Observability in Kubernetes: Unlocking the Power of eBPF
summary
Claims that eBPF runs sandboxed programs in kernel space to get real‑time visibility, avoids expensive syscall roundtrips, and can add features in days instead of kernel release cycles. Tools mentioned include Cilium and Pixie use eBPF and Falco/Tetragon/Tracee for runtime security. Concrete uses: per‑pod network stats via cgroups, load balancing and DDoS mitigation in kernel, and audit of kubectl exec sessions. Requires admin to load programs; code is constrained C attached to kprobes, tracepoints, sockets.
AI-written summary · about
chapters (10)
- 0:00Introduction and Overview
- 0:21Understanding Observability in Kubernetes
- 2:24Introduction to EBPF
- 3:27Applications and Use Cases of EBPF
- 8:49Kernel Space vs User Space
- 11:28System Calls and Performance Optimization
- 15:58Kernel Programming with EBPF
- 17:23Risks and Responsible Use of EBPF
- 19:11Advanced Use Cases in Kubernetes
- 24:20Conclusion and Recommended Readings
related talks
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
32mExploring the Power of eBPF for System Observability
35mAn Introduction to eBPF - Superpowers for Networking, Observability & Security
22mRole of eBPF in Kubernetes Networking and Security
31meBPF for Observability: The Good, the Bad, and the Ugly
27mLow-Overhead Tracing Using eBPF for Observability into Kubernetes Apps and Services
31mTrue Kubernetes Observability with eBPF
23mAn Intro to eBPF with Go : The Foundation of Modern Kubernetes Networking