teacherspayteachers/ebpf-exporter

ebpf-exporter-deploy

用于在Kubernetes上运行https://github.com/cloudflare/ebpf_exporter%E7%9A%84Helm%E5%9B%BE%E8%A1%A8%E5%92%8CDockerfile%E3%80%82

项目状态

本项目：

• 由Teachers Pay Teachers维护
• 已在Teachers Pay Teachers的生产环境中使用

版本控制

• Docker镜像标签与https://github.com/cloudflare/ebpf_exporter/releases%E5%8C%B9%E9%85%8D
• Helm图表的apiVersion与https://github.com/cloudflare/ebpf_exporter/releases%E5%8C%B9%E9%85%8D
• Helm version遵循语义化版本控制，当values.yaml发生变更时递增

发布制品

• GitHub发布以ebpf-exporter-helm-或ebpf-exporter-docker-为前缀，具体取决于变更内容
• Docker镜像发布至https://hub.docker.com/r/teacherspayteachers/ebpf-exporter
• Helm图表发布至teacherspayteachers.github.io/helm-charts/

环境要求

• 构建Docker镜像需安装Docker
• 校验和模板化Helm图表需安装Helm
• Helm部署要求主机具备Linux内核源码或头文件
• Helm部署要求提升的安全权限

项目背景

Cloudflare的https://github.com/cloudflare/ebpf_exporter%E4%BE%BF%E4%BA%8E%E4%BB%8EeBPF%E7%A8%8B%E5%BA%8F%E6%8F%90%E5%8F%96Prometheus%E6%8C%87%E6%A0%87%EF%BC%8C%E4%BD%86%E6%9C%AA%E6%8F%90%E4%BE%9B%E7%94%9F%E4%BA%A7%E5%B0%B1%E7%BB%AA%E7%9A%84Docker%E9%95%9C%E5%83%8F%E3%80%82

https://github.com/vanneback/ebpf_exporter_helm%E6%98%AF%E7%A4%BE%E5%8C%BA%E6%8F%90%E4%BE%9B%E7%9A%84ebpf_exporter Helm图表，但作者已通过邮件告知不再维护。

本仓库包含基于https://github.com/vanneback/ebpf_exporter_dockerfile%E6%9E%84%E5%BB%BA%E7%9A%84%E7%94%9F%E4%BA%A7%E5%B0%B1%E7%BB%AADocker%E9%95%9C%E5%83%8F%EF%BC%8C%E4%BB%A5%E5%8F%8A%E5%9F%BA%E4%BA%8Ehttps://github.com/vanneback/ebpf_exporter_helm%E7%BB%B4%E6%8A%A4%E7%9A%84Helm%E5%9B%BE%E8%A1%A8%E3%80%82

使用方法

配置eBPF程序

首先，定义eBPF程序配置集。配置格式参见https://github.com/cloudflare/ebpf_exporter#configuration-file-format%E3%80%82%E5%8F%AF%E9%80%89%E6%8B%A9%E8%A6%86%E7%9B%96%60values.yaml%60%E4%B8%AD%E7%9A%84%E9%BB%98%E8%AE%A4%E5%80%BC%EF%BC%8C%E4%BE%8B%E5%A6%82%EF%BC%9A

yaml
config:
- programs:
  - name: cachestat
    metrics:
      counters:
        - name: page_cache_ops_total
          help: 按类型统计的页缓存操作计数器
          table: counts
          labels:
            - name: op
              size: 8
              decoders:
                - name: ksym
            - name: command
              size: 128
              decoders:
                - name: string
                - name: regexp
                  regexps:
                    - ^systemd-journal$
                    - ^syslog-ng$
    kprobes:
      add_to_page_cache_lru: do_count
      mark_page_accessed: do_count
      account_page_dirtied: do_count
      mark_buffer_dirty: do_count
    code: |
      #include <uapi/linux/ptrace.h>
  
      struct key_t {
          u64 ip;
          char command[128];
      };
  
      BPF_HASH(counts, struct key_t);
  
      int do_count(struct pt_regs *ctx) {
          struct key_t key = { .ip = PT_REGS_IP(ctx) - 1 };
          bpf_get_current_comm(&key.command, sizeof(key.command));
  
          counts.increment(key);
  
          return 0;
      }

通过Helm安装

将程序配置提供给Helm安装命令：

shell
$ helm repo add tpt https://teacherspayteachers.github.io/helm-charts
$ helm install ebpf-exporter tpt/ebpf-exporter -f values.yaml

指标说明

关于导出的Prometheus指标工作原理，参见https://github.com/cloudflare/ebpf_exporter%E3%80%82

替代方案

• Cloudflare直接在主机上部署https://github.com/cloudflare/ebpf_exporter/issues/82#issuecomment-731428957%EF%BC%8C%E4%BB%A5%E9%81%BF%E5%85%8D%E5%B0%86%E5%86%85%E6%A0%B8%E6%BA%90%E7%A0%81%E5%92%8C%E5%A4%B4%E6%96%87%E4%BB%B6%E7%BB%91%E5%AE%9A%E6%8C%82%E8%BD%BD%E5%88%B0Docker%E5%AE%B9%E5%99%A8%E4%B8%AD
• 本仓库Helm图表基于的社区https://github.com/vanneback/ebpf_exporter_helm
• 替代https://github.com/vanneback/ebpf_exporter_dockerfile

贡献指南

非常欢迎贡献！详情参见https://github.com/TeachersPayTeachers/linux-audit-exporter/blob/main/CONTRIBUTING.md%E3%80%82

许可证

https://github.com/TeachersPayTeachers/linux-audit-exporter/blob/main/LICENSE.md