Find out what your processes are capable of with ebpf
summary
Shows how BumbleBee converts eBPF events to Prometheus counters by compiling a libbpf C probe for the kernel cap_capable hook, packaging it as an OCI image, and running it as a DaemonSet so one pod runs per node (demo uses three nodes). Kernel maps become Prometheus counters and histograms, allowing filtering for capabilities like CAP_NET_ADMIN and alerting on surprising frequencies. An operator is listed as roadmap work; the Grafana dashboard demo is functional.
AI-written summary · about
chapters (4)
- 0:00Start
- 7:01How can you monitor these capabilities?
- 9:06Build your eBPF program with BumbleBee
- 14:16Roadmap
related talks
36mBumbleBee: Or How I Learned To Stop Worrying And Love eBPF
01h 02mTutorial: Create Your First EBPF Program to Monitor Your System Using Bumblebee
27mStep By Step Kubernetes Observability with eBPF
36mPrometheus as exposition format for eBPF programs ..
29mKubernetes Observability with eBPF
25mPowering Observability with Simple, Sharable, EBPF Programs
42meBPF-Powered Observab...
35mBumbleBee: Or How I Learned To Stop Worrying And Love eBPF - Krisztian Fekete