Past, Present, and Future of eBPF in Cloud Native Observability

This talk explores the evolution of eBPF in cloud-native observability. Frederic Branczyk traces the history of eBPF, its current applications in projects like Cilium Hubble and Pixie, and demonstrates its use in Kubernetes for cluster insights. Natalie Serrino discusses the historical development of eBPF, differentiating it from its predecessor BPF, and highlighting key milestones like the introduction of the eBPF JIT compiler and the shift towards C for programming. They also address common misconceptions about eBPF's capabilities and limitations, particularly regarding language support and its applicability beyond networking. The presentation delves into the challenges and advancements in the present state of eBPF, such as obtaining symbols for native binaries and unwinding stack traces without frame pointers. Finally, they look towards the future of eBPF in observability, emphasizing performance, accessibility, and enhanced interpretability of the data it provides.