Lightning Talk: What Can eBPF Actually do for Modern-day Observability?
summary
Claim: eBPF plus user‑mode probes (uprobes) can deliver full observability of stateful, compressed or encrypted protocols like gRPC by reading library memory and function arguments. Implementation: attach five uprobes (send, receive variants and close) to gRPC library functions to extract headers and payloads, reconstruct compressed header meanings from HPACK state, and even peek after TLS decryption in crypto libraries. Result shown: per‑connection visibility with zero code changes and works for encrypted traffic.
AI-written summary · about
chapters (7)
- 0:00Introduction to eBPF
- 1:21The challenge of gRPC
- 2:42Standard kernel probing
- 3:42The gRPC observability gap
- 5:11Leveraging user mode probes
- 7:02Demonstration and results
- 8:58Conclusion and future outlook
related talks
31meBPF for Observability: The Good, the Bad, and the Ugly
37meBPF: Revolutionizing Observability and Telemetry for Modern Applications
26mExposing the Revolution: GRPC Observability with eBPF on K8s
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
35mAn Introduction to eBPF - Superpowers for Networking, Observability & Security
31mZero instrumentation observability with eBPF
32mExploring the Power of eBPF for System Observability
30mObservability in Kubernetes: Unlocking the Power of eBPF