Yechezkel Rabinovich, CTO of Groundcover, discusses observability and eBPF in Kubernetes. Topics include the three pillars of observability, extending the Linux Kernel with eBPF, basics of Kubernetes, and how Groundcover uses eBPF in its observability platform.
Read more
AI Summary
AI Chapters
Episode notes
auto_awesome
Podcast summary created with Snipd AI
Quick takeaways
Observability has three pillars: logging, metrics, and tracing, which provide important insights for troubleshooting and improving application performance.
eBPF enables safer and more efficient kernel extension, running in a virtual machine and allowing tracing, filtering, and modification of kernel functions.
Kubernetes functions as a cloud-native operating system, facilitating the management of containers and microservices, and observability involves monitoring the infrastructure and application planes for overall health and performance.
Deep dives
Observability: The Three Pillars of Data
Observability is commonly understood as having three pillars of data: logging, metrics, and tracing. Logging involves capturing text messages generated by applications, metrics include counters and gauges that measure application performance, and tracing involves recording interactions between services. By effectively querying and understanding these three types of data, developers gain important insights into the state and performance of their applications for troubleshooting and improving security and performance.
eBPF: Extending the Linux Kernel Safely
eBPF is a technology that allows dynamic changes to the Linux kernel. Unlike traditional kernel modules, eBPF enables safer and more efficient kernel extension. It guarantees efficient performance while running and operates in a read-only mode. eBPF programs run in a virtual machine, analogous to JavaScript in the browser, and are written in C. The eBPF verifier ensures safety and compatibility of programs with the kernel. eBPF hooks can be used for various purposes, such as tracing kernel functions, user-space information, or filtering network events.
Kubernetes: A Cloud-Native Operating System
Kubernetes is often described as an orchestrator for containers, but it is more accurately characterized as a cloud-native operating system. It provides the necessary infrastructure for running and managing containers and offers functionalities like networking, storage, scheduling, and resource management. Kubernetes facilitates the management of microservices, making deployment, scaling, and upgrades easier. Observability in Kubernetes involves monitoring both the infrastructure plane (nodes, clusters) and the application plane (containers, pods) to ensure overall health and performance.
The Challenges of Observability in Multi-Cloud Environments
Observability in multi-cloud environments presents challenges related to monitoring resources and dependencies across multiple cloud providers. It is essential to establish a dedicated monitoring cluster where data from all cloud deployments is consolidated. By using standard formats like OpenTelemetry, Auto, or Prometheus Remote Write, data can be sent to the monitoring cluster for consistent and comprehensive observability. Proper observability allows for the identification of anomalies and troubleshooting across diverse cloud environments.
Ground Cover: Frictionless Observability Powered by eBPF
Ground Cover is an observability platform that leverages eBPF technology for frictionless monitoring and troubleshooting. The platform utilizes eBPF programs to collect data directly from the kernel, reducing the need for data transfer and minimizing performance impact. Ground Cover's stream processing capabilities allow for real-time analysis and querying of data at the node level, eliminating the need for excessive data transfer or costly egress. The platform integrates with other tools like Prometheus, Grafana, and alerts, providing a unified and cost-efficient observability solution.
Yeckezkel Rabinovich, CTO of Groundcover, speaks with host Philip Winston about observability and eBPF as it applies to Kubernetes. Rabinovich was previously the chief architect at the healthcare security company CyberMDX and spent eight years in the cyber security division of the Israeli Prime Minister’s Office. This episode explores the three pillars of observability, extending the Linux Kernel with eBPF, the basics of Kubernetes, and how Groundcover uses eBPF as the basis for its observability platform.
Get the Snipd podcast app
Unlock the knowledge in podcasts with the podcast player of the future.
AI-powered podcast player
Listen to all your favourite podcasts with AI-powered features
Discover highlights
Listen to the best highlights from the podcasts you love and dive into the full episode
Save any moment
Hear something you like? Tap your headphones to save it with AI-generated key takeaways
Share & Export
Send highlights to Twitter, WhatsApp or export them to Notion, Readwise & more
AI-powered podcast player
Listen to all your favourite podcasts with AI-powered features
Discover highlights
Listen to the best highlights from the podcasts you love and dive into the full episode