Low-Overhead Tracing Using eBPF for Observability into Kubernetes Apps and Services

In the Kubernetes world, there is a need to build observability around apps and backing services deployed in Pods. The observability should allow to capture on demand low level metrics at a very low o …

In the Kubernetes world, there is a need to build observability around apps and backing services deployed in Pods. The observability should allow to capture on demand low level metrics at a very low overhead. The proposal is to use ebpf as the tracing technology to capture details at kernel and user level, and generate on demand flamegraphs, heat maps for applications & backend services. The in-kernel BPF JIT compiler, bpf program verifier and in-kernel storage maps implementation allow users to run the programs in kernel that can never interfere with the kernel negatively, without much overhead. These features make eBPF programs safe to run in production, and allow admins and engineers to collect crucial data from systems for performance analysis and monitoring. Link: https://docs.google.com/presentation/d/1tnhlVqddPQ7wvhxp0_YiqCrowjB29RqV3sK2U7dKPug/edit?usp=sharing