Bridging Dev and Ops with eBPF: Extending Observability Upwards and Downwards
summary
eBPF instruments kernel events (execve, connect, syscalls) to emit low‑overhead, aggregated metrics enriched with Kubernetes metadata and identities. Tools shown: Cilium for CNI, Hubble for service flows, Tetragon for process‑to‑network linking, plus BPFTrace/BCC and Parca for continuous profiling. Examples: capture TLS version/ciphers at handshake, enforce network policies in‑kernel, correlate a spawned shell with an outbound nc connection, and a Parca run that improved Cilium performance within an hour.
AI-written summary · about
chapters (7)
- 0:00Start
- 0:16Dumb Monitoring
- 4:48Observability Ownership
- 14:32Deep Down in Kernel Space
- 16:46Observability: bpftrace
- 18:30Networking: Hubble (CLI)
- 20:28Network Metrics (Hubble)
related talks
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
31meBPF for Observability: The Good, the Bad, and the Ugly
27mStep By Step Kubernetes Observability with eBPF
30mObservability in Kubernetes: Unlocking the Power of eBPF
17meBPF in Microservices Observability
20mClosing Perspectives
32mExploring the Power of eBPF for System Observability
29mKubernetes Observability with eBPF