Extending Cilium with eBPF for Exposing HTTP/1 Golden Metrics
summary
Extends Cilium with custom eBPF programs attached on egress and ingress to count requests, bucket 2xx/3xx errors, and measure latency by parsing response headers and tracking bytes until the Content-Length boundary. Encounters the verifier 1,000,000‑instruction limit, refactors using BPF tail calls to reset state, and reaches a content-length parser of ~600 bytes and a header parser of 1024 bytes. Exports Prometheus metrics via a bumblebee exporter. Works for plain HTTP but not for TLS, chunked transfer, or HTTP pipelining.
AI-written summary · about
chapters (19)
- 0:00Intro
- 2:24Goal: HTTP Golden Metrics
- 3:23Extending Gaps in Cilium
- 3:55Background: State of the World
- 6:08Skeleton of a Packet
- 7:20Latency (Simple)
- 7:46Latency (Useful)
- 8:52Where to place programs
- 9:59Number of requests
- 10:29Keying metric for userspace
- 11:051. Communicating with userspace
- 13:06Errors (2)
- 13:22Latency - Concept
- 15:233. Latency - Verifier (3)
- 17:533. Latency - Reprised Architecture
- 19:093. Latency-Efficiencies Found
- 21:58Exported Metrics
- 23:01Limitations/Potential Improvements
- 23:36Conclusion
related talks
38mUnderstanding and Troubleshooting the eBPF Datapath in Cilium
17meBPF in Microservices Observability
14mWriting Custom eBPF Programs for O11y: What You Need to Know
31mBridging Dev and Ops with eBPF: Extending Observability Upwards and Downwards
25mHubble Beyond Cilium
33mAuto-instrumentation of Prometheus for RED Monitorin...
32mBuzzing across the eBPF Landscape and into the Hive
29mKubernetes Observability with eBPF