Lessons Learned Migrating to Modern Multi-Platform eBPF Programs
Talkat Cilium + eBPF Day North America 2024 · on Tuesday, 2024-11-12· at 15:55· Salt Palace | Level 1 | Grand Ballroom B·
summary
Kepler migrates from BCC’s runtime LLVM compile to ahead-of-time object files using libbpf and the cilium/ebpf ecosystem with bpf2go to embed ELF and autogenerate map structs. VMLinux blobs (3 MB each) are removed by switching to BTF raw tracepoints and fexit plus CO-RE relocations, producing only two endianness builds instead of many kernel-specific probes. Packaging shrinks from a ~217 MB BCC dependency, eBPF unit tests and benchmarks show ~2.8 µs probe latency, and ring buffer streaming needs careful tuning to avoid 100% user CPU.
AI-written summary · about
chapters (11)
- 0:00eBPF migration challenges
- 1:02What is Kepler and eBPF
- 4:40Why Kepler modernized eBPF
- 6:50BCC to libbpf for portability
- 9:21Initial libbpf migration challenges
- 12:12Modern kernel and multi-platform goals
- 13:37Removing VM Linux and BTF trace points
- 17:29Kernel version differences with BPF CO-RE
- 18:33Modernizing user space with Cilium eBPF
- 20:42Benefits from Cilium eBPF
- 23:55Summary and conclusion
related talks
38mThe Next Linux Superpower: eBPF Primer
28mDeveloping Modern eBPF Applications
35mBumbleBee: Or How I Learned To Stop Worrying And Love eBPF - Krisztian Fekete
47mBPF: The Status of BTF, producers, consumers.
48mInto the hive of eBPF!
27mLow-Overhead Tracing Using eBPF for Observability into Kubernetes Apps and Services
34mBeyond the Hype: Cloud Native eBPF
32meBPF: BPF kernel infrastructure