eBPF in Microservices Observability
summary
eBPF programs get verified and JIT‑compiled, attach to sockets or syscall and tracepoints, and write into bpf maps that a user‑space agent reads; Pixie can deploy eBPF programs from a control plane and Pixie shows inbound HTTP without code changes, letting you see slow requests and raw tcp/http events. Cilium/Hubble provides a UI for flow metadata, eBPF can generate distributed‑trace spans from incoming headers, and a continuous profiler unwinds kernel+user stacks so you get low‑overhead, full‑stack profiles.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 2:16How eBPF works
- 3:39Network events
- 4:06Challenges in microservices
- 7:35Too much data
- 8:01Consistency
- 8:47Recap
- 9:28Where does eBPF help
- 10:53Distributed tracing
- 13:05Decorating with context
- 14:21Other projects
- 14:48Whats next
related talks
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
32mBuzzing across the eBPF Landscape and into the Hive
26mTriaging Real-time Security Threats with eBPF-powered Observability
31meBPF for Observability: The Good, the Bad, and the Ugly
43meBPF Superpowers for SRE
31mBridging Dev and Ops with eBPF: Extending Observability Upwards and Downwards
37mJust Buzz or Real Byte? eBPF in Cloud Native
35mAn Introduction to eBPF - Superpowers for Networking, Observability & Security