eBPF com BumbleBee

curl -sL https://run.solo.io/bee/install | sh

<string>:1: DeprecationWarning: The distutils package is deprecated and slated for removal in Python 3.12. Use setuptools or check PEP 632 for potential alternatives
Attempting to download bee version v0.0.14
Downloading bee-linux-amd64...
Download complete!, validating checksum...
Checksum valid.
bee was successfully installed 🎉

Add the bumblebee CLI to your path with:
  export PATH=$HOME/.bumblebee/bin:$PATH

Now run:
  bee init     # Initialize simple eBPF program to run with bee
Please see visit the bumblebee website for more info:  https://github.com/solo-io/bumblebee

export PATH=$HOME/.bumblebee/bin:$PATH

bee init

Use the arrow keys to navigate: ↓ ↑ → ←
? What language do you wish to use for the filter:
  ▸ C

 INFO  Selected Language: C
Use the arrow keys to navigate: ↓ ↑ → ←
? What type of program to initialize:
  ▸ Network
    FileSystem

 INFO  Selected Language: C
 INFO  Selected Program Type: Network
Use the arrow keys to navigate: ↓ ↑ → ←
? What type of map should we initialize:
    RingBuffer
  ▸ HashMap

 INFO  Selected Language: C
 INFO  Selected Program Type: Network
 INFO  Selected Map Type: HashMap
Use the arrow keys to navigate: ↓ ↑ → ←
? What type of output would you like from your map:
  ▸ print
    counter
    gauge

✔ BPF Program File Location: probe.c

#include "vmlinux.h"
#include "bpf/bpf_helpers.h"
#include "bpf/bpf_core_read.h"
#include "bpf/bpf_tracing.h"
#include "solo_types.h"// 1. Change the license if necessary
char __license[] SEC("license") = "Dual MIT/GPL";

struct dimensions_t {
    // 2. Add dimensions to your value. This struct will be used as the key in the hash map of your data.
    // These will be treated as labels on your metrics.
    // In this example we will have single field which contains the PID of the process
    u32 pid;
} __attribute__((packed));

// This is the definition for the global map which both our
// bpf program and user space program can access.
// More info and map types can be found here: https://www.man7.org/linux/man-pages/man2/bpf.2.html
struct {
    __uint(max_entries, 1 << 24);
    __uint(type, BPF_MAP_TYPE_HASH);
    __type(key, struct dimensions_t);
    __type(value, u64);
} values SEC(".maps.print");

SEC("kprobe/tcp_v4_connect")
int BPF_KPROBE(tcp_v4_connect, struct sock *sk)
{
    // initialize our struct which will be the key in the hash map
    struct dimensions_t key;
    // initialize variable used to track PID of process calling tcp_v4_connect
    u32 pid;
    // define variable used to track the count of function calls, and a pointer to it for plumbing
    u64 counter;
    u64 *counterp;

    // get the pid for the current process which has entered the tcp_v4_connect function
    pid = bpf_get_current_pid_tgid();
    key.pid = pid;

    // check if we have an existing value for this key
    counterp = bpf_map_lookup_elem(&values, &key);
    if (!counterp) {
        // debug log to help see how the program works
        bpf_printk("no entry found for pid: %u}", key.pid);
        // no entry found, so this is the first occurrence, set value to 1
        counter = 1;
    }
    else {
        bpf_printk("found existing value '%llu' for pid: %u", *counterp, key.pid);
        // we found an entry, so let's increment the existing value for this PID
        counter = *counterp + 1;
    }
    // update our map with the new value of the counter
    bpf_map_update_elem(&values, &key, &counter, 0);


    return 0;
}

curl https://raw.githubusercontent.com/iovisor/bcc/master/libbpf-tools/tcpconnect.c -o tcpconnect.c

bee build tcpconnect.c ttl.sh/ebpf-solo-tcpconnect:1h

/home/ubuntu # bee build probe.c ttl.sh/ebpf-solo-tcpconnect:1h
 SUCCESS  Successfully compiled "tcpconnect.c" and wrote it to "tcpconnect.o"
 SUCCESS  Saved BPF OCI image to ttl.sh/ebpf-solo-tcpconnect:1h

bee push ttl.sh/ebpf-solo-tcpconnect:1h

 SUCCESS  Pushing image ttl.sh/ebpf-solo-tcpconnect:1h to remote registry

bee run ttl.sh/ebpf-solo-tcpconnect:1h

curl http://localhost:9091/metrics

# HELP ebpf_solo_io_events_hash
# TYPE ebpf_solo_io_events_hash counter
ebpf_solo_io_events_hash{daddr="10.42.0.4",saddr="10.42.0.1"} 78
ebpf_solo_io_events_hash{daddr="10.43.165.159",saddr="10.5.0.154"} 2
ebpf_solo_io_events_hash{daddr="127.0.0.1",saddr="127.0.0.1"} 145
ebpf_solo_io_events_hash{daddr="216.239.34.174",saddr="10.5.0.154"} 1
ebpf_solo_io_events_hash{daddr="216.239.36.174",saddr="10.5.0.154"} 1
ebpf_solo_io_events_hash{daddr="74.125.133.100",saddr="10.5.0.154"} 1
ebpf_solo_io_events_hash{daddr="76.76.21.21",saddr="10.5.0.154"} 1
# HELP go_gc_duration_seconds A summary of the pause duration of garbage collection cycles.
# TYPE go_gc_duration_seconds summary
go_gc_duration_seconds{quantile="0"} 4.6054e-05
go_gc_duration_seconds{quantile="0.25"} 8.4773e-05
go_gc_duration_seconds{quantile="0.5"} 0.000114445
go_gc_duration_seconds{quantile="0.75"} 0.0001483
go_gc_duration_seconds{quantile="1"} 0.000223545
go_gc_duration_seconds_sum 0.001830346
go_gc_duration_seconds_count 15
...

kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.11/samples/bookinfo/platform/kube/bookinfo.yaml

kubectl get pods -o wide

kubectl create ns prometheus

helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
helm repo update

helm install prom prometheus-community/kube-prometheus-stack --version 30.0.1 -n prometheus

cat << EOF | kubectl apply -f -
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: bumblebee
spec:
  selector:
    matchLabels:
      app: bumblebee
  template:
    metadata:
      labels:
        app: bumblebee
    spec:
      containers:
      - name: bumblebee
        image: djannot/bumblebee:0.1
        imagePullPolicy: Always
        command: ["bee"]
        args: ["run", "--insecure", "--plain-http", "ttl.sh/ebpf-solo-tcpconnect:1h"]
        tty: true
        ports:
        - name: http-monitoring
          containerPort: 9091
        securityContext:
          privileged: true
EOF

cat << EOF | kubectl apply -f -
apiVersion: monitoring.coreos.com/v1
kind: PodMonitor
metadata:
  name: bumblebee
  labels:
    monitoring: bumblebee
    release: prom
spec:
  selector:
    matchLabels:
      app: bumblebee
  jobLabel: bumblebee-stats
  podMetricsEndpoints:
  - port: http-monitoring
    path: /metrics
    interval: 15s
    metricRelabelings:
    - action: replace
      sourceLabels:
      - saddr
      targetLabel: pod_ip
    - action: replace
      sourceLabels:
      - daddr
      targetLabel: cluster_ip
EOF

for i in {1..20}; do
    kubectl exec $(kubectl get pods -l app=productpage -o jsonpath='{.items[0].metadata.name}') -- python -c "import requests; r = requests.get('http://localhost:9080/productpage'); print(r.status_code)"
done

cat << EOF | kubectl apply -f -
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: kebpf
subjects:
- kind: ServiceAccount
  name: kebpf
  namespace: default
roleRef:
  kind: ClusterRole
  name: cluster-admin
  apiGroup: rbac.authorization.k8s.io
EOF

cat << EOF | kubectl apply -f -
apiVersion: v1
kind: ServiceAccount
metadata:
  name: kebpf
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: kebpf
spec:
  replicas: 1
  selector:
    matchLabels:
      app: kebpf
  template:
    metadata:
      labels:
        app: kebpf
    spec:
      serviceAccountName: kebpf
      containers:
      - name: kebpf
        imagePullPolicy: Always
        image: djannot/kebpf:0.1
        command: ["node"]
        args: ["kebpf.js"]
        env:
        - name: PROMETHEUS_ENDPOINT
          value: "http://prom-kube-prometheus-stack-prometheus.prometheus.svc.cluster.local:9090"
        ports:
        - name: http
          containerPort: 3000
---
apiVersion: v1
kind: Service
metadata:
  name: kebpf
spec:
  type: LoadBalancer
  selector:
    app: kebpf
  ports:
    - protocol: TCP
      port: 80
      targetPort: 3000
EOF

// SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) */
/* Copyright (c) 2021 Hengqi Chen */
/* Adapted for `bee` from: https://github.com/iovisor/bcc/blob/master/libbpf-tools/exitsnoop.bpf.c */
#include <vmlinux.h>#include <bpf/bpf_helpers.h>#include <bpf/bpf_core_read.h>#define TASK_COMM_LEN   16

struct event {
        __u32 pid;
        __u32 tid;
        __u32 ppid;
        char comm[TASK_COMM_LEN];
};

struct {
        __uint(type, BPF_MAP_TYPE_RINGBUF);
        __uint(max_entries, 1 << 24);
        __type(value, struct event);
} exits SEC(".maps.print");

SEC("tracepoint/sched/sched_process_exit")
int sched_process_exit(void *ctx)
{
        __u64 pid_tgid = bpf_get_current_pid_tgid();
        __u32 pid = pid_tgid >> 32;
        __u32 tid = (__u32)pid_tgid;

        struct task_struct *task;
        struct event event = {};

        task = (struct task_struct *)bpf_get_current_task();

        event.pid = pid;
        event.tid = tid;
        event.ppid = BPF_CORE_READ(task, real_parent, tgid);
        bpf_get_current_comm(event.comm, sizeof(event.comm));

        struct event *ring_val;

        ring_val = bpf_ringbuf_reserve(&exits, sizeof(struct event), 0);
        if (!ring_val) {
                return 0;
        }

        memcpy(ring_val, &event, sizeof(struct event));

        /* submit event to ringbuf for printing */
        bpf_ringbuf_submit(ring_val, 0);

        return 0;
}

char LICENSE[] SEC("license") = "Dual BSD/GPL";

bee build exitsnoop.c ttl.sh/exitsnoop:1h

bee push ttl.sh/exitsnoop:1h

bee run ttl.sh/exitsnoop:1h