297 lines
9.1 KiB
Markdown
297 lines
9.1 KiB
Markdown
|
---
|
|||
|
|
tags: [计算机网络, eBPF, XDP, kprobe, Tracepoint, ServiceMesh, Istio, Envoy]
|
|||
|
|
create time: 2026-05-18 05:30
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
# eBPF 与 Service Mesh
|
|||
|
|
|
|||
|
|
## 概述
|
|||
|
|
|
|||
|
|
eBPF 让 Linux 内核变得可编程而不需要编译内核模块；Service Mesh（Istio/Linkerd）让微服务间的流量治理从代码中剥离到基础设施层。这两者代表了可观测性和流量治理的两个重要方向。
|
|||
|
|
|
|||
|
|
## eBPF（extended Berkeley Packet Filter）
|
|||
|
|
|
|||
|
|
### 什么是 eBPF？
|
|||
|
|
|
|||
|
|
eBPF 允许在**内核态安全地运行沙箱程序**，无需修改内核源码或加载内核模块。它最初是一个 packet filter 增强版，现在已扩展到 tracing、monitoring、security 等多个领域。
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
传统方案: eBPF 方案:
|
|||
|
|
───────── ─────────
|
|||
|
|
编译内核模块 (.ko) ↔ 编写 eBPF C 程序
|
|||
|
|
手动符号导出 ↔ kprobe/kfunc/tracepoint 直接挂钩
|
|||
|
|
系统重启加载 ↔ insmod bpf 即时生效
|
|||
|
|
无类型安全检查 ↔ 内核验证器严格检查 (verifier)
|
|||
|
|
崩溃影响全局 ↔ 沙箱隔离，失败不崩内核
|
|||
|
|
无法卸载或调试 ↔ 可卸载，bpftool 可调试
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
### eBPF 的核心架构
|
|||
|
|
|
|||
|
|
```mermaid
|
|||
|
|
flowchart TD
|
|||
|
|
subgraph "用户态 (User Space)"
|
|||
|
|
Prog["eBPF 程序<br/>(C/BPF 汇编)"]
|
|||
|
|
Map["bpf_map<br/>KV 存储<br/>hash/array/perf_event/..."]
|
|||
|
|
Tool["bpftool<br/>BCC tools<br/>bpftrace"]
|
|||
|
|
end
|
|||
|
|
|
|||
|
|
subgraph "内核态 (Kernel Space)"
|
|||
|
|
Verifier["Verifier<br/>严格安全检查"]
|
|||
|
|
JIT["JIT Compiler<br/>C → x86/arm/riscv 机器码"]
|
|||
|
|
|
|||
|
|
subgraph "Attachment Points"
|
|||
|
|
KP["kprobe / kretprobe<br/>hook 任意内核函数入口/出口"]
|
|||
|
|
TP["tracepoint<br/>内核预定义探测点"]
|
|||
|
|
TC["Traffic Control<br/>qdisc classifier"]
|
|||
|
|
XDP["XDP (eXpress Data Path)<br/>网卡驱动级别最快路径"]
|
|||
|
|
end
|
|||
|
|
|
|||
|
|
Map -->|"写入"| PerfEvent["perf event → 用户态采集"]
|
|||
|
|
end
|
|||
|
|
|
|||
|
|
Tool -->|"加载"| Prog
|
|||
|
|
Prog -->|"提交"| Verifier
|
|||
|
|
Verifier -->|"验证通过"| JIT
|
|||
|
|
JIT -->|"注册到"| KP
|
|||
|
|
JIT -->|"注册到"| TP
|
|||
|
|
JIT -->|"注册到"| TC
|
|||
|
|
JIT -->|"注册到"| XDP
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
### eBPF 在网络中的典型应用层级
|
|||
|
|
|
|||
|
|
```mermaid
|
|||
|
|
flowchart LR
|
|||
|
|
NIC["Network Interface Card"] -.->|XDP 微秒级处理| XDP["XDP<br/>最快路径: 网卡驱动级别"]
|
|||
|
|
|
|||
|
|
