Using eBPF for Non-invasive, Performant, Instant Network Monitoring
Talkat KubeCon + CloudNativeCon Europe 2025 · on Friday, 2025-04-04· at 15:15· Level 0 | ICC Auditorium·
summary
Grafana Baila uses eBPF to extract L3–L7 signals without redeploying apps, injecting many small probes into kernel and user space, storing events in eBPF maps and joining them by thread or runtime IDs to reconstruct HTTP/gRPC/Kafka requests. It ties flows to Kubernetes via informers and /proc container IDs, offers zero-code automatic instrumentation, adds OpenTelemetry metrics/traces, and uses a novel IPv4 options trace propagation to pass trace IDs across TLS. Implementation-dependent probes are required per runtime, and metric cardinality is configurable.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 0:43What is eBPF
- 3:14eBPF capabilities
- 4:41Grafana Beyla network monitoring
- 7:59Collecting network metrics
- 10:13Tracing HTTP in web servers
- 12:22Tracing HTTP in async servers
- 14:08Network vs app metrics
- 15:13Trace context propagation
- 18:47Network monitoring in Kubernetes
- 21:40Matching processes to resources
- 22:44Tracking inter-zone traffic
- 24:53Accurate DNS resolution
- 25:56Managing metric cardinality
- 26:40Visualizing service topology
- 27:02Future of Grafana Beyla
- 28:15Q&A
related talks
41mFrom PIDs to Pods: our journey to connect eBPF and Kubernetes
33mEffortless, Standardised Homelab Observability With eBPF
35mSidecarless Mesh Monitoring with eBPF and Grafana
31mEffortless, standardised homelab observability with eBPF
37meBPF: Revolutionizing Observability and Telemetry for Modern Applications
31mZero instrumentation observability with eBPF
31mBridging Dev and Ops with eBPF: Extending Observability Upwards and Downwards
42mCommunity Driven Breakout Session: eBPF and Auto-Instrumentation