A methodology for using eBPF to efficiently monitor network behavior in Linux Kubernetes clusters
With the rise of container orchestration systems, such as Kubernetes and microservice based application architectures there has been a corresponding growth in tools aimed at monitoring these systems. As monitoring approaches have evolved the implementation of instrumentation has shifted from the app...
| Main Author: | |
|---|---|
| Other Authors: | |
| Format: | Thesis |
| Published: |
Massachusetts Institute of Technology
2022
|
| Online Access: | https://hdl.handle.net/1721.1/145083 |
| _version_ | 1811097035952095232 |
|---|---|
| author | Zavarella, Timothy D. |
| author2 | Palacios, Tomas |
| author_facet | Palacios, Tomas Zavarella, Timothy D. |
| author_sort | Zavarella, Timothy D. |
| collection | MIT |
| description | With the rise of container orchestration systems, such as Kubernetes and microservice based application architectures there has been a corresponding growth in tools aimed at monitoring these systems. As monitoring approaches have evolved the implementation of instrumentation has shifted from the application level to the platform level. The extended Berkeley Packet Filter (eBPF) can enable high performance and low overhead collection for platform level monitoring. Existing commercial eBPF monitoring systems are often tightly integrated systems with large dependencies and little flexibility in integration into alternative monitoring systems. This thesis presents a methodology for developing modular self-contained eBPF monitoring systems which are portable across various kernel versions, Container Network Interface (CNI) plugins, and cluster configurations. The choice of stable hook points and the BPF CO-RE approach to development using the libbpf or Cilium/ebpf loaders is recommended in this methodology. A proof of concept monitor was developed which captures network traffic on a cluster using the stable Traffic Control direct-action hook point. Packet capture at pod virtual ethernet network interfaces was selected to allow for CNI independent correlation of packets to cluster workloads. The prototype developed provides a suitable platform for implementing additional monitoring functionality on top of and was integrated with an existing NetApp cloud monitoring system. |
| first_indexed | 2024-09-23T16:53:18Z |
| format | Thesis |
| id | mit-1721.1/145083 |
| institution | Massachusetts Institute of Technology |
| last_indexed | 2024-09-23T16:53:18Z |
| publishDate | 2022 |
| publisher | Massachusetts Institute of Technology |
| record_format | dspace |
| spelling | mit-1721.1/1450832022-08-30T03:02:08Z A methodology for using eBPF to efficiently monitor network behavior in Linux Kubernetes clusters Zavarella, Timothy D. Palacios, Tomas Ryabin, Aleks Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science With the rise of container orchestration systems, such as Kubernetes and microservice based application architectures there has been a corresponding growth in tools aimed at monitoring these systems. As monitoring approaches have evolved the implementation of instrumentation has shifted from the application level to the platform level. The extended Berkeley Packet Filter (eBPF) can enable high performance and low overhead collection for platform level monitoring. Existing commercial eBPF monitoring systems are often tightly integrated systems with large dependencies and little flexibility in integration into alternative monitoring systems. This thesis presents a methodology for developing modular self-contained eBPF monitoring systems which are portable across various kernel versions, Container Network Interface (CNI) plugins, and cluster configurations. The choice of stable hook points and the BPF CO-RE approach to development using the libbpf or Cilium/ebpf loaders is recommended in this methodology. A proof of concept monitor was developed which captures network traffic on a cluster using the stable Traffic Control direct-action hook point. Packet capture at pod virtual ethernet network interfaces was selected to allow for CNI independent correlation of packets to cluster workloads. The prototype developed provides a suitable platform for implementing additional monitoring functionality on top of and was integrated with an existing NetApp cloud monitoring system. M.Eng. 2022-08-29T16:31:43Z 2022-08-29T16:31:43Z 2022-05 2022-05-27T16:19:42.374Z Thesis https://hdl.handle.net/1721.1/145083 In Copyright - Educational Use Permitted Copyright MIT http://rightsstatements.org/page/InC-EDU/1.0/ application/pdf Massachusetts Institute of Technology |
| spellingShingle | Zavarella, Timothy D. A methodology for using eBPF to efficiently monitor network behavior in Linux Kubernetes clusters |
| title | A methodology for using eBPF to efficiently monitor network behavior in Linux Kubernetes clusters |
| title_full | A methodology for using eBPF to efficiently monitor network behavior in Linux Kubernetes clusters |
| title_fullStr | A methodology for using eBPF to efficiently monitor network behavior in Linux Kubernetes clusters |
| title_full_unstemmed | A methodology for using eBPF to efficiently monitor network behavior in Linux Kubernetes clusters |
| title_short | A methodology for using eBPF to efficiently monitor network behavior in Linux Kubernetes clusters |
| title_sort | methodology for using ebpf to efficiently monitor network behavior in linux kubernetes clusters |
| url | https://hdl.handle.net/1721.1/145083 |
| work_keys_str_mv | AT zavarellatimothyd amethodologyforusingebpftoefficientlymonitornetworkbehaviorinlinuxkubernetesclusters AT zavarellatimothyd methodologyforusingebpftoefficientlymonitornetworkbehaviorinlinuxkubernetesclusters |