Introducing The eBPF Agent: A No-Code Approach for Cloud-Native Observability#

1
graph TB
2
    subgraph "DX Operational Observability Platform"
3
        subgraph "Data Collection Layer"
4
            UMA[Universal Monitoring Agent] --> eBPF[eBPF Agent]
5
            UMA --> Traditional[Traditional Agents]
6
            UMA --> Synthetic[Synthetic Monitoring]
7
        end
8

9
        subgraph "Processing Layer"
10
            eBPF --> Correlation[Data Correlation Engine]
11
            Traditional --> Correlation
12
            Synthetic --> Correlation
13
            Correlation --> AI[AI/ML Analytics]
14
        end
15

16
        subgraph "Insights Layer"
17
            AI --> Dashboards[Real-time Dashboards]
18
            AI --> Alerts[Intelligent Alerting]
19
            AI --> Recommendations[Actionable Recommendations]
20
        end
21

22
        subgraph "Integration Layer"
23
            Dashboards --> APIs[REST APIs]
24
            Alerts --> Webhooks[Webhook Integration]
25
            Recommendations --> Automation[Automation Workflows]
26
        end
27
    end
28

29
    style eBPF fill:#e1f5fe
30
    style AI fill:#f3e5f5
31
    style Dashboards fill:#e8f5e8

1
// Example: Dynamic HTTP request monitoring
2
#include <vmlinux.h>
3
#include <bpf/bpf_helpers.h>
4
#include <bpf/bpf_tracing.h>
5

6
// HTTP request tracking structure
7
struct http_request {
8
    __u32 pid;
9
    __u32 tid;
10
    __u64 timestamp;
11
    __u32 container_id;
12
    __u16 port;
13
    __u8 method;  // GET=1, POST=2, etc.
14
    char host[64];
15
    char path[128];
16
};
17

18
// Ring buffer for event streaming
19
struct {
20
    __uint(type, BPF_MAP_TYPE_RINGBUF);
21
    __uint(max_entries, 1024 * 1024);
22
} http_events SEC(".maps");
23

24
// Hook into socket operations for HTTP detection
25
SEC("uprobe/connect")
26
int trace_connect(struct pt_regs *ctx) {
27
    struct sockaddr *addr = (struct sockaddr *)PT_REGS_PARM2(ctx);
28

29
    if (!addr) return 0;
30

31
    // Extract connection information
32
    __u32 pid = bpf_get_current_pid_tgid() >> 32;
33
    __u64 timestamp = bpf_ktime_get_ns();
34

35
    // Create HTTP request event
36
    struct http_request *event = bpf_ringbuf_reserve(&http_events,
37
                                                    sizeof(*event), 0);
38
    if (!event) return 0;
39

40
    event->pid = pid;
41
    event->tid = (__u32)bpf_get_current_pid_tgid();
42
    event->timestamp = timestamp;
43
    event->container_id = get_container_id();
44

45
    // Extract port information
46
    if (addr->sa_family == AF_INET) {
47
        struct sockaddr_in *sin = (struct sockaddr_in *)addr;
48
        event->port = bpf_ntohs(BPF_CORE_READ(sin, sin_port));
49
    }
50

51
    bpf_ringbuf_submit(event, 0);
52
    return 0;
53
}
54

55
// Helper function to get container ID from cgroup
56
static __u32 get_container_id() {
57
    struct task_struct *task = (struct task_struct *)bpf_get_current_task();
58
    // Simplified container ID extraction
59
    return bpf_get_current_pid_tgid() >> 32;
60
}
61

62
char _license[] SEC("license") = "GPL";

1
graph TB
2
    subgraph "Three Key Performance Indicators"
3
        KPI1[Responses per Interval] --> Metrics[Application Health KPIs]
4
        KPI2[Errors per Interval] --> Metrics
5
        KPI3[Average Response Time] --> Metrics
6

