An Introduction to eBPF - Superpowers for Networking, Observability & Security
summary
eBPF makes the kernel programmable: C code compiles to eBPF bytecode, a Go userland loader attaches a program as a kprobe on execve and prints a trace message — the demo is a working “hello” running on each exec. psyllium runs as a DaemonSet (one agent per node), maps pod IPs to endpoints and ties flows to Kubernetes identities, and benchmarks show eBPF networking approaches node-to-node throughput while reducing TCP stack traversals. Privileged load requires CAP_BPF and similar caution; a Windows eBPF port is underway.
AI-written summary · about
chapters (9)
- 0:00Start
- 3:07What Does It Mean To Run Custom Code in the Kernel
- 4:47Code in Practice
- 6:06K Probe
- 14:44Kubernetes Labels
- 23:07The Sidecar Model
- 29:26Microsoft Have Announced Ebpf on Windows
- 30:15Find Out More about Edpf
- 32:45What Are the Security Implications of of Being Able To Write Programs to the Kernel
