# 运行在每个 node 上的 eBPF 代理
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: ebpf-auto-instrumenter
spec:
  selector:
    matchLabels:
      app: ebpf-agent
  template:
    spec:
      hostPID: true      # eBPF 需要
      hostNetwork: true  # 网络追踪需要
      containers:
      - name: agent
        securityContext:
          privileged: true  # eBPF 需要

# eBPF 代理作为 sidecar (更为隔离，更多开销)
spec:
  containers:
  - name: my-app
    image: my-app:latest
  - name: ebpf-sidecar
    image: ebpf-agent:latest
    securityContext:
      privileged: true

    # 直接在主机上运行
    sudo ./beyla --config config.yaml

# 下载最新版本
curl -LO https://github.com/grafana/beyla/releases/latest/download/beyla-linux-amd64.tar.gz
tar xzf beyla-linux-amd64.tar.gz
sudo mv beyla /usr/local/bin/

# beyla-config.yaml
open_port: 8080  # 测量进程监听端口

# 或目标的可执行名称
# executable_name: "my-service"

# 或进程 ID
# pid: 12345

# OTLP 导出配置
otel_traces_export:
  endpoint: http://localhost:4317  # OTel 收集器

otel_metrics_export:
  endpoint: http://localhost:4317
  
# 可选: 添加资源参数
attributes:
  kubernetes:
    enable: true  # 自动检测 K8s 元数据
  
# 采样 (可选)
traces:
  sampler:
    name: parentbased_traceidratio
    arg: "0.1"  # 10% 采样

# 通过配置文件执行
sudo beyla --config beyla-config.yaml

# 或者通过环境变量
sudo BEYLA_OPEN_PORT=8080 \
     OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4317 \
     beyla

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: beyla
  namespace: observability
spec:
  selector:
    matchLabels:
      app: beyla
  template:
    metadata:
      labels:
        app: beyla
    spec:
      hostPID: true
      serviceAccountName: beyla
      containers:
      - name: beyla
        image: grafana/beyla:latest
        securityContext:
          privileged: true
          runAsUser: 0
        env:
        - name: BEYLA_OPEN_PORT
          value: "8080,3000,9090"  # 测量端口
        - name: OTEL_EXPORTER_OTLP_ENDPOINT
          value: "http://otel-collector.observability:4317"
        - name: BEYLA_KUBE_METADATA_ENABLE
          value: "true"
        volumeMounts:
        - name: sys-kernel
          mountPath: /sys/kernel
          readOnly: true
      volumes:
      - name: sys-kernel
        hostPath:
          path: /sys/kernel

# 安装 Odigos CLI
brew install odigos-io/homebrew-odigos-cli/odigos

# 或者直接下载
curl -LO https://github.com/odigos-io/odigos/releases/latest/download/odigos-cli-linux-amd64
chmod +x odigos-cli-linux-amd64
sudo mv odigos-cli-linux-amd64 /usr/local/bin/odigos

# 在集群里安装 Odigos
odigos install

# 创建:
# - odigos-system namespace
# - Odigos operator
# - Instrumentor DaemonSet
# - OTel Collector (可选)

# 添加可观测性后端
odigos ui

# 或通过 CLI
odigos destination add oneuptime \
  --endpoint https://otlp.oneuptime.com \
  --api-key YOUR_API_KEY

# 测量命名空间中的所有工作负载
odigos instrument namespace my-app-namespace

# 或指定工作负载
odigos instrument deployment my-service -n my-namespace

// Go 服务 - eBPF 自动捕获 HTTP 处理
// 为重要业务逻辑添加手动 span

func (s *OrderService) CreateOrder(ctx context.Context, req *OrderRequest) (*Order, error) {
    // eBPF已经获取：HTTP POST /orders、计时、状态

    // 业务逻辑细节的手动 span
    ctx, span := tracer.Start(ctx, "order.validate")
    err := s.validateOrder(ctx, req)
    span.End()
    if err != nil {
        // 手动：添加 eBPF 看不到的错误细节
        span.RecordError(err)
        span.SetStatus(codes.Error, "validation failed")
        return nil, err
    }
    
    // eBPF 自动捕获数据库调用
    // 手动：添加业务上下文
    ctx, span = tracer.Start(ctx, "order.save")
    span.SetAttributes(
        attribute.String("order.customer_id", req.CustomerID),
        attribute.Float64("order.total", req.Total),
        attribute.Int("order.items_count", len(req.Items)),
    )
    order, err := s.repo.Save(ctx, req)
    span.End()
    
    return order, err
}

# OTel Collector 配置合并两个源
receivers:
  otlp:
    protocols:
      grpc:
        endpoint: 0.0.0.0:4317
      http:
        endpoint: 0.0.0.0:4318

processors:
  batch:
    timeout: 1s
    
  # 添加一致的资源属性
  resource:
    attributes:
      - key: deployment.environment
        value: production
        action: upsert

exporters:
  otlp:
    endpoint: https://oneuptime.com/otlp
    headers:
      x-oneuptime-token: ${ONEUPTIME_TOKEN}

service:
  pipelines:
    traces:
      receivers: [otlp]
      processors: [batch, resource]
      exporters: [otlp]

# Beyla 示例: 通过采样降低开销
traces:
  sampler:
    name: parentbased_traceidratio
    arg: "0.01"  # 1% 采样

# 隔离高数据量、低价值的端点
routes:
  ignored:
    - /health
    - /ready
    - /metrics

# Kubernetes: 严格使用 RBAC
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: ebpf-agent-role
rules:
- apiGroups: [""]
  resources: ["pods", "nodes"]
  verbs: ["get", "list", "watch"]
# 避免授予不必要的权限

# 尽可能使用 seccomp 配置文件
securityContext:
  seccompProfile:
    type: RuntimeDefault

containers:
- name: ebpf-agent
  resources:
    requests:
      cpu: 100m
      memory: 128Mi
    limits:
      cpu: 500m
      memory: 512Mi

# 不要追踪每件事 —— 专注于重要的事情
routes:
  patterns:
    - /api/*        # Trace API calls
    - /graphql      # Trace GraphQL
  ignored:
    - /health       # Skip health checks
    - /metrics      # Skip metrics endpoint
    - /favicon.ico  # Skip static assets

# 通过采样控制数据量
traces:
  sampler:
    name: parentbased_traceidratio
    arg: "0.1"  # 10% in production

# 从非生产环境开始
odigos instrument namespace staging

# 验证开销和数据质量
# 然后扩展到生产环境
odigos instrument namespace production

# 导出 eBPF 代理指标
prometheus:
  port: 9090
  path: /metrics

# 代理有问题时告警
# - 高 CPU 使用率
# - 事件丢失
# - 导出失败