? ? In This Talk… • Different “types” of BPF programs • Write BPF programs in Rust • Add new feature in RedBPF • Use BPF maps to make stateful decisions • Load the program and protect the Rabbit(MQ) Rabbit(MQ)! About Me • Software Engineer @ CCP Games • @aquarhead on GitHub, Twitter… • Rust (and Elixir) • Disclaimer: new to BPF & kernel networking, pardon my mistake and welcome corrections • RedBPF uses Rust for both in-kernel and user- space programs - benefits from LLVM integration • Rust: expressive type system, modern toolchain - but most importantly, I love Rust! • For networking

eBPF programs to be loaded in the form of bytecode. Typically, eBPF developers write programs in C, Rust, or other languages, which are then compiled into eBPF bytecode. eBPF programs can be loaded into under the hood, making them go full steam. eBPF now has a variety of libraries written in Golang, Rust, C++, and others that help loading, compiling, and debugging eBPF programs across both user and kernel 4.0 International (CC-BY-4.0). See https://phippy.io The crab is based on Ferris, the unofficial Rust mascot, designed by Karen Rustad Tölva. It is licensed under Creative Commons Zero (CC0-1.0, Public

、稳定性。 From:https://zhuanlan.zhihu.com/p/507388164 微服务可观测的挑战 第三部分 微服务可观测的挑战 应用：微服务架构、多语言、多协议 挑战1：微服务、多语言、多协议环境下，端到端观测 复杂度上升，埋点成本居高不下 Kubernetes 容器 网络、操作系统、硬件 基础设施层复杂度日益增加 如何关联? 挑战3：数据散落，工具多， Kubernetes下的可观测 Golang + eBPF实现数据采 集 第四部分 eBPF在可观测领域的优势 无侵入 多语言/多协议/多框架 全栈覆盖 无侵入性 • 无需修改代码 • 无需重启应用 • Verifier保证运行安全 多协议、多框架、多语言 • 捕获网络字节流 • 无需适配编程语言 • 无需适配协议框架 • 同时支持用户态插桩 全栈覆盖 ✅ uprobe ✅ kprobe ✅ • 无需要修改任何业务代码，一键接入eBPF监控 • 语言无关、框架无关、协议无关 无侵入的应用可观测 eBPF是一种在Linux内核运行的沙盒程序，无需修改 任何应用代码，提供无侵入的应用无关、语言无关、 框架无关的应用可观测能力，提供如网络、虚拟内存、 系统调用等Otel无法获取的数据指标。 新版控制台体验升级 • 提供多语言的无侵入的应用CPU热点查看 • 监控网络异常，如TCP