策略执行的替代品， Istio 的 RBAC 也是可以满足一部分功能的，比如服务白名 单我们就是通过 RBAC 来实现21/24 规划与展望 /0422/24 性能优化方向 • 方案1: 采用 eBPF/xDP(sockops)，优化路径为 SVC <-> Envoy，延迟性能提升10-20%。 Envoy 部署方式 per-pod，跟社区方向一致，也是目前严选采用的部署方案。 • 方案2: 采用 DPDK+Fstack

级（QUIC，MQTT，国密）， 云原生 再启程 03前世 F5 BigIP Netscaler自研四层网络代理 2011 2014 2018 未来 Ø 全面使用DPDK技术重构 Ø EBPF，XDP Ø 可编程交换芯片（P4语言） Ø 四层负载均衡-IPVS Ø NAT网关蚂蚁七层网络代理 Google Spanner?蚂蚁七层网络接入代理 Spanner蚂蚁七层网络接入代理 AGNA

12之前 initial RTO是⼀个常数1s • 应⽤类型BPF_PROG_TYPE_SOCK_OPS • HOOK BPF_SOCK_OPS_TIMEOUT_INIT • 内核中调⽤栈 • tcp_timeout_init • tcp_call_bpf(BPF_SOCK_OPS_TIMEOUT_INI T) • bpf_cgrougp_run_sock_ops • … • 写cache流程基于inode cache优化 • bpf程序类型 BPF_PROG_TYPE_EXTFUSE • Hook点及⽅法 • fuse_request_send • FUSE_LOOKUP / FUSE_GETATTR / FUSE_SETATTR / • map 结构 • dentry map BPF_MAP_TYPE_HASH • key (inode (inode id, node name) • value inode id • inode map BPF_MAP_TYPE_HASH • key inode id • value fuse_attr (⽂件属性)基于data cache部分 • bpf程序类型 BPF_PROG_TYPE_EXTFUSE • Hook点及⽅法 • fuse_file_read_iter, fuse_file_write_iter

sealfs 直接从容器拦截 IO，对接 sealfs 分布式文件系统，避免 fuse 用户态内核态反复横跳 在 Sealos 上使用 GPU 在 Sealos 上利用 Cilium + BPF 实现流量统计 Slide source credit to: How to Make Linux Microservice-Aware with Cilium and eBPF (InfoQ, 2019)

growing complexity © 2021, YUNSHAN Networks Technology Co., Ltd. All rights reserved. 实战 实战1 采集器怎么运行 实战2 BPF和eBPF怎么配合 实战3 如何与eBPF交互 实战4 eBPF kprobe挂在哪 实战5 eBPF uprobe挂在哪 实战6 怎样编码 实战7 怎样传输 实战8 怎样打标签 实战9 怎样存储与检索

interfaces report operstate UP only when they have VMs at- tached (bug #14526) • Mac OS X hosts: fix bpf capture and accounting of traffic on bridged and host-only inter- faces (bug #14553) • Windows guests:

interfaces report operstate UP only when they have VMs at- tached (bug #14526) • Mac OS X hosts: fix bpf capture and accounting of traffic on bridged and host-only inter- faces (bug #14553) • Windows guests:

supported Berkeley Packet Filter (BPF). Therefore, you can choose proper tools to conduct an in-depth analysis based on the results in In 60 seconds. Compared with perf/ftrace, BPF provides programmability and performance overhead. Compared with kprobe, BPF provides higher security and is more suitable for the production environments. For detailed usage of the BCC toolkit, see BPF Compiler Collection (BCC). 1857 11

supported Berkeley Packet Filter (BPF). Therefore, you can choose proper tools to conduct an in-depth analysis based on the results in In 60 seconds. Compared with perf/ftrace, BPF provides programmability and performance overhead. Compared with kprobe, BPF provides higher security and is more suitable for the production environments. For detailed usage of the BCC toolkit, see BPF Compiler Collection (BCC). 1438 11

supported Berkeley Packet Filter (BPF). Therefore, you can choose proper tools to conduct an in-depth analysis based on the results in In 60 seconds. Compared with perf/ftrace, BPF provides programmability and performance overhead. Compared with kprobe, BPF provides higher security and is more suitable for the production environments. For detailed usage of the BCC toolkit, see BPF Compiler Collection (BCC). 1446 11