7
        subgraph "Collection Method"
8
            Metrics --> Kernel[Kernel-Level API Calls]
9
            Kernel --> Consistent[Consistent Across All Hosts]
10
            Consistent --> Uniform[Uniform Metric Collection]
11
        end
12

13
        subgraph "Benefits"
14
            Uniform --> Reliability[Reliable Monitoring]
15
            Uniform --> Correlation[Cross-Host Correlation]
16
            Uniform --> Scalability[Massive Scale Support]
17
        end
18
    end
19

20
    style Metrics fill:#e1f5fe
21
    style Uniform fill:#c8e6c9
22
    style Reliability fill:#c8e6c9

1
graph TB
2
    subgraph "Universal Language Support"
3
        subgraph "Supported Languages"
4
            L1[Java Applications] --> eBPF[eBPF Agent]
5
            L2[.NET Applications] --> eBPF
6
            L3[PHP Applications] --> eBPF
7
            L4[Node.js Applications] --> eBPF
8
            L5[Python Applications] --> eBPF
9
            L6[Go Applications] --> eBPF
10
            L7[C++ Applications] --> eBPF
11
        end
12

13
        subgraph "Monitoring Capabilities"
14
            eBPF --> Topology[Application Flow Topology]
15
            eBPF --> Correlation[Full Stack Correlation]
16
            eBPF --> Insights[Intuitive Insights]
17
        end
18

19
        subgraph "Business Value"
20
            Topology --> StandardMonitoring[Standardized Monitoring]
21
            Correlation --> ReducedComplexity[Reduced Complexity]
22
            Insights --> FasterTTR[Faster Time to Resolution]
23
        end
24
    end
25

26
    style eBPF fill:#e1f5fe
27
    style StandardMonitoring fill:#c8e6c9
28
    style ReducedComplexity fill:#c8e6c9
29
    style FasterTTR fill:#c8e6c9

1
graph LR
2
    subgraph "Zero Overhead Design"
3
        subgraph "Traditional Monitoring"
4
            T1[In-Process Agent] --> T2[Application Pod]
5
            T2 --> T3[Resource Competition]
6
            T3 --> T4[Performance Impact]
7
        end
8

9
        subgraph "eBPF Monitoring"
10
            E1[eBPF Agent] --> E2[Outside Application Pod]
11
            E2 --> E3[Dedicated Resources]
12
            E3 --> E4[No Performance Impact]
13
        end
14
    end
15

16
    style T3 fill:#ffcdd2
17
    style T4 fill:#ffcdd2
18
    style E3 fill:#c8e6c9
19
    style E4 fill:#c8e6c9

