From PIDs to Pods: our journey to connect eBPF and Kubernetes
summary
Grafana Baila uses eBPF probes plus a userspace monitor to auto‑instrument HTTP, gRPC, SQL and Kafka and export OpenTelemetry; it maps kernel PIDs to Kubernetes pods by reading /proc for container IDs, subscribing to Kubernetes informers, and walking task_struct to the outermost PID namespace to resolve mismatched PID views. Deployed as a daemonset or sidecar, it runs with low overhead thanks to the eBPF verifier, requires elevated privileges, handles most real workloads in production, and still breaks on some runtime ABI changes (notably Go).
AI-written summary · about
chapters (15)
- 0:00Introduction to the talk
- 0:51What is auto instrumentation
- 4:28Grafana Baila overview
- 5:12What is eBPF
- 8:02How eBPF probes work
- 11:37eBPF program types
- 14:07eBPF pros and cons
- 18:25Metrics and traces in Baila
- 21:16Kubernetes challenges
- 23:47From PIDs to Pods
- 29:11User space discovery
- 32:10Trace journey in Kubernetes
- 32:53Demo setup
- 35:47OpenTelemetry donation
- 37:12Q&A session
related talks
24mFrom PIDs to Pods: The Life Cycle of an eBPF-Autoinstrumented..
29mUsing eBPF for Non-invasive, Performant, Instant Network Monitoring
22mFrom PIDs to Pods: the life cycle of an eBPF-autoinstrumented Kubernetes app
27mStep By Step Kubernetes Observability with eBPF
30mObservability in Kubernetes: Unlocking the Power of eBPF
28mBringing the power of eBPF tools to your k8s web UI
18mFind out what your processes are capable of with ebpf
27mLow-Overhead Tracing Using eBPF for Observability into Kubernetes Apps and Services