Complete lifecycle management of eBPF programs in the kernel

Explore L3AF WikiTry it!

Innovation

Empowerment

Flexibility

Industry-first "Kernel Functions as a Service"

L3AF is an industry-first platform for distributed management and composition of eBPF programs. Composition in L3AF means multiple independent eBPF programs can be dynamically combined or “chained” together to solve unique business problems. In the L3AF ecosystem, we refer to eBPF programs as “Kernel Functions” because they extend the functionality of the OS kernel. These features combine to make L3AF a platform that provides “Kernel Functions as a Service.”

Multiple independent kernel functions executing in a chain

“Chaining” in L3AF means that the Kernel Functions can be configured to run sequentially as configured by the user. Kernel Functions can be reordered on the fly according to business needs. Chaining is a powerful feature that enables the composition of multiple, independent eBPF programs in order to solve unique problems.

More to come, including a community-driven kernel function marketplace

We believe that eBPF users can benefit from the modular development and open distribution of eBPF programs. In this respect, we embrace the Unix philosophy of “write programs that do one thing and do it well.” Our vision is that the L3AF team, open-source community, and other businesses will develop independent eBPF programs that will be shared in a “kernel function marketplace.” Users can then download a selection of signed eBPF programs and orchestrate them to solve their unique business needs.

Simple API to add, remove, and reorder kernel functions on the fly

Kernel functions may store metrics in eBPF maps. L3AF can be configured to read these metrics and expose them over a web API.

Configurable metrics are gathered for each kernel function

Kernel functions may store metrics in eBPF maps. L3AF can be configured to read these metrics and expose them over a web API.

Replace proprietary applications and hardware with blazing fast eBPF code

L3AF empowers its users to remove expensive hardware appliances with software-defined networking in the form of eBPF programs. L3AF is currently being used in production to save money and reduce network hops. Real-world examples include the removal of commercial networking packets broker and hardware load balancer solutions.

Distributed model to manage and configure kernel functions on a per-node basis

A L3AF daemon (L3AFD) runs on each machine and exposes a simple web API for configuration. This offers great flexibility in that each machine is able to have a unique configuration if the user wishes.

Compose kernel functions to fit business needs

L3AF is designed to combine multiple, individual kernel functions into a comprehensive and complementary solution to business problems. Even individual kernel functions can be configured differently depending on their environment. This composition and configurability of eBPF programs provide great flexibility to the user.

Cloud and vendor agnostic

L3AF can be run on any Linux system (>= 4.18). This means L3AF can be leveraged to solve common problems that may exist between cloud environments where other common solutions may not exist.

L3AF: Platform

KF Marketplace

Coming Soon!

L3AF: Vision

At L3AF, our vision is to create a marketplace for eBPF programs (Kernel Functions), where users and developers can share their own signed kernel functions and download kernel functions from others. Our L3AF platform can then be used to orchestrate and compose selected kernel functions from the marketplace to several business needs. In this way, L3AF provides developers with a cloud and vendor-agnostic platform for adding capabilities to an operating system at runtime. We believe that the creation of such a fully integrated software ecosystem around eBPF will unleash its full potential for community adoption.

Latest Posts

August 24, 2021 in Blog

Introducing Walmart’s L3AF Project: Control plane, chaining eBPF programs, and open-source plans

This is the third blog in a three-part series introducing the L3AF project that provides Kernel Function as a Service using eBPF and related technologies. Though this blog can be…
Read More
August 16, 2021 in Blog

Introducing Walmart’s L3AF Project: XDP based packet processing at scale

This is the second blog in a three-part series introducing the L3AF project that provides Kernel Function as a Service using eBPF and related technologies. Read More
Read More
VIEW ALL POSTS

eBPF Summit 2021 Presentations

High Performance Load Balancing at Walmart
Karan Dalal and Kanthi Pavuluri, Walmart

Running and Orchestrating Multiple XDP and TC Programs
Brian G. Merrell, Walmart