joules_total 主机组件的累积能源消耗，容器使用的 CPU 和 DRAM 除外。通常，这个指标是 ACPI 主机的能源消耗。 kepler_container_bpf_cpu_time_us_total 使用 BPF 跟踪的容器使用的总 CPU 时间。 kepler_container_cpu_cycles_total 使用硬件计数器的容器使用的总 CPU 周期。CPU 周 期是与 CPU kepler_container_bpf_net_tx_irq_total 传送到使用 BPF 跟踪的容器的网卡的数据包总数。 kepler_container_bpf_net_rx_irq_total 从容器网卡接收的数据包总数，使用 BPF 跟踪。 指 指标 标名称 名称 描述 描述 第 第 5 章 章 视觉 视觉化 化电 电源 源监 监控指 控指标 标 13 kepler_container_bpf_block_irq_total ck_irq_total 使用 BPF 跟踪的容器的块 I/O 调用总数。 kepler_node_info 节点元数据，如节点 CPU 架构。 kepler_node_core_joules_total 在节点和操作系统上运行的所有容器使用的 CPU 内核 使用的总能源消耗。 kepler_node_uncore_joules_total 由在节点和操作系统上运行的所有容器使用的、非核 心

Conntrack Pre-route route IPVS entry Post-route Iptables snat Conntrack Post-route Pre-route IPVS entry BPF SNAT IPVS mode data path IPVS-eBPF mode data path How eBPF does SNAT • Why does SNAT with eBPF NodePort +64% -47% +22% Test result • Perf shows number of instructions per request drops by 38% IPVS-BPF IPVS 0 20000 40000 60000 80000 100000 120000 140000 160000 180000 Nodeport short connection #param unroll • Size limitation of BPF program <= 4096 • Move SNAT allocate port loop into IPVS kernel module • Bounded loop support in Linux 5.3 • Size limitation of BPF program is one million after Linux

Knowledge Prog type ● SOCK_OPS ➢ Set callbacks for TCP state changing ➢ Help functions: BPF_MAP_UPDATE_ELEM, BPF_SOCK_HASH_UPDATE ● SK_MSG ➢ Attach to a SOCKHASH map, capture the packets sent by a socket socket in SOCKHASH map and determine its destination socket ➢ Help functions: BPF_MSG_REDIRECT_HASH Istio Meetup China Work Flow of Acceleration ● sock_ops o Capture socket in specific states and

sealfs 直接从容器拦截 IO，对接 sealfs 分布式文件系统，避免 fuse 用户态内核态反复横跳 在 Sealos 上使用 GPU 在 Sealos 上利用 Cilium + BPF 实现流量统计 Slide source credit to: How to Make Linux Microservice-Aware with Cilium and eBPF (InfoQ, 2019)

growing complexity © 2021, YUNSHAN Networks Technology Co., Ltd. All rights reserved. 实战 实战1 采集器怎么运行 实战2 BPF和eBPF怎么配合 实战3 如何与eBPF交互 实战4 eBPF kprobe挂在哪 实战5 eBPF uprobe挂在哪 实战6 怎样编码 实战7 怎样传输 实战8 怎样打标签 实战9 怎样存储与检索

interfaces report operstate UP only when they have VMs at- tached (bug #14526) • Mac OS X hosts: fix bpf capture and accounting of traffic on bridged and host-only inter- faces (bug #14553) • Windows guests:

interfaces report operstate UP only when they have VMs at- tached (bug #14526) • Mac OS X hosts: fix bpf capture and accounting of traffic on bridged and host-only inter- faces (bug #14553) • Windows guests:

interfaces report operstate UP only when they have VMs at- tached (bug #14526) • Mac OS X hosts: fix bpf capture and accounting of traffic on bridged and host-only inter- faces (bug #14553) • Windows guests:

interfaces report operstate UP only when they have VMs at- tached (bug #14526) • Mac OS X hosts: fix bpf capture and accounting of traffic on bridged and host-only inter- faces (bug #14553) • Windows guests:

interfaces report operstate UP only when they have VMs at- tached (bug #14526) • Mac OS X hosts: fix bpf capture and accounting of traffic on bridged and host-only inter- faces (bug #14553) • Windows guests: