BumbleBee: 如丝般顺滑构建、交付和运行 eBPF 程序

1

$ bee build probe.c username/my_probe:v1

1
2
3
4
5

# 推送
$ bee push username/my_probe:v1 

# 拉取
$ bee pull username/my_probe:v1 

1

$ bee run my_probe:v1

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

ubuntu@ubuntu21-10:~# curl -sL https://run.solo.io/bee/install | BUMBLEBEE_VERSION=v0.0.9 sh
Attempting to download bee version v0.0.9
Downloading bee-linux-amd64...
Download complete!, validating checksum...
Checksum valid.
bee was successfully installed 🎉

Add the bumblebee CLI to your path with:
  export PATH=$HOME/.bumblebee/bin:$PATH

Now run:
  bee init     # Initialize simple eBPF program to run with bee
Please see visit the bumblebee website for more info:  https://github.com/solo-io/bumblebee

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

# bee --help
Usage:
  bee [command]

Available Commands:
  build       Build a BPF program, and save it to an OCI image representation.
  completion  generate the autocompletion script for the specified shell
  describe    Describe a BPF program via it's OCI ref
  help        Help about any command
  init        Initialize a sample BPF program
  list
  login       Log in so you can push images to the remote server.
  pull
  push
  run         Run a BPF program file or OCI image.
  tag
  version

Flags:
  -c, --config stringArray   path to auth configs
      --config-dir string    Directory to bumblebee configuration (default "/root/.bumblebee")
  -h, --help                 help for bee
      --insecure             allow connections to SSL registry without certs
  -p, --password string      registry password
      --plain-http           use plain http and not https
      --storage string       Directory to store OCI images locally (default "/root/.bumblebee/store")
  -u, --username string      registry username
  -v, --verbose              verbose output

Use "bee [command] --help" for more information about a command.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46

$ export PATH=$HOME/.bumblebee/bin:$PATH
# ebpf-test && cd ebpf-test
# bee init
Use the arrow keys to navigate: ↓ ↑ → ←  
? What language do you wish to use for the filter: # 步骤 选择编写 eBPF 代码的语言
  ▸ C   # 当前仅支持 C，Rust 可能在未来支持
---------------------------------------------  # 步骤 2 选择 eBPF 程序类型
 INFO  Selected Language: C
Use the arrow keys to navigate: ↓ ↑ → ←
? What type of program to initialize: 
  ▸ Network        # 选择编写 eBPF 程序的类型，当前支持 Network 和 File System
    File system    # 生成的模板分别对应于 tcp_connet 和 open 函数
--------------------------------------------- # 步骤 3  选择 map 类型 
 INFO  Selected Language: C
 INFO  Selected Program Type: Network
Use the arrow keys to navigate: ↓ ↑ → ←
? What type of map should we initialize: 
  ▸ RingBuffer     
    HashMap
 --------------------------------------------- # 步骤 4 选择 map 导出类型
 INFO  Selected Language: C
 INFO  Selected Program Type: Network
 INFO  Selected Map Type: HashMap
Use the arrow keys to navigate: ↓ ↑ → ←  
? What type of output would you like from your map:
  ▸ print    # map 数据的展现方式，日志打印、计数或者指标导出
    counter
    gauge
 ---------------------------------------------  # 步骤 5 eBPF 程序保存文件名
 INFO  Selected Language: C 
 INFO  Selected Program Type: Network
 INFO  Selected Map Type: HashMap
 INFO  Selected Output Type: print
✔ BPF Program File Location: probe.c  
 ---------------------------------------------- # 最终完成整个代码生成向导
 INFO  Selected Language: C
 INFO  Selected Program Type: Network
 INFO  Selected Map Type: HashMap
 INFO  Selected Output Type: print
 INFO  Selected Output Type: BPF Program File Location probe.c
 SUCCESS  Successfully wrote skeleton BPF program  
 
 
# ls -hl
total 4.0K
-rw-rw-r-- 1 ubuntu ubuntu 2.0K Feb 11 11:33 probe.c

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

#include "vmlinux.h"
#include "bpf/bpf_helpers.h"
#include "bpf/bpf_core_read.h"
#include "bpf/bpf_tracing.h"
#include "solo_types.h"

// 1. Change the license if necessary 
char __license[] SEC("license") = "Dual MIT/GPL";

struct event_t {
	// 2. Add ringbuf struct data here.
} __attribute__((packed));

// This is the definition for the global map which both our
// bpf program and user space program can access.
// More info and map types can be found here: https://www.man7.org/linux/man-pages/man2/bpf.2.html
struct {
	__uint(max_entries, 1 << 24);
	__uint(type, BPF_MAP_TYPE_RINGBUF);
	__type(value, struct event_t);
} events SEC(".maps.print");


SEC("kprobe/tcp_v4_connect")
int BPF_KPROBE(tcp_v4_connect, struct sock *sk)
{
	// Init event pointer
	struct event_t *event;

	// Reserve a spot in the ringbuffer for our event
	event = bpf_ringbuf_reserve(&events, sizeof(struct event_t), 0);
	if (!event) {
		return 0;
	}

	// 3. set data for our event,
	// For example:
	// event->pid = bpf_get_current_pid_tgid();

	bpf_ringbuf_submit(event, 0);

	return 0;
}

1
2
3
4
5

# apt  install docker.io  # 安装 docker

# bee build probe.c my_probe:v1
 SUCCESS  Successfully compiled "probe.c" and wrote it to "probe.o"
 SUCCESS  Saved BPF OCI image to my_probe:v1 

1
2
3

# bee tag my_probe:v1 dwh0403/my_probe:v1
# bee login
# bee push dwh0403/my_probe:v1

1
2
3
4
5

# bee run my_probe:v1
 SUCCESS  Fetching program from registry: my_probe:v1
 SUCCESS  Loading BPF program and maps into Kernel
 SUCCESS  Linking BPF functions to associated probe/tracepoint
 INFO  Rendering TUI..