1
# Universal Monitoring Agent DaemonSet
2
apiVersion: apps/v1
3
kind: DaemonSet
4
metadata:
5
  name: dx-uma-ebpf-agent
6
  namespace: dx-observability
7
spec:
8
  selector:
9
    matchLabels:
10
      app: dx-uma-ebpf-agent
11
  template:
12
    metadata:
13
      labels:
14
        app: dx-uma-ebpf-agent
15
    spec:
16
      hostNetwork: true
17
      hostPID: true
18
      serviceAccountName: dx-uma-ebpf-agent
19
      containers:
20
        - name: app-container-monitor
21
          image: broadcom/dx-uma-ebpf:latest
22
          securityContext:
23
            privileged: true
24
            capabilities:
25
              add: ["SYS_ADMIN", "BPF", "SYS_PTRACE"]
26
          env:
27
            - name: DX_TENANT_ID
28
              valueFrom:
29
                secretKeyRef:
30
                  name: dx-credentials
31
                  key: tenant-id
32
            - name: DX_API_TOKEN
33
              valueFrom:
34
                secretKeyRef:
35
                  name: dx-credentials
36
                  key: api-token
37
            - name: CLUSTER_NAME
38
              value: "production-cluster"
39
            - name: NODE_NAME
40
              valueFrom:
41
                fieldRef:
42
                  fieldPath: spec.nodeName
43
          resources:
44
            requests:
45
              cpu: 100m
46
              memory: 128Mi
47
            limits:
48
              cpu: 500m
49
              memory: 512Mi
50
          volumeMounts:
51
            - name: debugfs
52
              mountPath: /sys/kernel/debug
53
            - name: tracefs
54
              mountPath: /sys/kernel/tracing
55
            - name: bpf-maps
56
              mountPath: /sys/fs/bpf
57
            - name: proc
58
              mountPath: /host/proc
59
              readOnly: true
60
            - name: sys
61
              mountPath: /host/sys
62
              readOnly: true
63
      volumes:
64
        - name: debugfs
65
          hostPath:
66
            path: /sys/kernel/debug
67
        - name: tracefs
68
          hostPath:
69
            path: /sys/kernel/tracing
70
        - name: bpf-maps
71
          hostPath:
72
            path: /sys/fs/bpf
73
        - name: proc
74
          hostPath:
75
            path: /proc
76
        - name: sys
77
          hostPath:
78
            path: /sys
79
      tolerations:
80
        - operator: Exists
81
          effect: NoSchedule
82
---
83
apiVersion: v1
84
kind: ServiceAccount
85
metadata:
86
  name: dx-uma-ebpf-agent
87
  namespace: dx-observability
88
---
89
apiVersion: rbac.authorization.k8s.io/v1
90
kind: ClusterRole
91
metadata:
92
  name: dx-uma-ebpf-agent
93
rules:
94
  - apiGroups: [""]
95
    resources: ["pods", "nodes", "services", "endpoints"]
96
    verbs: ["get", "list", "watch"]
97
  - apiGroups: ["apps"]
98
    resources: ["deployments", "replicasets", "daemonsets"]
99
    verbs: ["get", "list", "watch"]
100
---
101
apiVersion: rbac.authorization.k8s.io/v1
102
kind: ClusterRoleBinding
103
metadata:
104
  name: dx-uma-ebpf-agent
105
roleRef:
106
  apiGroup: rbac.authorization.k8s.io
107
  kind: ClusterRole
108
  name: dx-uma-ebpf-agent
109
subjects:
110
  - kind: ServiceAccount
111
    name: dx-uma-ebpf-agent
112
    namespace: dx-observability

1
// UMA automatic discovery implementation
2
package main
3

4
import (
5
    "context"
6
    "fmt"
7
    "log"
8
    "time"
9

10
    "k8s.io/client-go/kubernetes"
11
    "k8s.io/client-go/rest"
12
    metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
13
)
14

15
type UMADiscoveryAgent struct {
16
    k8sClient     kubernetes.Interface
17
    ebpfAgent     *eBPFAgent
18
    discoveredPods map[string]*PodInfo
19
    ticker        *time.Ticker
20
}
21

22
type PodInfo struct {
23
    Name          string
24
    Namespace     string
25
    ContainerID   string
26
    Language      string
27
    Ports         []int32
28
    Labels        map[string]string
29
    LastSeen      time.Time
30
}
31

32
func NewUMADiscoveryAgent() (*UMADiscoveryAgent, error) {
33
    // Create Kubernetes client from in-cluster config
34
    config, err := rest.InClusterConfig()
35
    if err != nil {
36
        return nil, fmt.Errorf("creating k8s config: %w", err)
37
    }
38

39
    clientset, err := kubernetes.NewForConfig(config)
40
    if err != nil {
41
        return nil, fmt.Errorf("creating k8s client: %w", err)
42
    }
43

44
    ebpfAgent, err := NeweBPFAgent()
45
    if err != nil {
46
        return nil, fmt.Errorf("creating eBPF agent: %w", err)
47
    }
48

49
    return &UMADiscoveryAgent{
50
        k8sClient:      clientset,
51
        ebpfAgent:      ebpfAgent,
52
        discoveredPods: make(map[string]*PodInfo),
53
        ticker:         time.NewTicker(30 * time.Second),
54
    }, nil
55
}
56

57
func (ua *UMADiscoveryAgent) Start(ctx context.Context) {
58
    log.Println("Starting UMA Discovery Agent...")
59

60
    // Initial discovery
61
    ua.discoverPods()
62

63
    // Start eBPF monitoring
64
    go ua.ebpfAgent.StartMonitoring(ctx)
65

66
    // Periodic discovery
67
    for {
68
        select {
69
        case <-ctx.Done():
70
            return
71
        case <-ua.ticker.C:
72
            ua.discoverPods()
73
        }
74
    }
75
}
76

77
func (ua *UMADiscoveryAgent) discoverPods() {
78
    pods, err := ua.k8sClient.CoreV1().Pods("").List(context.TODO(),
79
        metav1.ListOptions{})
80
    if err != nil {
81
        log.Printf("Error listing pods: %v", err)
82
        return
83
    }
84

85
    currentPods := make(map[string]*PodInfo)
86

87
    for _, pod := range pods.Items {
88
        if pod.Status.Phase != "Running" {
89
            continue
90
        }
91

92
        podKey := fmt.Sprintf("%s/%s", pod.Namespace, pod.Name)
93

94
        podInfo := &PodInfo{
95
            Name:      pod.Name,
96
            Namespace: pod.Namespace,
97
            Labels:    pod.Labels,
98
            LastSeen:  time.Now(),
99
        }
100

101
        // Extract container information
102
        for _, container := range pod.Spec.Containers {
103
            // Detect language from image or labels
104
            podInfo.Language = ua.detectLanguage(container.Image, pod.Labels)
105

106
            // Extract ports
107
            for _, port := range container.Ports {
108
                podInfo.Ports = append(podInfo.Ports, port.ContainerPort)
109
            }
110
        }
111

112
        // Get container ID from status
113
        if len(pod.Status.ContainerStatuses) > 0 {
114
            containerID := pod.Status.ContainerStatuses[0].ContainerID
115
            podInfo.ContainerID = ua.extractContainerID(containerID)
116
        }
117

118
        currentPods[podKey] = podInfo
119

120
        // Check if this is a new pod
121
        if _, exists := ua.discoveredPods[podKey]; !exists {
122
            log.Printf("Discovered new pod: %s (Language: %s)",
123
                      podKey, podInfo.Language)
124
            ua.configureBPFMonitoring(podInfo)
125
        }
126
    }
127

128
    // Remove pods that no longer exist
129
    for podKey, podInfo := range ua.discoveredPods {
130
        if _, exists := currentPods[podKey]; !exists {
131
            log.Printf("Pod removed: %s", podKey)
132
            ua.removeBPFMonitoring(podInfo)
133
        }
134
    }
135

136
    ua.discoveredPods = currentPods
137

138
    log.Printf("Discovery complete: monitoring %d pods", len(currentPods))
139
}
140

141
func (ua *UMADiscoveryAgent) detectLanguage(image string, labels map[string]string) string {
142
    // Check labels first
143
    if lang, exists := labels["app.language"]; exists {
144
        return lang
145
    }
146

147
    // Detect from image name
148
    imageLanguages := map[string]string{
149
        "java":       "java",
150
        "openjdk":    "java",
151
        "node":       "nodejs",
152
        "python":     "python",
153
        "golang":     "go",
154
        "go":         "go",
155
        "dotnet":     "dotnet",
156
        "php":        "php",
157
        "nginx":      "web",
158
        "apache":     "web",
159
    }
160

161
    for pattern, language := range imageLanguages {
162
        if strings.Contains(strings.ToLower(image), pattern) {
163
            return language
164
        }
165
    }
166

167
    return "unknown"
168
}
169

170
func (ua *UMADiscoveryAgent) configureBPFMonitoring(podInfo *PodInfo) {
171
    config := &eBPFMonitoringConfig{
172
        ContainerID: podInfo.ContainerID,
173
        Language:    podInfo.Language,
174
        Ports:       podInfo.Ports,
175
        Labels:      podInfo.Labels,
176
    }
177