TC["Traffic Control<br/>tc filter/qdisc"] -.->|中等路径| Stack["Linux Network Stack"]
|
|||
|
|
|
|||
|
|
Stack -.->|kprobe hook| Kprobe["kprobe/kretprobe<br/>TCP/IP 栈钩子"]
|
|||
|
|
|
|||
|
|
XDP -->|"drop/mirror/redirect"| NIC
|
|||
|
|
TC -->|"police/packet/cgroup"| Stack
|
|||
|
|
Kprobe -->|"tcp_connect/tcp_rcv_skb..."| App["可观测性工具"]
|
|||
|
|
|
|||
|
|
style XDP fill:#FF6B6B,color:#fff
|
|||
|
|
style TC fill:#FFD700,color:#000
|
|||
|
|
style Kprobe fill:#98FB98,color:#000
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
| 挂载点 | 性能 | 用途 | 典型工具 |
|
|||
|
|
|--------|------|------|---------|
|
|||
|
|
| **XDP** | 微秒级，最快 | DDoS 过滤、L4 LB、镜像 | AF_XDP, cilium-hubble |
|
|||
|
|
| **tc (Traffic Control)** | 纳秒~微秒级 | qdisc 调度、带宽限制、重定向 | tc-bpf, polycube |
|
|||
|
|
| **kprobe/kretprobe** | 低开销 | 追踪任意内核函数 | bcc tcpconnect, bpftrace |
|
|||
|
|
| **tracepoint** | 极低开销 | 内核预定义事件 | perf trace |
|
|||
|
|
| **CGroup** | 进程级 | 网络隔离、限速 | cgroup-bpf |
|
|||
|
|
| **LSM** | 安全级别 | 强制访问控制 | libbpf-security |
|
|||
|
|
|
|||
|
|
### 常用 eBPF 工具实战
|
|||
|
|
|
|||
|
|
```bash
|
|||
|
|
# === BCC Tools (Python-based eBPF 工具集) ===
|
|||
|
|
|
|||
|
|
# 追踪所有新建 TCP 连接
|
|||
|
|
sudo ./tcpconnect
|
|||
|
|
PID COMM IP SADDR DADDR DPORT
|
|||
|
|
1234 curl 4 192.168.1.10 93.184.216.34 443
|
|||
|
|
|
|||
|
|
# 查看 TCP 连接存活时间
|
|||
|
|
sudo ./tcplife
|
|||
|
|
PID COMM FD LADDR:LADDR → RADDR:RADDR state msec
|
|||
|
|
1234 chrome 42 192.168.1.10:54321→ 93.184.216.34:443 ESTAB 12345
|
|||
|
|
|
|||
|
|
# 查看 TCP 状态分布
|
|||
|
|
sudo ./tcpstates
|
|||
|
|
Tracing TCP states... Output every 1 seconds.
|
|||
|
|
TIME_WAIT 42
|
|||
|
|
ESTABLISHED 128
|
|||
|
|
CLOSE_WAIT 0
|
|||
|
|
|
|||
|
|
# === bpftrace (一行脚本) ===
|
|||
|
|
|
|||
|
|
# 实时打印每个 TCP 包的大小
|
|||
|
|
sudo bpftrace -e 'kprobe:tcp_sendmsg { @bytes[tid] = arg0; }'
|
|||
|
|
|
|||
|
|
# 统计每秒 DNS 查询数
|
|||
|
|
sudo bpftrace -e 'tracepoint:dns:dns_query { @count++; } interval:s:1 { print(@count); clear(@count); }'
|
|||
|
|
|
|||
|
|
# === Cilium Hubble (Kubernetes 可观测性) ===
|
|||
|
|
|
|||
|
|
# 服务间流量可视化
|
|||
|
|
hubble observe --namespace=default
|
|||
|
|
FLOW 08:23:45.123 DefaultPod → api-server (TCP NEW) DPT=8080
|
|||
|
|
FLOW 08:23:45.125 api-server → DefaultPod (TCP FIN)
