What is eBPF?
In the cloud landscape there is currently one technology, that was raising questions to me: eBPF.
I want to give a short answer what eBPF is and how it is used for Cloud Native development.
eBPF is not a ‘fresh and new’ idea from yesterday.
In fact, it exists since 2014, but has risen more and more attention in the past years.
It is often referred to as ‘JS, but for Kernel programmers’.
For people were going through a quite painful plain-JS development journey, this sounds like a nightmare.
But it is not about the development or language, it is about what eBPF enables kernel developers to do: Extending the Kernel fast and applicable to their needs without the need to convince the whole Kernel community of the changes.
This is comparable to JS: It enabled developers to extend the browser functionality without the need to build new browser versions with new features. Which revolutionized the whole web experience and gave us Single Page Applications.
As operating systems are hard to change and have a very long innovation cycle, it would take too much time to adapt the kernel and change it regarding the requirements - for the whole community! eBPF breaks this innovation cycle and enables kernel developers to build their own modules on kernel level.
There are different frameworks which allow to develop code that compiles to eBPF bytecode. This bytecode is executed by the eBPF runtime which lays in the kernel. The eBPF programs are executed on kernel events - at the same time as syscalls are invoked.
Is this kernel stuff interesting in any way for cloud developers?
Short answer: Yes, it is!
Long answer:
Beside of another step towards modular kernels, the eBPF foundation also works to make things better in the following aspects:
- eBPF Network Observability
- eBPF based Tracing, HTTP Observability
- eBPF based Security Observability.
All of these are applicable use cases for cloud developers. If you think of your current microservice architecture you may already have a solution for observability. But probably either as sidecars or proxies.
eBPF aims to move load balancing, service meshes, retry logic and so on to one transparent place. The overhead of implementing this in applications or having sidecars and proxies for this logic will be reduced. The complexity shall also be decreased as there will be one central place at which all of this happens.
Another important aspect is the security and networking. In Kubernetes you have different tools for different aspects of Networking. eBPF makes it possible to have one tool for all these aspects.
Using bpfilter instead iptables for routing and have filtering tasks in the kernel space, seems to make applications faster.
Furthermore you have a better control of network policies.
Cilium is currently the pioneer in building tools which make use of eBPF. With Tetragon they build a tool that observes and collects metrics through all layers. In the long run it shall show which processes are running in which namespaces, show file traces, collect sys and process calls, monitor code that is being executed and so on. All visible as logs for the end user.
So, when working on security-critical applications eBPF will give cloud developers more confidence about what is going on in the cluster.
(Image taken from the eBPF documentation page)
Conclusion
This post gave a short overview and explanation about what eBPF even is. Even when the technology lays in the Kernel space, it has effects for us cloud developers.
When you start using it today, you’ll be one of the early adopters. Especially for security-critical applications this is a technology that enables a lot of advantages. I don’t think to 100% that everyone needs this, but have an eye on this and discuss and decide when you seem to need it.
Further resources
Keynote: eBPF - Everything You Need to Know in 5 Minutes (youtube.com)
The Future of eBPF in Cloud Native (youtube.com)
What is eBPF (ebpf.io)? (this page gives very good further information)