Chapter 3. eBPF manager Operator

Procedure

1. To create the bpfman namespace, enter the following command:

   $ cat << EOF| oc create -f -
   apiVersion: v1
   kind: Namespace
   metadata:
     labels:
       pod-security.kubernetes.io/enforce: privileged
       pod-security.kubernetes.io/enforce-version: v1.24
     name: bpfman
   EOF

   Copy to Clipboard Toggle word wrap

2. To create an OperatorGroup CR, enter the following command:

   $ cat << EOF| oc create -f -
   apiVersion: operators.coreos.com/v1
   kind: OperatorGroup
   metadata:
     name: bpfman-operators
     namespace: bpfman
   EOF

   Copy to Clipboard Toggle word wrap

3. Subscribe to the eBPF Manager Operator.

   1. To create a Subscription CR for the eBPF Manager Operator, enter the following command:

      $ cat << EOF| oc create -f -
      apiVersion: operators.coreos.com/v1alpha1
      kind: Subscription
      metadata:
        name: bpfman-operator
        namespace: bpfman
      spec:
        name: bpfman-operator
        channel: alpha
        source: community-operators
        sourceNamespace: openshift-marketplace
      EOF

      Copy to Clipboard Toggle word wrap

4. To verify that the Operator is installed, enter the following command:

   $ oc get ip -n bpfman

   Copy to Clipboard Toggle word wrap

   Example output

   NAME            CSV                                 APPROVAL    APPROVED
   install-ppjxl   security-profiles-operator.v0.8.5   Automatic   true

   Copy to Clipboard Toggle word wrap

5. To verify the version of the Operator, enter the following command:

   $ oc get csv -n bpfman

   Copy to Clipboard Toggle word wrap

   Example output

   NAME                                DISPLAY                      VERSION   REPLACES                            PHASE
   bpfman-operator.v0.5.0              eBPF Manager Operator              0.5.0     bpfman-operator.v0.4.2              Succeeded

   Copy to Clipboard Toggle word wrap

Procedure

1. Install the eBPF Manager Operator:

   1. In the OpenShift Container Platform web console, click Operators OperatorHub.
   2. Select eBPF Manager Operator from the list of available Operators, and if prompted to Show community Operator, click Continue.
   3. Click Install.
   4. On the Install Operator page, under Installed Namespace, select Operator recommended Namespace.
   5. Click Install.

2. Verify that the eBPF Manager Operator is installed successfully:

   1. Navigate to the Operators Installed Operators page.

   2. Ensure that eBPF Manager Operator is listed in the openshift-ingress-node-firewall project with a Status of InstallSucceeded.

      Note

      During installation an Operator might display a Failed status. If the installation later succeeds with an InstallSucceeded message, you can ignore the Failed message.

      If the Operator does not have a Status of InstallSucceeded, troubleshoot using the following steps:

      • Inspect the Operator Subscriptions and Install Plans tabs for any failures or errors under Status.
      • Navigate to the Workloads Pods page and check the logs for pods in the bpfman project.

Procedure

1. To download the manifest, enter the following command:

   $ curl -L https://github.com/bpfman/bpfman/releases/download/v0.5.1/go-xdp-counter-install-selinux.yaml -o go-xdp-counter-install-selinux.yaml

   Copy to Clipboard Toggle word wrap

2. To deploy the sample eBPF application, enter the following command:

   $ oc create -f go-xdp-counter-install-selinux.yaml

   Copy to Clipboard Toggle word wrap

   Example output

   namespace/go-xdp-counter created
   serviceaccount/bpfman-app-go-xdp-counter created
   clusterrolebinding.rbac.authorization.k8s.io/xdp-binding created
   daemonset.apps/go-xdp-counter-ds created
   xdpprogram.bpfman.io/go-xdp-counter-example created
   selinuxprofile.security-profiles-operator.x-k8s.io/bpfman-secure created

   Copy to Clipboard Toggle word wrap

3. To confirm that the eBPF sample application deployed successfully, enter the following command:

   $ oc get all -o wide -n go-xdp-counter

   Copy to Clipboard Toggle word wrap

   Example output

   NAME                          READY   STATUS    RESTARTS   AGE   IP             NODE                                 NOMINATED NODE   READINESS GATES
   pod/go-xdp-counter-ds-4m9cw   1/1     Running   0          44s   10.129.0.92    ci-ln-dcbq7d2-72292-ztrkp-master-1   <none>           <none>
   pod/go-xdp-counter-ds-7hzww   1/1     Running   0          44s   10.130.0.86    ci-ln-dcbq7d2-72292-ztrkp-master-2   <none>           <none>
   pod/go-xdp-counter-ds-qm9zx   1/1     Running   0          44s   10.128.0.101   ci-ln-dcbq7d2-72292-ztrkp-master-0   <none>           <none>
   
   NAME                               DESIRED   CURRENT   READY   UP-TO-DATE   AVAILABLE   NODE SELECTOR   AGE   CONTAINERS       IMAGES                                           SELECTOR
   daemonset.apps/go-xdp-counter-ds   3         3         3       3            3           <none>          44s   go-xdp-counter   quay.io/bpfman-userspace/go-xdp-counter:v0.5.0   name=go-xdp-counter

   Copy to Clipboard Toggle word wrap

4. To confirm that the example XDP program is running, enter the following command:

   $ oc get xdpprogram go-xdp-counter-example

   Copy to Clipboard Toggle word wrap

   Example output

   NAME                     BPFFUNCTIONNAME   NODESELECTOR   STATUS
   go-xdp-counter-example   xdp_stats         {}             ReconcileSuccess

   Copy to Clipboard Toggle word wrap

5. To confirm that the XDP program is collecting data, enter the following command:

   $ oc logs <pod_name> -n go-xdp-counter

   Copy to Clipboard Toggle word wrap

   Replace <pod_name> with the name of an XDP program pod, such as go-xdp-counter-ds-4m9cw.

   Example output

   2024/08/13 15:20:06 15016 packets received
   2024/08/13 15:20:06 93581579 bytes received
   ...

   Copy to Clipboard Toggle word wrap