eBPF for Observability: The Good, the Bad, and the Ugly - Anna Kapuscinska, Isovalent

eBPF for Observability: The Good, the Bad, and the Ugly - Anna Kapuscinska, Isovalent

eBPF’s promise of zero-instrumentation observability with low performance overhead sounds like a dream and is driving wide adoption in observability tooling. At the same time, as a relatively low-level technology it is often poorly understood or even feared. To bridge this gap, we will dive into how eBPF serves the observability field. Anna will start by introducing eBPF features that let us achieve observability with no code changes. Next, she will examine at a few distinct eBPF use cases in open source tools: * getting insights from granular system events (e.g. Tetragon) * continuous profiling (e.g. Pixie) * distributed tracing auto-instrumentation (OpenTelemetry) Peeking at both eBPF code and user interfaces will help us understand the potential of the technology. Finally, Anna will discuss the limits of using eBPF for observability and how it plays together with other frameworks. The audience will walk away understanding what works and what doesn’t when using eBPF for observability.