Illustrated Children’s Guide to eBPF Written by: Quentin Monnet & Bill Mulligan Illustrated by: Dacil C. Designed by: Quentin Monnet Here's a story about starships, about space travels, and about little expects eBPF programs to be loaded in the form of bytecode. Typically, eBPF developers write programs in C, Rust, or other languages, which are then compiled into eBPF bytecode. eBPF programs can be loaded the hood, making them go full steam. eBPF now has a variety of libraries written in Golang, Rust, C++, and others that help loading, compiling, and debugging eBPF programs across both user and kernel

probability ● Used to test disaster recovery readiness 6 cgroup-bpf infra ● twagent is written in C++ ● libbpf [0] for everything-BPF ● BPF integration with buck [1] ● BTF [2] is enabled everywhere

0/1 PodInitializing 0 7s coredns-86c58d9df4-4g7dd 0/1 ContainerCreating 0 8m57s coredns-86c58d9df4-4l6b2 0/1 ContainerCreating 0 1/1 Running 0 4m12s coredns-86c58d9df4-4g7dd 1/1 Running 0 13m coredns-86c58d9df4-4l6b2 1/1 Running 0 13m echo-a-5995597649-f5d5g 1/1 Running 0 4m51s echo-b-54c9bb5f5c-p6lxf 1/1 Running 0 4m50s echo-b-host-67446447f7-chvsp

0/1 PodInitializing 0 7s coredns-86c58d9df4-4g7dd 0/1 ContainerCreating 0 8m57s coredns-86c58d9df4-4l6b2 0/1 ContainerCreating 0 1/1 Running 0 4m12s coredns-86c58d9df4-4g7dd 1/1 Running 0 13m coredns-86c58d9df4-4l6b2 1/1 Running 0 13m NAME READY STATUS RESTARTS AGE echo-a-6788c799fd-42qxx 1/1 Running 0 69s echo-b-59757679d4-pjtdl

0/1 PodInitializing 0 7s coredns-86c58d9df4-4g7dd 0/1 ContainerCreating 0 8m57s coredns-86c58d9df4-4l6b2 0/1 ContainerCreating 0 1/1 Running 0 4m12s coredns-86c58d9df4-4g7dd 1/1 Running 0 13m coredns-86c58d9df4-4l6b2 1/1 Running 0 13m READY STATUS RESTARTS AGE echo-a-76c5d9bd76-q8d99 1/1 Running 0 66s echo-b-795c4b4f76-9wrrx 1/1

com/cilium/cilium- cli/releases/latest/download/cilium-darwin-amd64.tar.gz{,.sha256sum} shasum -a 256 -c cilium-darwin-amd64.tar.gz.sha256sum sudo tar xzvfC cilium-darwin-amd64.tar.gz /usr/local/bin rm cilium-darwin-amd64 '' | awk '{print "-n "$1" "$2}' | xargs -L 1 -r kubectl delete pod pod "event-exporter-v0.2.3-f9c896d75-cbvcz" deleted pod "fluentd-gcp-scaler-69d79984cb-nfwwk" deleted pod "heapster-v1.6.0-beta.1-56d5d5d87f-qw8pv" 5-n6m5k" deleted pod "l7-default-backend-6f8697844f-d2rq2" deleted pod "metrics-server-v0.3.1-54699c9cc8-7l5w2" deleted Note This may error out on macOS due to -r being unsupported by xargs. In this

0/1 PodInitializing 0 7s coredns-86c58d9df4-4g7dd 0/1 ContainerCreating 0 8m57s coredns-86c58d9df4-4l6b2 0/1 ContainerCreating 0 1/1 Running 0 4m12s coredns-86c58d9df4-4g7dd 1/1 Running 0 13m coredns-86c58d9df4-4l6b2 1/1 Running 0 13m 0/1 PodInitializing 0 7s coredns-86c58d9df4-4g7dd 0/1 ContainerCreating 0 8m57s coredns-86c58d9df4-4l6b2 0/1 ContainerCreating 0

cli/releases/download/${CILIUM_CLI_VERSION}/cilium- darwin-${CLI_ARCH}.tar.gz{,.sha256sum} shasum -a 256 -c cilium-darwin-${CLI_ARCH}.tar.gz.sha256sum sudo tar xzvfC cilium-darwin-${CLI_ARCH}.tar.gz /usr/local/bin '' | awk '{print "-n "$1" "$2}' | xargs -L 1 -r kubectl delete pod pod "event-exporter-v0.2.3-f9c896d75-cbvcz" deleted pod "fluentd-gcp-scaler-69d79984cb-nfwwk" deleted pod "heapster-v1.6.0-beta.1-56d5d5d87f-qw8pv" 5-n6m5k" deleted pod "l7-default-backend-6f8697844f-d2rq2" deleted pod "metrics-server-v0.3.1-54699c9cc8-7l5w2" deleted Note This may error out on macOS due to -r being unsupported by xargs. In this

a node Troubleshoo�ng Component & Cluster Health Connec�vity Problems Policy Troubleshoo�ng Automa�c Diagnosis Symptom Library Useful Scripts Repor�ng a problem Community Special Interest Groups All args/cni-network/cni.conf curl https://raw.githubusercontent.com/cilium/cilium/v1.5/plugins/cilium-c systemctl restart snap.microk8s.daemon-containerd.service systemctl restart snap.microk8s.daemon-apiserver 0/1 PodInitializing 0 coredns-86c58d9df4-4g7dd 0/1 ContainerCreating 0 coredns-86c58d9df4-4l6b2 0/1 ContainerCreating 0

(2) is local port open? (3) pick echo service socket Ncat socket (1) (4) echo_dispatch.bpf.c - BPF sk_lookup program /* Declare BPF maps */ struct bpf_map_def SEC("maps") echo_ports = { .key_size = sizeof(__u32), .value_size = sizeof(__u64), }; echo_dispatch.bpf.c - BPF sk_lookup program SEC("sk_lookup/echo_dispatch") int echo_dispatch(struct bpf_sk_lookup *ctx) clang -I…/linux/usr/include -I…/linux/tools/lib -g -O2 -Wall -Wextra -target bpf -c -o echo_dispatch.bpf.o echo_dispatch.bpf.c # bpftool prog load echo_dispatch.bpf.o /sys/fs/bpf/echo_dispatch_prog # bpftool