Debugging the BPF Virtual Machine Lorenzo Fontana October 28, 2020 ● Debugging is useful to understand how things work ● Sometimes, eBPF programs can’t even load ● I couldn’t find good resources on this this, so, here I am ● I break lots of eBPF programs ● The BPF Virtual machine is not easy to understand Why ? The BPF subsystem lives in the kernel AND The kernel can be debugged using gdb The

source host. For east-west type load balancing, Cilium performs efficient service-to-backend translation right in the Linux kernel’s socket layer (e.g. at TCP connect time) such that per-packet NAT operations CLUSTER_ZONE=us-west2-a gcloud container clusters create $CLUSTER_NAME --image-type COS --num- nodes 2 --machine-type n1-standard-4 --zone $CLUSTER_ZONE Retrieve the credentials to access the cluster: gcloud policies. It is a detailed walk-through of getting a single-node Cilium environment running on your machine. It is designed to take 15-30 minutes. If you haven’t read the Introduction to Cilium & Hubble yet

source host. For east-west type load balancing, Cilium performs efficient service-to-backend translation right in the Linux kernel’s socket layer (e.g. at TCP connect time) such that per-packet NAT operations In order to access the Hubble API, create a port forward to the Hubble service from your local machine. This will allow you to connect the Hubble client to the local port 4245 and access the Hubble Relay to the hubble-ui service in your Kubernetes cluster and make it available on a local port on your machine. cilium hubble ui Forwarding from 0.0.0.0:12000 -> 8081 Forwarding from [::]:12000 -> 8081 Tip

source host. For east-west type load balancing, Cilium performs efficient service-to-backend translation right in the Linux kernel’s socket layer (e.g. at TCP connect time) such that per-packet NAT operations In order to access the Hubble API, create a port forward to the Hubble service from your local machine. This will allow you to connect the Hubble client to the local port 4245 and access the Hubble Relay to the hubble-ui service in your Kubernetes cluster and make it available on a local port on your machine. cilium hubble ui Forwarding from 0.0.0.0:12000 -> 8081 Forwarding from [::]:12000 -> 8081 Tip

CLUSTER_ZONE=us-west2-a gcloud container clusters create $CLUSTER_NAME --image-type COS --num- nodes 2 --machine-type n1-standard-4 --zone $CLUSTER_ZONE Retrieve the credentials to access the cluster: gcloud policies. It is a detailed walk-through of getting a single-node Cilium environment running on your machine. It is designed to take 15-30 minutes. If you haven’t read the Introduction to Cilium & Hubble yet policies. It is a detailed walk-through of getting a single-node Cilium environment running on your machine. It is designed to take 15-30 minutes. If you haven’t read the Introduction to Cilium & Hubble yet

policies. It is a detailed walk-through of getting a single-node Cilium environment running on your machine. It is designed to take 15-30 minutes. If you haven’t read the Introduction to Cilium yet, we’d policies. It is a detailed walk-through of getting a single-node Cilium environment running on your machine. It is designed to take 15-30 minutes. If you haven’t read the Introduction to Cilium yet, we’d policies. It is a detailed walk-through of getting a single-node Cilium environment running on your machine. It is designed to take 15-30 minutes. If you haven’t read the Introduction to Cilium yet, we’d

policies. It is a detailed walk-through of getting a single-node Cilium environment running on your machine. It is designed to take 15-30 minutes. If you haven’t read the Introduction to Cilium yet, we’d policies. It is a detailed walk-through of getting a single-node Cilium environment running on your machine. It is designed to take 15-30 minutes. If you haven’t read the Introduction to Cilium yet, we’d policies. It is a detailed walk-through of getting a single-node Cilium environment running on your machine. It is designed to take 15-30 minutes. If you haven’t read the Introduction to Cilium yet, we’d

policies. It is a detailed walk-through of ge�ng a single-node Cilium environment running on your machine. It is designed to take 15-30 minutes. If you haven’t read the Introduc�on to Cilium yet, we’d encourage policies. It is a detailed walk-through of ge�ng a single-node Cilium environment running on your machine. It is designed to take 15-30 minutes. If you haven’t read the Introduc�on to Cilium yet, we’d encourage policies. It is a detailed walk-through of ge�ng a single-node Cilium environment running on your machine. It is designed to take 15-30 minutes. If you haven’t read the Introduc�on to Cilium yet, we’d encourage

The Just-in-Time (JIT) compilation step translates the generic bytecode of the program into the machine-specific instruction set to optimize execution speed. This makes eBPF programs run as efficiently