From Monitoring to Observability: eBPF Chaos - Michael Friedrich
summary
eBPF moves observability into the kernel to give SRE and DevSecOps access to syscalls, packets and resource events for debugging, security and profiling. Practical tooling shown includes BCC and bpftrace, BPF programs compiled with clang/GCC, Prometheus/OpenTelemetry collectors and projects like Pixie, Cilium, Falco and Tetragon. A small random packet-drop probe is built and loaded on loopback; the live demo yields about 74% packet loss, proving eBPF can power chaos experiments that verify collectors, SLO alerts and security policies.
AI-written summary · about
chapters (15)
- 0:00Introduction and motivation
- 3:11What is observability
- 4:36Introduction to eBPF
- 7:06Learning eBPF with tools
- 9:15Developing eBPF programs
- 11:40eBPF use cases for observability
- 13:49Security and eBPF tools
- 16:19Chaos engineering with eBPF
- 25:14Live eBPF chaos demo
- 27:45eBPF in CI/CD pipelines
- 28:51Risks and limitations of eBPF
- 29:55Key takeaways and conclusion
- 31:17Q&A: GitLab plans for eBPF
- 32:44Q&A: Runtime impact of eBPF
- 33:49Q&A: Deploying eBPF programs
related talks
31meBPF for Observability: The Good, the Bad, and the Ugly
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
32meBPF: The Next Power Tool of SREs
32mExploring the Power of eBPF for System Observability
38meBPF for Observability: Hard Truths and Practical Wins
43meBPF Superpowers for SRE
31mBridging Dev and Ops with eBPF: Extending Observability Upwards and Downwards
20mClosing Perspectives