Cloud Native Superpowers with eBPF
Talkat KubeCon + CloudNativeCon North America 2021 · on Thursday, 2021-10-14· at 16:30· Room 403 AB + Online·
summary
eBPF runs small programs in the kernel and attach to execve or network events, with a verifier that enforces safety so code cannot crash or loop; demos use Falco to flag execve/netcat, Pixie to show cluster flame graphs and call stacks, and Cilium using XDP fast path to route packets directly to pods, achieving near bare‑metal network performance in benchmarks. It collects process, pod and timestamp context for deep forensics, instruments everything on a node with no app changes, and the examples all run live.
AI-written summary · about
chapters (12)
- 0:00Intro
- 0:39What is eBPF?
- 2:30Run custom code in the kernel
- 5:34eBPF Hello World
- 6:02eBPF code has to be safe
- 10:23CNCF eBPF projects
- 12:02Falco rule
- 16:16Cilium eBPF (Receive path)
- 18:49A sidecar has a view across one pod
- 19:04Sidecars need YAML
- 19:53eBPF does not need app changes
- 21:02Process visibility
related talks
36mCloud Native Superpowers with eBPF
29mBuzzing Across the Cloud Native Landscape with eBPF
43meBPF Superpowers for SRE
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
20mGentle Introduction to EBPF
36mPanel: Exploring eBPF Use Cases in Cloud-Native Security
37mJust Buzz or Real Byte? eBPF in Cloud Native
42mResolving Performance and Security Issues with eBPF