178
    ua.ebpfAgent.AddMonitoringTarget(config)
179
}
180

181
func (ua *UMADiscoveryAgent) removeBPFMonitoring(podInfo *PodInfo) {
182
    ua.ebpfAgent.RemoveMonitoringTarget(podInfo.ContainerID)
183
}
184

185
func (ua *UMADiscoveryAgent) extractContainerID(fullID string) string {
186
    // Extract short container ID from full container ID
187
    // Format: docker://1a2b3c4d5e6f...
188
    parts := strings.Split(fullID, "://")
189
    if len(parts) == 2 && len(parts[1]) >= 12 {
190
        return parts[1][:12]
191
    }
192
    return fullID
193
}

1
// Application Flow Topology Construction
2
type ApplicationFlowTracker struct {
3
    serviceMap    map[string]*ServiceNode
4
    connections   map[string]*ConnectionFlow
5
    topology      *TopologyGraph
6
}
7

8
type ServiceNode struct {
9
    Name         string
10
    Namespace    string
11
    Language     string
12
    Version      string
13
    Endpoints    []string
14
    Dependencies []string
15
    Dependents   []string
16
    Metrics      *ServiceMetrics
17
}
18

19
type ConnectionFlow struct {
20
    Source      string
21
    Destination string
22
    Protocol    string
23
    Port        int32
24
    RequestRate float64
25
    ErrorRate   float64
26
    Latency     time.Duration
27
    LastSeen    time.Time
28
}
29

30
type ServiceMetrics struct {
31
    RequestsPerSecond float64
32
    ErrorsPerSecond   float64
33
    AverageLatency    time.Duration
34
    P95Latency        time.Duration
35
    P99Latency        time.Duration
36
}
37

38
func (aft *ApplicationFlowTracker) ProcessNetworkEvent(event *NetworkEvent) {
39
    sourceService := aft.getOrCreateService(event.SourcePod)
40
    destService := aft.getOrCreateService(event.DestinationPod)
41

42
    // Create or update connection flow
43
    flowKey := fmt.Sprintf("%s->%s:%d", sourceService.Name,
44
                          destService.Name, event.DestPort)
45

46
    flow, exists := aft.connections[flowKey]
47
    if !exists {
48
        flow = &ConnectionFlow{
49
            Source:      sourceService.Name,
50
            Destination: destService.Name,
51
            Protocol:    event.Protocol,
52
            Port:        event.DestPort,
53
        }
54
        aft.connections[flowKey] = flow
55

56
        // Update service dependencies
57
        sourceService.Dependencies = append(sourceService.Dependencies,
58
                                           destService.Name)
59
        destService.Dependents = append(destService.Dependents,
60
                                       sourceService.Name)
61
    }
62

63
    // Update flow metrics
64
    flow.RequestRate = aft.calculateRequestRate(flowKey)
65
    flow.ErrorRate = aft.calculateErrorRate(flowKey)
66
    flow.Latency = aft.calculateLatency(flowKey)
67
    flow.LastSeen = time.Now()
68

69
    // Update topology graph
70
    aft.updateTopologyGraph()
71
}
72

73
func (aft *ApplicationFlowTracker) updateTopologyGraph() {
74
    // Generate updated topology for visualization
75
    topology := &TopologyGraph{
76
        Nodes: make([]*TopologyNode, 0, len(aft.serviceMap)),
77
        Edges: make([]*TopologyEdge, 0, len(aft.connections)),
78
    }
79

80
    // Add service nodes
81
    for _, service := range aft.serviceMap {
82
        node := &TopologyNode{
83
            ID:       service.Name,
84
            Label:    service.Name,
85
            Language: service.Language,
86
            Metrics:  service.Metrics,
87
            Status:   aft.calculateServiceHealth(service),
88
        }
89
        topology.Nodes = append(topology.Nodes, node)
90
    }
91

