Monitoring Service Architecture and Health with BPF
summary
Claims a production system that gives 100% visibility into pod-to-pod flows by combining BPF (eBPF) kernel hooks and Kubernetes API metadata, aggregates per-socket flow records into an analysis pipeline and exports summaries to Prometheus. Demo injects a 75 ms delay and shows RTT and TCP timeouts; system reconstructs live architecture, spots cross-AZ cost hot spots, and detects degradations. Measured overhead is typically 0.1–0.2% CPU (worst seen 0.86%); telemetry adds ~0.5–1.15% network; supports hundreds of nodes with ~2s latency and can use uprobes for app-layer codes.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 1:06Jonathans background
- 2:50Demo application
- 3:57Architecture diagrams
- 6:25Service degradation
- 10:17Cost
- 11:48Summary
- 13:37Advantages and Disadvantages
- 15:56Extracting Flow Data from Kubernetes
- 17:08Performance
- 18:38BPF
- 20:28BPF utilities
- 23:03Endtoend analysis
- 25:23Evaluation
- 26:53Network Overhead
- 27:49Number of Events
- 29:11User Probes
related talks
27mStep By Step Kubernetes Observability with eBPF
31mZero instrumentation observability with eBPF
20mNetwork Monitor: A Tale of ACKnowledging an Observability Gap
31mEffortless, standardised homelab observability with eBPF
33mEffortless, Standardised Homelab Observability With eBPF
34mNetwork Observability with eBPF and OpenTelemetry
31mBridging Dev and Ops with eBPF: Extending Observability Upwards and Downwards
42meBPF-Powered Observab...