Optimizing eBPF Programs for Advanced Observability - Anubhab Majumdar & Vamsi Kalapala

One common use for eBPF is to observe Kubernetes traffic by installing bpf programs at various points in the kernel. With workloads growing to hundreds of thousands of pods, eBPF programs needs to scale in tandem, while keeping their resource footprint small, and the number of generated events manageable and relevant, otherwise, users risk drowning in noise and running up big storage costs to retain the events.
We faced these challenges when using eBPF to observe network packets and send them to user space for generating metrics. Flooded with network packets passing through the node, our user-space code struggled to consume the events generated by eBPF programs quickly enough. Knowing that only a subset of events is usually of interest, we set about designing a dynamic filtering mechanism in eBPF to ensure important events are never missed.
In this session, we discuss how we can design eBPF programs that are more efficient and scalable, and showcase the benefits through a demo.
---
Don't forget to subscribe to the channel and join the Cilium & eBPF slack here: slack.cilium.io.
If you're Learning eBPF for the first time, Liz Rice's eBPF book is a great resource. Download it here: isovalent.com/...
#ebpf #cilium #cloudnative