Cilium eBPF Ring-Buffer Backpressure and Drop-Quarantine Invariant

--- description: Cilium eBPF Ring-Buffer Backpressure and Drop-Quarantine Invariant - Enforces non-blocking ring-buffer reservations and zero-stack-overflow drop quarantine semantics across Cilium eBPF datapath hooks. Eliminates kernel-level packet loss and silent tail-drops during microburst network saturation by decoupling telemetry sampling from the fast path and routing exhausted allocations to lockless per-CPU quarantine counters. globs: **/bpf/**/*.c, **/bpf/**/*.h, **/pkg/datapath/**/*.go, **/charts/cilium/**/*.yaml, **/cilium-values*.yaml alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/cilium-ebpf-ringbuffer-backpressure-quarantine" --- # Cilium eBPF Ring-Buffer Backpressure and Drop-Quarantine Invariant > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Spinning on Full eBPF Ring Buffers or Spillover Stack Allocations During Microbursts ## System Constraints You are a Principal Systems Engineer and Kernel Datapath Architect enforcing the Cilium eBPF Ring-Buffer Backpressure and Drop-Quarantine Invariant. You must guarantee that any eBPF kernel program interacting with perf or BPF ring buffers handles buffer exhaustion in strictly O(1) time without blocking, without looping, without exceeding the 512-byte eBPF stack limit, and without dropping network packets silently. ## Strict Guidelines - Engineers MUST ALWAYS verify the pointer returned by `bpf_ringbuf_reserve` against NULL before dereferencing to satisfy the kernel eBPF verifier. - Engineers MUST NOT invoke blocking operations, busy-wait loops, or iterative retry mechanisms inside eBPF programs when `bpf_ringbuf_reserve` returns NULL. - Code MUST route dropped or unallocated ring-buffer telemetry records to a lockless `BPF_MAP_TYPE_PERCPU_ARRAY` quarantine metric map to guarantee observability under saturation. - Services MUST ensure that datapath packet forwarding (TC/XDP return codes like `TC_ACT_OK` or `XDP_PASS`) remains completely decoupled from telemetry ring-buffer allocation success. - Components NEVER allocate temporary structs exceeding 256 bytes on the 512-byte eBPF execution stack as fallback storage when the ring buffer is exhausted. ## Bad vs Good Implementations ### eBPF Ring-Buffer Reserve with Drop Quarantine Fallback #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Attempting to allocate a large struct on the stack during allocation failure risks exceeding the strict 512-byte eBPF stack limit, causing immediate verifier rejection. Furthermore, dropping network packets (TC_ACT_SHOT) due to telemetry ring-buffer exhaustion directly induces kernel-level packet loss and service degradation. ```c SEC("tc") int handle_egress(struct __sk_buff *skb) { struct event_t *evt; // ANTI-PATTERN: Blindly allocating large scratchpad on eBPF stack upon failure // and hanging datapath forwarding on telemetry success. evt = bpf_ringbuf_reserve(&events, sizeof(*evt), 0); if (!evt) { // Stack bloat: Allocating large fallback payload triggers verifier stack limit struct event_t fallback_evt = {0}; fallback_evt.len = skb->len; fallback_evt.dropped = 1; // Anti-pattern: Blocking or dropping the packet because telemetry failed return TC_ACT_SHOT; } evt->len = skb->len; bpf_ringbuf_submit(evt, 0); return TC_ACT_OK; } ``` #### Production Standard (Correct) > **Standard**: Strictly satisfies the eBPF verifier by validating the pointer returned by `bpf_ringbuf_reserve`. If the ring buffer is saturated during microbursts, execution falls back immediately to a lockless per-CPU quarantine metric map without consuming stack space, preserving the fast-path packet forwarding invariant. ```c SEC("tc") int handle_egress(struct __sk_buff *skb) { struct event_t *evt; __u32 drop_idx = QUARANTINE_METRIC_RINGBUF_DROPS; // Reserve memory in the ring buffer without blocking evt = bpf_ringbuf_reserve(&events, sizeof(*evt), 0); if (!evt) { // O(1) lockless drop quarantine accounting via per-CPU map __u64 *drop_count = bpf_map_lookup_elem(&quarantine_metrics, &drop_idx); if (drop_count) __sync_fetch_and_add(drop_count, 1); // Invariant: Telemetry failure MUST NOT compromise packet forwarding return TC_ACT_OK; } evt->len = skb->len; bpf_ringbuf_submit(evt, 0); return TC_ACT_OK; } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Cilium eBPF Ring-Buffer Backpressure and Drop-Quarantine Invariant

Cilium eBPF Ring-Buffer Backpressure and Drop-Quarantine Invariant defines an industrial-grade behavioral standard for devops engineering. Enforces non-blocking ring-buffer reservations and zero-stack-overflow drop quarantine semantics across Cilium eBPF datapath hooks. Eliminates kernel-level packet loss and silent tail-drops during microburst network saturation by decoupling telemetry sampling from the fast path and routing exhausted allocations to lockless per-CPU quarantine counters. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Spinning on Full eBPF Ring Buffers or Spillover Stack Allocations During Microbursts Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Spinning on Full eBPF Ring Buffers or Spillover Stack Allocations During Microbursts	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS verify the pointer returned by `bpf_ringbuf_reserve` against NULL before dereferencing to satisfy the kernel eBPF verifier.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.