toPorts: - ports: - port: "9042" protocol: TCP rules: l7proto: cassandra l7: - query_action: "select" query_table: "system\\. toPorts: - ports: - port: "9042" protocol: TCP rules: l7proto: cassandra l7: - {} A CiliumNetworkPolicy contains a list of rules that define a-wing toPorts: - ports: - port: '11211' protocol: TCP rules: l7proto: memcache l7: - command: get keyExact: awing-coord - command:

toPorts: - ports: - port: "9042" protocol: TCP rules: l7proto: cassandra l7: - query_action: "select" query_table: "system\\..*" toPorts: - ports: - port: "9042" protocol: TCP rules: l7proto: cassandra l7: - {} A CiliumNetworkPolicy contains a list of rules that define app: a-wing toPorts: - ports: - port: '11211' protocol: TCP rules: l7proto: memcache l7: - command: get keyExact: awing-coord - command: set

toPorts: - ports: - port: "9042" protocol: TCP rules: l7proto: cassandra l7: - query_action: "select" query_table: "system\\..*" toPorts: - ports: - port: "9042" protocol: TCP rules: l7proto: cassandra l7: - {} A CiliumNetworkPolicy contains a list of rules that define app: a-wing toPorts: - ports: - port: '11211' protocol: TCP rules: l7proto: memcache l7: - command: get keyExact: awing-coord - command: set

toPorts: - ports: - port: "9042" protocol: TCP rules: l7proto: cassandra l7: - query_action: "select" query_table: "system\\..*" toPorts: - ports: - port: "9042" protocol: TCP rules: l7proto: cassandra l7: - {} A CiliumNetworkPolicy contains a list of rules that define app: a-wing toPorts: - ports: - port: '11211' protocol: TCP rules: l7proto: memcache l7: - command: get keyExact: awing-coord - command: set

toPorts: - ports: - port: "9042" protocol: TCP rules: l7proto: cassandra l7: - query_action: "select" query_table: "system\\..*" toPorts: - ports: - port: "9042" protocol: TCP rules: l7proto: cassandra l7: - {} A CiliumNetworkPolicy contains a list of rules that define app: a-wing toPorts: - ports: - port: '11211' protocol: TCP rules: l7proto: memcache l7: - command: get keyExact: awing-coord - command: set

toPorts: - ports: - port: "9042" protocol: TCP rules: l7proto: cassandra l7: - query_action: "select" query_table: "system\\..*" toPorts: - ports: - port: "9042" protocol: TCP rules: l7proto: cassandra l7: - {} A CiliumNetworkPolicy contains a list of rules that define app: a-wing toPorts: - ports: - port: '11211' protocol: TCP rules: l7proto: memcache l7: - command: get keyExact: awing-coord - command: set

toPorts: - ports: - port: "9042" protocol: TCP rules: l7proto: cassandra l7: - query_action: "select" query_table: "system\\..*" toPorts: - ports: - port: "9042" protocol: TCP rules: l7proto: cassandra l7: - {} A CiliumNetworkPolicy contains a list of rules that define app: a-wing toPorts: - ports: - port: '11211' protocol: TCP rules: l7proto: memcache l7: - command: get keyExact: awing-coord - command: set

发。 Kubernetes下的可观测 Golang + eBPF实现数据采 集 第四部分 eBPF在可观测领域的优势 无侵入 多语言/多协议/多框架 全栈覆盖 无侵入性 • 无需修改代码 • 无需重启应用 • Verifier保证运行安全 多协议、多框架、多语言 • 捕获网络字节流 • 无需适配编程语言 • 无需适配协议框架 • 同时支持用户态插桩 全栈覆盖 ✅ uprobe 应用监控eBPF版 • eBPF Agent性能提升20% • Otel Collector 性能提升80% • 无需要修改任何业务代码，一键接入eBPF监控 • 语言无关、框架无关、协议无关 无侵入的应用可观测 eBPF是一种在Linux内核运行的沙盒程序，无需修改 任何应用代码，提供无侵入的应用无关、语言无关、 框架无关的应用可观测能力，提供如网络、虚拟内存、 系统调用等Otel无法获取的数据指标。

定程度的影响规则更新的时间， 这些都会引入的TPS波动 Cilium policy采用了 identity 标识来进行 L3 - L4 policy 决策。 • 根据Cilium endpoint 的 label， 计算生成集群唯一的identity，意味着 pod 的 IP 变更，不需要引起 policy 信息的同步，有效降低信息同步频率。 • 多个相同policy策略的endpoint可以共用一个identity，例如同一