92
    // Add connection edges
93
    for _, connection := range aft.connections {
94
        edge := &TopologyEdge{
95
            Source:      connection.Source,
96
            Destination: connection.Destination,
97
            Protocol:    connection.Protocol,
98
            Metrics:     connection,
99
            Health:      aft.calculateConnectionHealth(connection),
100
        }
101
        topology.Edges = append(topology.Edges, edge)
102
    }
103

104
    aft.topology = topology
105
}

1
// Real-time performance analytics engine
2
type PerformanceAnalytics struct {
3
    metricsBuffer   *RingBuffer
4
    aggregator      *MetricsAggregator
5
    anomalyDetector *AnomalyDetector
6
    alertManager    *AlertManager
7
}
8

9
type MetricsAggregator struct {
10
    windows map[time.Duration]*TimeWindow
11
}
12

13
type TimeWindow struct {
14
    Duration    time.Duration
15
    Buckets     []*MetricsBucket
16
    Current     int
17
    StartTime   time.Time
18
}
19

20
type MetricsBucket struct {
21
    Timestamp        time.Time
22
    RequestCount     int64
23
    ErrorCount       int64
24
    TotalLatency     time.Duration
25
    MinLatency       time.Duration
26
    MaxLatency       time.Duration
27
    LatencyHistogram map[time.Duration]int64
28
}
29

30
func (pa *PerformanceAnalytics) ProcessMetric(metric *PerformanceMetric) {
31
    // Add to buffer for real-time processing
32
    pa.metricsBuffer.Add(metric)
33

34
    // Aggregate into time windows
35
    pa.aggregator.AddMetric(metric)
36

37
    // Check for anomalies
38
    if anomaly := pa.anomalyDetector.Detect(metric); anomaly != nil {
39
        pa.alertManager.TriggerAlert(anomaly)
40
    }
41

42
    // Update real-time dashboards
43
    pa.updateRealTimeDashboard(metric)
44
}
45

46
func (ma *MetricsAggregator) AddMetric(metric *PerformanceMetric) {
47
    for duration, window := range ma.windows {
48
        bucket := window.GetCurrentBucket()
49

50
        // Update bucket metrics
51
        bucket.RequestCount++
52
        if metric.IsError {
53
            bucket.ErrorCount++
54
        }
55

56
        // Update latency statistics
57
        bucket.TotalLatency += metric.Latency
58
        if bucket.MinLatency == 0 || metric.Latency < bucket.MinLatency {
59
            bucket.MinLatency = metric.Latency
60
        }
61
        if metric.Latency > bucket.MaxLatency {
62
            bucket.MaxLatency = metric.Latency
63
        }
64

65
        // Update latency histogram
66
        latencyBucket := ma.getLatencyBucket(metric.Latency)
67
        bucket.LatencyHistogram[latencyBucket]++
68

69
        // Rotate window if needed
70
        if time.Since(bucket.Timestamp) >= duration/time.Duration(len(window.Buckets)) {
71
            window.RotateBucket()
72
        }
73
    }
74
}

1
// Intelligent alerting with ML-based anomaly detection
2
type IntelligentAlerting struct {
3
    baselineCalculator *BaselineCalculator
4
    anomalyDetector    *MLAnomalyDetector
5
    alertPolicies      map[string]*AlertPolicy
6
    notificationQueue  chan *Alert
7
}
8

9
type AlertPolicy struct {
10
    Name            string
11
    Conditions      []AlertCondition
12
    Severity        AlertSeverity
13
    Cooldown        time.Duration
14
    NotificationChannels []string
15
}
16

17
type AlertCondition struct {
18
    Metric      string
19
    Operator    string
20
    Threshold   float64
21
    Duration    time.Duration
22
    Aggregation string
23
}
24

25
type MLAnomalyDetector struct {
26
    models map[string]*AnomalyModel
27
}
28

