Download to read offline
![Brief insight into writing a gadget
struct key_t {
gadget_comm comm[TASK_COMM_LEN];
gadget_mntns_id mntns_id;
};
struct value_t {
__u64 packets;
};
struct {
__uint(type, BPF_MAP_TYPE_HASH);
__uint(max_entries, 1024);
__type(key, struct key_t);
__type(value, struct value_t);
} stats SEC(".maps");
GADGET_MAPITER(packetcounter, stats);](https://image.slidesharecdn.com/burakok-251124121320-f2aba888/75/OSMC-2025-Making-the-Kernel-Speak-Kubernetes-Unlocking-eBPF-s-Power-for-Observability-by-Burak-Ok-pdf-16-2048.jpg)
Uploaded byNETWAYS
OSMC 2025: Making the Kernel Speak Kubernetes: Unlocking eBPF’s Power for Observability by Burak Ok.pdf
The Linux kernel reveals detailed observability data, but context is often missing. Imagine debugging a slow service in Kubernetes. eBPF can trace the issue by linking kernel events to the affected container, providing clarity, though it introduces added complexity. This talk explores how Inspektor Gadget abstracts eBPF’s complexity, correlating events with Kubernetes resources. You’ll see how the provided gadgets can be used and learn to build your own troubleshooting gadgets with ease.
More Related Content
Similar to OSMC 2025: Making the Kernel Speak Kubernetes: Unlocking eBPF’s Power for Observability by Burak Ok.pdf
OSMC 2025: Making the Kernel Speak Kubernetes: Unlocking eBPF’s Power for Observability by Burak Ok.pdf
- 2. Agenda • Quick eBPFintro • Inspektor Gadget • Ready to go gadgets • Building your own gadgets • Questions
- 3. Getting into theKernel: eBPF • Bytecode runtime in the Linux Kernel • Guaranteed to not crash • Verifier runs before the program is loaded • Runs in a sandbox • Used for • Networking • Security • Tracing and Observability
- 4.
- 5. Working with eBPF programs KernelUserspace eBPF Network eBPF programs syscall Monitored Process
- 6. Working with eBPF programs Kernel eBPFmap Userspace Event eBPF Network eBPF programs syscall Monitored Process
- 7. Working with eBPF programs Kernel eBPFmap Userspace Event - New language to learn - Deep Linux insights eBPF Network - Need to develop a userspace program - Link these events to Kubernetes
- 8. Working with eBPF programs Kernel eBPFmap Userspace Event eBPF Network
- 9. Kernel Userspace CNCF SandboxProject Working with Inspektor Gadget Gadgets (eBPF programs) eBPF map Event Network
- 10. Kernel Userspace Working withInspektor Gadget Kubernetes API Server Container Runtime Others… DNS answer for inspektor-gadget.io From: Service kube-dns in NS kube-system To: curl in Pod Frontend in NS default Addr: 172.67.164.52 Event -mnt namespace -ns namespace -process ID -IP addr Event Gadgets (eBPF programs) eBPF map Event Network
- 11. Inspektor Gadget –A set of tools • Managing eBPF programs • Enrichment • Filtering • Data export • Many modes of use • Sharing & distribution
- 12. Official gadgets • Advise:Recommend system configurations based on collected information • seccomp-profile, network-policies • Audit: Audit a subsystem • seccomp • Profile: Profile different subsystems • block-io, cpu • Snapshot: Take a snapshot of a subsystem and print it • process, socket • Top: Gather, sort and periodically report events according to a given criteria • blockio, file, tcp • Trace: Trace and print system events • bind, dns, exec, mount, oomkill, tcp{drop, retrans}, open, few more…
- 13. Demo of anofficial gadget
- 14. IG – Aframework for eBPF devs • Allow everyone to easily build eBPF gadgets • Same enrichment, filtering and helpers • No additional userspace program needed • Package gadgets in OCI artifacts
- 15. Gadgets as OCIartifacts • An OCI image that contains • Metadata for the gadget • Basic information (author, license, etc.) • Supported export options (Prometheus, API, logging, etc.) • etc. • eBPF program(s) as object file • Optional user-space modules for post- processing of data • A deployable unit • A sharable unit Gadget (OCI) Metadata YAML eBPF program ELF Userspace processing WASM
- 16. Brief insight intowriting a gadget struct key_t { gadget_comm comm[TASK_COMM_LEN]; gadget_mntns_id mntns_id; }; struct value_t { __u64 packets; }; struct { __uint(type, BPF_MAP_TYPE_HASH); __uint(max_entries, 1024); __type(key, struct key_t); __type(value, struct value_t); } stats SEC(".maps"); GADGET_MAPITER(packetcounter, stats);
- 17. Brief insight intowriting a gadget SEC("kprobe/udp_sendmsg") int BPF_KPROBE(probe_udp_sendmsg, struct sock *sk) { struct key_t key = {}; struct value_t *value; /* Filter by container and more using gadget helpers */ if (gadget_should_discard_data_current()) return 0; key.mntns_id = gadget_get_current_mntns_id(); /* SNIP */ return 0; }
- 18. Brief insight intowriting a gadget ~/mygadget $ sudo ig image build –t ghcr.io/burak-ok/mygadget:test . Pulling builder image ghcr.io/inspektor-gadget/gadget-builder:v0.46.0 ... Successfully built ghcr.io/burak-ok/mygadget:test@sha256:5a1b86c... ~/mygadget $ sudo ig image push ghcr.io/burak-ok/mygadget:test Pushing ghcr.io/burak-ok/mygadget:test... Successfully pushed ghcr.io/burak-ok/mygadget:test@sha256:5a1b86c... ~/mygadget $ kubectl gadget run ghcr.io/burak-ok/mygadget:test --verify-image=false K8S.NODE K8S.NAMESPACE K8S.PODNAME COMM PACKETS minikube-doc… kube-system coredns-7db…hwl coredns 14 minikube-doc… default test-pod nslookup 2
- 19. Thanks – Anyquestions? • https://inspektor-gadget.io • https://github.com/inspektor-gadget/Contribfest-KubeCon- Europe2025/blob/main/ to learn how to create your own Gadget • https://github.com/burak-ok • https://de.linkedin.com/in/burak-ok