Cloud Native Superpowers with eBPF

Overview

Explore the powerful capabilities of eBPF in cloud native environments through this informative conference talk. Discover how eBPF enables high-performance tools for managing, debugging, and securing applications in the cloud. Learn about eBPF's role in cloud native observability, networking, and security, with examples from tools like Falco, Pixie, and Cilium. Gain insights into eBPF's ability to collect performance and behavioral data across entire systems, relate observed data to Kubernetes objects, and instrument workloads without modifying applications or configurations. Through live-coding demonstrations and examples from the cloud native ecosystem, understand eBPF's strengths and limitations. Acquire a comprehensive understanding of eBPF's impact on cloud native technologies, even without extensive Linux kernel knowledge.

Syllabus

Intro
What is eBPF?
Run custom code in the kernel
eBPF Hello World
eBPF code has to be safe
CNCF eBPF projects
Falco rule
Cilium eBPF (Receive path)
A sidecar has a view across one pod
Sidecars need YAML
eBPF does not need app changes
Process visibility