Example eBPF Programs
Example applications that use the
bpfman-go bindings can be found in the
Current examples include:
These examples and the associated documentation is intended to provide the basics on how to deploy and manage an eBPF program using bpfman. Each of the examples contain an eBPF Program written in C (tc_counter.c, tracepoint_counter.c and xdp_counter.c) that is compiled into eBPF bytecode. Each time the eBPF program is called, it increments the packet and byte counts in a map that is accessible by the userspace portion.
Each of the examples also have a userspace portion written in GO.
When run locally, the userspace program makes gRPC calls to
bpfman to load the eBPF program
at the requested hook point (XDP hook point, TC hook point or Tracepoint).
When run in a Kubernetes deployment, the
bpfman-agent makes gRPC calls to
bpfman to load
the eBPF program based on a Custom Resource Definition (CRD), which is described in more detail in that section.
Independent of the deployment, the userspace program then polls the eBPF map every 3 seconds and logs the
The userspace code is leveraging the cilium/ebpf library
to manage the maps shared with the eBPF program.
The example eBPF programs are very similar in functionality, and only vary where in the Linux networking stack
they are inserted.
Read more about XDP and TC programs here.
There are two ways to deploy these example applications:
- Run locally on one machine: Deploying Example eBPF Programs On Local Host
- Deploy to multiple nodes in a Kubernetes cluster: Deploying Example eBPF Programs On Kubernetes
Notes regarding this document:
- Source of images used in the example documentation can be found in bpfman Upstream Images. Request access if required.