An Intro to eBPF with Go : The Foundation of Modern Kubernetes Networking
summary
eBPF lets tiny C programs run inside the kernel, verified and sandboxed so the kernel never crashes, and Go plus cilium/ebpf compiles, loads and links them with clang at runtime without rebooting. Examples show tracing syscalls to log file opens, using eBPF maps to count source IP packets per VM, and an XDP express data path program that drops pings at the NIC—dynamic, per-node enforcement for Kubernetes (used by Cilium and Tetragon) that actually works in demos.
AI-written summary · about
chapters (10)
- 0:00eBPF and Kubernetes networking
- 2:22Why the kernel feels like an Arab market
- 4:31The eBPF lamp and the cave of wonders
- 7:27Go and eBPF programming
- 9:38Visibility without recompiling
- 13:34Observing system behavior
- 15:22Kernel-level protection
- 17:54eBPF in Kubernetes
- 19:38Third wish freeing the eBPF genie
- 21:48eBPF tools and lessons
related talks
22mRole of eBPF in Kubernetes Networking and Security
32mExploring the Power of eBPF for System Observability
30mObservability in Kubernetes: Unlocking the Power of eBPF
29mKubernetes Observability with eBPF
29meBPF on the Rise - Getting Started
42mMonitoring Kubernetes Traffic with eBPF
24mUnlocking eBPF from Go
19mKeynote: Hello eBPF! Goodbye Sidecars?