Cilium is a Kubernetes-native networking, observability, and security solution built on eBPF. It provides CNI plugin functionality with overlay/native routing modes, distributed load balancing (replacing kube-proxy), cluster mesh for multi-cluster connectivity, identity-based network policies (L3-L7), service mesh with mutual authentication, and observability via Hubble (flow metrics, DNS insights). The architecture features a modular design using the Hive dependency injection framework, with components including the cilium-agent daemon, operator for CRD management, CLI tools for management/debugging, and API servers for inter-component communication. The data plane leverages eBPF/XDP for high-performance packet processing, while the control plane integrates deeply with Kubernetes through client-go, controller-runtime, and custom resource definitions.
KernelScript is a domain-specific language and compiler (OCaml) for developing eBPF-centric programs. The compiler translates a single `.ks` source file into multiple C outputs: idiomatic eBPF C code (for kernel execution via XDP, TC, kprobe, tracepoint, perf_event, struct_ops), userspace loader C code (managing maps, ring buffers, tail calls, and program lifetime), and optionally kernel module C code (for `@kfunc` functions). The compiler pipeline includes lexing, parsing, symbol table construction, type checking (including context-specific rules for eBPF program types), IR generation with control-flow and data-flow analysis, loop analysis (bound detection, bpf_loop optimization), tail-call detection and automatic progarry management, map assignment optimization, safety checking (null pointer, bounds, overflow), and multi-program optimization (map type changes, batching). It also supports BTF introspection for kernel type and kfunc extraction, a Python bridge, and a compile-time evaluator. The architecture is modular with pluggable context code generators per program type. The project includes an extensive test suite covering the full pipeline from parse to C output and specific features like perf_event attach, ring buffer dispatch, struct_ops, and multi-program scenario.
Honey Potion is a compiler framework that translates a subset of the Elixir programming language into eBPF (extended Berkeley Packet Filter) programs, targeting both tracepoints and XDP. The system works as an Elixir library (published on Hex as `honey`) where users write eBPF logic in Elixir using macros like `@sec`, `defmap`, and `fuel`. At compile time, `__before_compile__` triggers a pipeline: static analysis, optimization (constant propagation, dead code elimination, type propagation), AST-to-C translation, boilerplate generation, and C compilation via `make`/`clang`/`llc`/`bpftool`. The generated C code includes a custom runtime with heap, tuple pool, and string pool implemented using BPF maps to overcome eBPF's stack and memory constraints. The repository includes 20+ example programs (system monitors, packet filters, data structure demos) and a comprehensive benchmark suite comparing hand-written C eBPF programs to Honey-generated ones, supporting a published research paper. Although classified as an application (a compiler library), the project has strong research characteristics with reproducible artifact scripts, optimizer variants, and performance comparisons.