tenant Clusters on RKE2

Learn how to give each tenant its own IP pool without touching underlying cluster network

eBPF Tutorial: Building an Egress Pacer with BPF Qdisc

Build a traffic limiter using eBPF kernel hooks
🐝

The Video

SIGCOMM'26: Don't Stall Me Now: Hiding Memory Latency in eBPF

A Politecnico di Milano researcher shows how to hide eBPF memory-stall latency with prefetching and batched execution 

🐝

The Events

ACM SOSP'26 Workshop on eBPF and Kernel Extensions

September 29th in Prague

Linux Plumbers Conference

October 5-7th in Prague, schedule for eBPF Track 

CiliumCon

November 9 in Salt Lake City, schedule now live 

Security Native Europe

November 26 in Zurich, headlined by Daniel Borkmann on eBPF's role in live system hardening

CiliumCon Europe

March 15 in Barcelona, CFP open through October 18

🐝 

The Livestreams

eCHO Episode 214: Contributing to Cilium with Hadrien Patte of Datadog

Upcoming on Sept 11: eCHO Episode 215: Tetragon in GitHub Actions

The Post of the Week

As always, if you’ve seen a blog post, a tool, or anything else eBPF or Cilium related that you think the rest of the community should hear about, send them my way. You can either hit reply or join the #echo-news channel on Cilium Slack. You can also find all of the past episodes on the website.

🐝

To make sure you keep getting these emails, please add kaoconno@cisco.com to your address book or otherwise mark me as a permitted sender.

Know a friend that needs to be in the know? Forward this to them

Was this forwarded to you? Sign up today!

Written and sent by Katie Meinders. Any feedback is welcome!