29
type AnomalyModel struct {
30
    ModelType   string
31
    Parameters  map[string]float64
32
    Confidence  float64
33
    LastTrained time.Time
34
}
35

36
func (ia *IntelligentAlerting) EvaluateMetrics(metrics []*PerformanceMetric) {
37
    for _, metric := range metrics {
38
        // Calculate baseline
39
        baseline := ia.baselineCalculator.GetBaseline(metric.Service, metric.MetricType)
40

41
        // Detect anomalies using ML
42
        anomaly := ia.anomalyDetector.DetectAnomaly(metric, baseline)
43

44
        if anomaly != nil && anomaly.Confidence > 0.8 {
45
            // Check alert policies
46
            for _, policy := range ia.alertPolicies {
47
                if ia.evaluatePolicy(policy, metric, anomaly) {
48
                    alert := &Alert{
49
                        PolicyName:  policy.Name,
50
                        Severity:    policy.Severity,
51
                        Service:     metric.Service,
52
                        Metric:      metric,
53
                        Anomaly:     anomaly,
54
                        Timestamp:   time.Now(),
55
                        Description: ia.generateAlertDescription(metric, anomaly),
56
                    }
57

58
                    ia.notificationQueue <- alert
59
                }
60
            }
61
        }
62
    }
63
}
64

65
func (ia *IntelligentAlerting) generateAlertDescription(
66
    metric *PerformanceMetric, anomaly *Anomaly) string {
67

68
    return fmt.Sprintf(
69
        "Anomaly detected in %s: %s is %.2f (baseline: %.2f, confidence: %.1f%%)",
70
        metric.Service,
71
        metric.MetricType,
72
        metric.Value,
73
        anomaly.Baseline,
74
        anomaly.Confidence*100,
75
    )
76
}

1
# Security-hardened eBPF agent deployment
2
apiVersion: v1
3
kind: SecurityContext
4
spec:
5
  # Run as non-root user where possible
6
  runAsNonRoot: false # Required for eBPF operations
7
  runAsUser: 0
8

9
  # Minimal required capabilities
10
  capabilities:
11
    add:
12
      - SYS_ADMIN # Required for eBPF program loading
13
      - BPF # Required for eBPF operations
14
      - SYS_PTRACE # Required for process tracing
15
    drop:
16
      - ALL # Drop all other capabilities
17

18
  # Security context constraints
19
  allowPrivilegeEscalation: false
20
  readOnlyRootFilesystem: true
21

22
  # SELinux settings
23
  seLinuxOptions:
24
    type: container_runtime_t

1
# Resource limits and requests
2
resources:
3
  requests:
4
    cpu: 100m
5
    memory: 128Mi
6
    ephemeral-storage: 1Gi
7
  limits:
8
    cpu: 500m
9
    memory: 512Mi
10
    ephemeral-storage: 2Gi
11

12
# Quality of Service
13
priorityClassName: system-node-critical
14

15
# Pod disruption budget
16
apiVersion: policy/v1
17
kind: PodDisruptionBudget
18
metadata:
19
  name: dx-uma-ebpf-agent-pdb
20
spec:
21
  minAvailable: 80%
22
  selector:
23
    matchLabels:
24
      app: dx-uma-ebpf-agent

1
// Self-monitoring for the eBPF agent
2
type AgentMonitoring struct {
3
    metrics     *prometheus.Registry
4
    healthCheck *HealthChecker
5
    logger      *zap.Logger
6
}
7

8
func (am *AgentMonitoring) RegisterMetrics() {
9
    // Agent performance metrics
10
    am.eventsProcessedTotal = prometheus.NewCounterVec(
11
        prometheus.CounterOpts{
12
            Name: "ebpf_agent_events_processed_total",
13
            Help: "Total number of eBPF events processed",
14
        },
15
        []string{"event_type", "status"},
16
    )
17