|
|||
|
|
|
|||
|
|
# 按命名空间聚合
|
|||
|
|
hubble observe --aggregate 5s
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
### eBPF 监控网络问题的经典场景
|
|||
|
|
|
|||
|
|
```bash
|
|||
|
|
# 场景 1: 哪个进程的 TCP 连接最多?
|
|||
|
|
sudo bpftrace -e '
|
|||
|
|
kprobe:sock_alloc
|
|||
|
|
/@pids[comm]/++
|
|||
|
|
'
|
|||
|
|
|
|||
|
|
# 场景 2: 慢连接诊断——每个 TCP 连接耗时多久?
|
|||
|
|
sudo bpftrace -e '
|
|||
|
|
kprobe:tcp_v4_connect /arg0/ {
|
|||
|
|
@start[tid] = nsecs;
|
|||
|
|
}
|
|||
|
|
kretprobe:tcp_v4_connect /arg0 >= 0/ {
|
|||
|
|
$delta = (nsecs - @start[tid]) / 1000;
|
|||
|
|
@latency_us = hist($delta);
|
|||
|
|
delete(@start[tid]);
|
|||
|
|
}'
|
|||
|
|
|
|||
|
|
# 场景 3: SYN Flood 检测
|
|||
|
|
sudo bpftrace -e '
|
|||
|
|
kprobe:tcp_v4_do_rcvd
|
|||
|
|
@syn_count["SYN_RECV"]++;
|
|||
|
|
interval:1s {
|
|||
|
|
print(@syn_count);
|
|||
|
|
clear(@syn_count);
|
|||
|
|
}'
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## Service Mesh (Istio / Linkerd)
|
|||
|
|
|
|||
|
|
### Sidecar 模式原理
|
|||
|
|
|
|||
|
|
```mermaid
|
|||
|
|
flowchart LR
|
|||
|
|
Pod["Pod / VM"] -->|"app container"| App["my-service v1"]
|
|||
|
|
Pod -->|"proxy container"| Proxy["envoy sidecar"]
|
|||
|
|
|
|||
|
|
Proxy -->|"xDS API"| CP["Istiod<br/>Pilot(路由) + Citadel(mTLS)"]
|
|||
|
|
CP -->|"推送配置"| Proxy
|
|||
|
|
|
|||
|
|
subgraph "Sidecar 自动接管:"
|
|||
|
|
MTLS["mTLS 双向认证"]
|
|||
|
|
Retry["重试/熔断/超时"]
|
|||
|
|
Tracing["分布式链路追踪 (Jaeger)"]
|
|||
|
|
Metrics["指标收集 (Prometheus)"]
|
|||
|
|
Canary["金丝雀/蓝绿发布"]
|
|||
|
|
Dashboard["流量仪表盘"]
|
|||
|
|
end
|
|||
|
|
|
|||
|
|
Proxy -.-> MTLS
|
|||
|
|
Proxy -.-> Retry
|
|||
|
|
Proxy -.-> Tracing
|
|||
|
|
Proxy -.-> Metrics
|
|||
|
|
Proxy -.-> Canary
|
|||
|
|
Proxy -.-> Dashboard
|
|||
|
|
|
|||
|
|
style Proxy fill:#DDA0DD,color:#000
|
|||
|
|
style CP fill:#FFD700,color:#000
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
### Istio Traffic Management 核心资源
|
|||
|
|
|
|||
|
|
```yaml
|
|||
|
|
# VirtualService: 路由规则
|
|||
|
|
apiVersion: networking.istio.io/v1beta1
|
|||
|
|
kind: VirtualService
|
|||
|
|
metadata:
|
|||
|
|
name: my-service
|
|||
|
|
spec:
|
|||
|
|
hosts: ["my-service.default.svc.cluster.local"]
|
|||
|
|
http:
|
|||
|
|
- match:
|
|||
|
|
- headers:
|
|||
|
|
x-canary: {exact: "true"}
|
|||
|
|
route:
|
|||
|
|
- destination: {host: my-service, subset: v2} # canary 版
|
|||
|
|
weight: 100
|
|||
|
|
- route:
|
|||
|
|
- destination: {host: my-service, subset: v1}
|
|||
|
|
weight: 90 # 正式版 90%
|
|||
|
|
- destination: {host: my-service, subset: v2}
|
|||
|
|
weight: 10 # 金丝雀 10%
|
|||
|
|
timeout: 5s # 超时控制
