Skip to content

Example eBPF Programs

Example applications that use the bpfd-go bindings can be found in the examples/ directory. Current examples include:

These examples and the associated documentation is intended to provide the basics on how to deploy and manage a eBPF program using bpfd. Each of the examples contain an eBPF Program written in C (tc_counter.c, tracepoint_counter.c and xdp_counter.c) that is compiled into eBPF bytecode. Each time the eBPF program is called, it increments the packet and byte counts in a map that is accessible by the userspace portion.

Each of the examples also have a userspace portion written in GO. When run locally, the userspace program makes gRPC calls to bpfd requesting bpfd to load the eBPF program at the requested hook point (XDP hook point, TC hook point or Tracepoint). When run in a Kubernetes deployment, the bpfd-agent makes gRPC calls to bpfd requesting bpfd to load the eBPF program based on a Custom Resource Definition (CRD), which is described in more detail in that section. Independent of the deployment, the userspace program then polls the eBPF map every 3 seconds and logs the current counts. The userspace code is leveraging the cilium/ebpf library to manage the maps shared with the eBPF program. The example eBPF programs are very similar in functionality, and only vary where in the Linux networking stack they are inserted. Read more about XDP and TC programs here.

There are two ways to deploy these example applications:

Notes

Notes regarding this document:

  • Source of images used in the example documentation can be found in bpfd Upstream Images. Request access if required.