18
    am.programLoadTime = prometheus.NewHistogram(
19
        prometheus.HistogramOpts{
20
            Name:    "ebpf_agent_program_load_duration_seconds",
21
            Help:    "Time taken to load eBPF programs",
22
            Buckets: prometheus.DefBuckets,
23
        },
24
    )
25

26
    am.memoryUsage = prometheus.NewGauge(
27
        prometheus.GaugeOpts{
28
            Name: "ebpf_agent_memory_usage_bytes",
29
            Help: "Current memory usage of the eBPF agent",
30
        },
31
    )
32

33
    // Register metrics
34
    am.metrics.MustRegister(am.eventsProcessedTotal)
35
    am.metrics.MustRegister(am.programLoadTime)
36
    am.metrics.MustRegister(am.memoryUsage)
37
}
38

39
func (am *AgentMonitoring) StartHealthCheck() {
40
    ticker := time.NewTicker(30 * time.Second)
41
    go func() {
42
        for range ticker.C {
43
            health := am.healthCheck.CheckHealth()
44
            if !health.Healthy {
45
                am.logger.Error("Agent health check failed",
46
                    zap.String("reason", health.Reason),
47
                    zap.Duration("uptime", health.Uptime))
48
            }
49
        }
50
    }()
51
}

1
// Optimized eBPF program for high-performance monitoring
2
#include <vmlinux.h>
3
#include <bpf/bpf_helpers.h>
4
#include <bpf/bpf_core_read.h>
5

6
// Optimized data structures
7
struct {
8
    __uint(type, BPF_MAP_TYPE_LRU_HASH);
9
    __uint(max_entries, 65536);
10
    __type(key, __u64);
11
    __type(value, struct connection_info);
12
} connection_cache SEC(".maps");
13

14
// Per-CPU array for better performance
15
struct {
16
    __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
17
    __uint(max_entries, 1);
18
    __type(key, __u32);
19
    __type(value, struct metrics_buffer);
20
} metrics_buffers SEC(".maps");
21

22
// Rate limiting to prevent overwhelming user space
23
struct {
24
    __uint(type, BPF_MAP_TYPE_LRU_HASH);
25
    __uint(max_entries, 1024);
26
    __type(key, __u32);
27
    __type(value, __u64);
28
} rate_limits SEC(".maps");
29

30
// Optimized event processing
31
SEC("tp_btf/sys_enter_read")
32
int trace_read_entry(u64 *ctx) {
33
    __u32 pid = bpf_get_current_pid_tgid() >> 32;
34
    __u64 now = bpf_ktime_get_ns();
35

36
    // Rate limiting: max 1000 events per second per process
37
    __u64 *last_event = bpf_map_lookup_elem(&rate_limits, &pid);
38
    if (last_event && (now - *last_event) < 1000000) { // 1ms
39
        return 0;
40
    }
41
    bpf_map_update_elem(&rate_limits, &pid, &now, BPF_ANY);
42

43
    // Use per-CPU buffer for better performance
44
    __u32 zero = 0;
45
    struct metrics_buffer *buffer = bpf_map_lookup_elem(&metrics_buffers, &zero);
46
    if (!buffer) return 0;
47

48
    // Process event efficiently
49
    process_read_event(ctx, buffer);
50

51
    return 0;
52
}
53

54
// Efficient helper function
55
static __always_inline void process_read_event(u64 *ctx,
56
                                              struct metrics_buffer *buffer) {
57
    // Optimized event processing logic
58
    __u32 fd = (__u32)ctx[0];
59
    __u64 count = ctx[2];
60

61
    // Quick validation
62
    if (fd < 0 || count > MAX_READ_SIZE) return;
63

64
    // Batch processing for efficiency
65
    if (buffer->count < BUFFER_SIZE) {
66
        buffer->events[buffer->count++] = create_read_event(fd, count);
67
    }
68

69
    // Flush buffer when full
70
    if (buffer->count >= BUFFER_SIZE) {
71
        flush_metrics_buffer(buffer);
72
    }
73
}