Using BPF Iterators to Gain Insight into Kubernetes
summary
BPF iterators (added in Linux 5.8) let the kernel itself walk tasks and sockets so a 25-line iterator yields one line per thread or TCP socket with a single read instead of thousands of /proc opens (demo compares ~5,000 syscalls vs one). Inspector Gadget uses BPF iterators via bpffs + bpftool to implement process and socket collectors, enriching results from a BPF hash map keyed by mnt namespace ID with container/pod/label strings; network iteration runs once per network namespace (practically per pod).
AI-written summary · about
chapters (13)
- 0:00BPF iterators in Kubernetes
- 1:28BPF evolution to iterators
- 3:53Demo: BPF over Linux threads
- 7:10BPF vs traditional ps command
- 8:12Demo: BPF over TCP sockets
- 9:35Namespace isolation with BPF
- 10:16Enriching BPF data for Kubernetes
- 11:20Demo: Kubernetes process gadget
- 12:24Demo: Kubernetes socket gadget
- 13:27Container metadata for BPF enrichment
- 14:52BPF maps for container metadata
- 16:35Inspecting BPF maps for metadata
- 17:57Future BPF iterator enhancements
related talks
20mebpf iterators
21mPerformance Wins with BPF: Getting Started
25mBeyond the Buzzword: BPF’s Unexpected Role in Kubernetes
35mPerformance Insights into eBPF Step by Step
36mObservability and performance analysis with BPF
16mBPF Based Telemetry, Metrics, and Accounting on Android
27mLow-Overhead Tracing Using eBPF for Observability into Kubernetes Apps and Services
13mTalk Deep Dive