Scheduling eBPF on K8S doesn't have to be difficult

Indeed, there's kubectl-trace to help you do it!

The kubectl-trace project is a kubectl plugin that makes our lives easier, allowing us to use BPF programs against our Kubernetes clusters.

You are 5 minutes away from starting scheduling your bpftrace programs (or whatever BPF frontend language) against your clusters.

Join this talk to have some fun tracing the system calls happening on our Kubernetes nodes and pods.

Resources:
- https://github.com/iovisor/kubectl-trace
- https://github.com/iovisor/bpftrace
- https://github.com/iovisor/bcc
- Watch on YT: https://bit.ly/kubectl-trace-ebpf-summit-2021

Ask questions:
- https://twitter.com/leodido
- https://kubernetes.slack.com/messages/kubectl-trace

Transcript

1. Scheduling eBPF on K8S doesn’t have to be
   difficult
   There’s kubectl-trace to help you!
   

   Watch here! 📹
   Leonardo Di Donato
   
   
   gh:leodido
   
   
   @leodido
   

   View Slide

2. Tracers
   Leonardo Di Donato
   
   
   gh:leodido
   
   
   @leodido
   1. bpftrace
   
   
   2. bcc
   
   
   3. rbspy
   
   
   4. more to come…
   

   View Slide

3. Leonardo Di Donato
   
   
   gh:leodido
   
   
   @leodido
   

   View Slide

4. Leonardo Di Donato
   
   
   gh:leodido
   
   
   @leodido
   Demos
   Run a bpftrace program that instruments the caturday binary with an uretprobe on the counterValue function:
   

   kubectl trace run \
   
   
   -
   e 'uretprobe:/proc/$container_pid/exe:"main.counterValue" { printf("%d\n", retval) }' \
   
   
   -
   a
   --
   fetch
   -
   headers \
   
   
   -
   n caturday pod/caturday-54998fcb5-fsbxk
   
   
   

   Visit the caturday page and check the bpftrace program outputs the same counter value like it does:
   

   curl
   -
   v 206.189.248.54
   :
   8080/raw
   
   
   

   View Slide

5. Leonardo Di Donato
   
   
   gh:leodido
   
   
   @leodido
   Demos
   Run a bpftrace program to trace all the exec() family syscalls happening on a Kubernetes node:
   

   kubectl trace run
   -
   a \
   
   
   -
   e "tracepoint:syscalls:sys_enter_exec
   *
   { printf(\"%-10u %-5d \", elapsed / 1e6, pid); join(args
   ->
   argv); }" \
   
   
   node/pool
   -
   dido22h-8hom3
   - -
   fetch
   -
   headers
   
   
   

   Observe the output arguments…
   

   

   View Slide

6. Leonardo Di Donato
   
   
   gh:leodido
   
   
   @leodido
   Homeworks
   Do the same as before but with BCC tools. Have fun!
   

   

   kubectl trace —tracer=bcc …
   

   

   View Slide

7. Thank you!
   Leonardo Di Donato
   
   
   gh:leodido
   
   
   @leodido
   github.com/iovisor/kubectl-trace
   
   
   #kubectl-trace (k8s slack)
   👋
   

   View Slide