Beyond Dashboards: Deep-Dive Network Observability with eBPF
summary
Compares two eBPF solutions deployed to an AWS EKS cluster at ~500 QPS and shows Retina uses ~47% less memory per node while Cilium causes ~31% CPU spike under the same load. Retina emits Hubble-format flows and uncovers DNS, TCP events and drop reasons but leaves an identity gap (IP→pod mapping in user space). Cilium provides kernel-level cryptographic endpoint identity and L7 parsing (HTTP/gRPC). Shows helm commands to deploy Retina in minutes, using Hubble observe for live debugging, and Cilium in CNI chaining mode when full identity and L7 visibility are required.
AI-written summary · about
chapters (11)
- 0:00Welcome and Topic Setup
- 1:48Why Dashboards Lie
- 3:14Monitoring vs Observability
- 4:38Iptables Limits in Kubernetes
- 6:12EBPF What It Unlocks
- 7:21How EBPF Agents Work
- 8:26Retina Architecture Deep Dive
- 10:02Cilium and Hubble Identity Model
- 11:58Benchmark Results and Screenshots
- 13:51Choosing Tools and 3 Step Blueprint
- 15:24Key Takeaways and Closing
related talks
25mHubble Beyond Cilium
34mNetwork Observability in Kubernetes with Cilium and Hubble
32mBuzzing across the eBPF Landscape and into the Hive
27mInsightful Traffic Monitoring: Harnessing Cilium for Comprehensive Network Observability
18meBPF & Cillium
31mBridging Dev and Ops with eBPF: Extending Observability Upwards and Downwards
38mUnderstanding and Troubleshooting the eBPF Datapath in Cilium
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools