Inspektor Gadget and traceloop: BPF debugging tools for Kubernetes
summary
Traceloop captures system calls asynchronously per cgroup using BPF and an overwritable ring buffer so traces sit in memory like a flight recorder until inspected; it attaches at sys_enter and can drop events if the ring fills but still recovers useful last-run state for crashed pods. Inspektor Gadget runs traceloop in Kubernetes (DaemonSet pods), uses BCC/PCC helpers, exposes label-based selection and a network policy advisor that logs TCP connections to generate candidate policies. traceloop and gadgets demonstrably record and surface syscall and networking activity for post-mortem debugging.
AI-written summary · about
chapters (17)
- 0:00Intro
- 0:32Who is Kinvolk?
- 1:45BPF in a nutshell
- 4:09Debugging with "strace" on Kubernetes
- 5:45Comparing strace and traceloop
- 11:34Tracing tools for Kubernetes
- 15:21Supported platforms
- 16:28Use cases
- 19:53Selecting containers
- 20:44Pods & tracers come and go
- 21:05Keeping track of containers & tracers
- 24:12Example: GoogleCloudPlatform/microservices-demo
- 24:31Network policies not implemented
- 24:43How to use the Network Policy Advisor
- 26:02Example of generated network policy
- 27:00How to contribute
- 27:31Thank you!
related talks
22mTraceloop: Tracing containers syscalls using BPF
13mTalk Deep Dive
25mBeyond the Buzzword: BPF’s Unexpected Role in Kubernetes
28mBringing the power of eBPF tools to your k8s web UI
28mDebug Your Clusters with eBPF-Powered Tools
27mLow-Overhead Tracing Using eBPF for Observability into Kubernetes Apps and Services
24mMaking the Kernel Speak Kubernetes: Unlocking eBPF’s Power for Observability
27mBeyond printf & tcpdump: Debugging Kubernetes Networking with eBPF