Evaluating iptables vs eBPF Performance in Kubernetes Zero Trust Environments

Sammanfattning

As Kubernetes adoption continues to grow, securing inter-service communication has become increasingly critical. Zero Trust (ZT) architectures and network policy enforcement introduce additional processing overhead, particularly when implemented using technologies such as iptables, eBPF, and service meshes like Istio. While prior studies have evaluated these components individually, their combined performance impact in Kubernetes environments remains insufficiently explored. This thesis aims to evaluate and compare the performance overhead of iptables and eBPF as underlying data planes in Kubernetes, specifically in the context of ZT networking. The study further investigates the additional latency, CPU usage, and memory consumption introduced by network policies and service mesh components. A controlled experimental setup was implemented using a Kubernetes cluster with Calico CNI configured to operate with either iptables or eBPF. High-precision latency measurements were obtained using external packet capture hardware with nanosecond accuracy. From these measurements we can obtain service performance delays for TCP, UDP, and HTTP traffic under varying policy configurations. Resource utilization was monitored using cgroup v2 metrics. Additional experiments evaluated the impact of Istio service mesh and eBPF-based acceleration via Merbridge. Results show that eBPF provides modest latency improvements over iptables for TCP 6-12 μs (2.2–4.2%) and HTTP 5-7 μs (1.1–1.8%) traffic, while performance for UDP remains comparable. Network policies introduce no statistically significant latency overhead. In contrast, enabling Istio results in a substantial latency increase of approximately 555-588 μs 133–143%, along with significantly higher CPU and memory usage. The use of Merbridge did not yield performance improvements and instead increased both latency and resource consumption. The findings indicate that while eBPF offers minor performance benefits over iptables, the choice of data plane has limited overall impact compared to higher-level security mechanisms. Network policies can be applied with negligible performance cost and should be widely adopted. However, service mesh solutions such as Istio introduce significant overhead, requiring careful consideration of trade-offs between security features and system performance.