|
|||
|
|
retries: # 重试策略
|
|||
|
|
attempts: 3
|
|||
|
|
perTryTimeout: 2s
|
|||
|
|
retryOn: "5xx,reset,connect-failure,gateway-error"
|
|||
|
|
|
|||
|
|
# DestinationRule: 定义 subset (版本分组)
|
|||
|
|
apiVersion: networking.istio.io/v1beta1
|
|||
|
|
kind: DestinationRule
|
|||
|
|
metadata:
|
|||
|
|
name: my-service
|
|||
|
|
spec:
|
|||
|
|
host: my-service.default.svc.cluster.local
|
|||
|
|
trafficPolicy:
|
|||
|
|
tls:
|
|||
|
|
mode: ISTIO_MUTUAL # 自动 mTLS
|
|||
|
|
connectionPool:
|
|||
|
|
tcp:
|
|||
|
|
maxConnections: 100 # 连接池上限
|
|||
|
|
http:
|
|||
|
|
h2UpgradePolicy: DEFAULT # 升级到 HTTP/2
|
|||
|
|
http1MaxPendingRequests: 100
|
|||
|
|
http2MaxRequests: 1000
|
|||
|
|
subsets:
|
|||
|
|
- name: v1 # 打标签为 v1
|
|||
|
|
labels: {app-version: v1}
|
|||
|
|
- name: v2 # 打标签为 v2
|
|||
|
|
labels: {app-version: v2}
|
|||
|
|
|
|||
|
|
# Gateway: 入站流量入口
|
|||
|
|
apiVersion: networking.istio.io/v1beta1
|
|||
|
|
kind: Gateway
|
|||
|
|
metadata:
|
|||
|
|
name: my-gateway
|
|||
|
|
spec:
|
|||
|
|
selector: {istio: ingressgateway}
|
|||
|
|
servers:
|
|||
|
|
- port: {number: 443, name: https, protocol: HTTPS}
|
|||
|
|
tls: {mode: SIMPLE, credentialName: my-cert}
|
|||
|
|
hosts: ["api.example.com"]
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
### Istio 工作原理
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
开发者视角:
|
|||
|
|
──────────────
|
|||
|
|
我的代码完全不知道 Service Mesh 的存在！
|
|||
|
|
不需要引入任何 SDK、注解或配置。
|
|||
|
|
|
|||
|
|
流量全部被 envoy sidecar 拦截和转发。
|
|||
|
|
|
|||
|
|
运维视角:
|
|||
|
|
──────────────
|
|||
|
|
Istiod (control plane) 统一管理所有 envoy proxy
|
|||
|
|
↓ 通过 xDS API (CDS/EDS/LDS/RDS)
|
|||
|
|
推送路由规则、监听配置、集群发现给每个 sidecar
|
|||
|
|
↓
|
|||
|
|
sidecar 热更新配置，无需重启应用
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
```bash
|
|||
|
|
# 确认 sidecar 注入成功
|
|||
|
|
kubectl get pods -n default
|
|||
|
|
NAME READY STATUS
|
|||
|
|
my-service-abc123-xk9qp 2/2 Running ← 2/2 = app + envoy sidecar
|
|||
|
|
|
|||
|
|
# 检查 envoy 配置
|
|||
|
|
kubectl exec -it my-service-abc123-xk9qp -c envoy -- \
|
|||
|
|
envoy --admin-address-port localhost:15000 stats
|
|||
|
|
|
|||
|
|
# istioctl 诊断
|
|||
|
|
istioctl analyze # 分析配置正确性
|
|||
|
|
istioctl proxy-status # sidecar 同步状态
|
|||
|
|
istioctl proxy-config routes my-service-pod # 查看某 pod 的路由表
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## 关联笔记
|
|||
|
|
|
|||
|
|
- [[hhs/NETWORK/QUIC协议深度解析]] — QUIC 也是用户态实现的协议
|
|||
|
|
- [[hhs/NETWORK/WireGuardVPN原理与实践]] — WireGuard 同样在内核态运行
|
|||
|
|
- [[hhs/NETWORK/01-SocketAPI与backlog详解]] — Socket API 是 eBPF kprobe 最常挂钩的地方
|