Tales from an eBPF Program's Murder Mystery

Dive into a thrilling investigation of eBPF program failures in this conference talk. Follow detectives Hemanth and Guillaume as they unravel a multi-week mystery involving Cilium and eBPF, which led to cluster-wide connectivity issues. Gain valuable insights into potential pitfalls for developers working with eBPF-based components and learn how to avoid them. Explore the Linux traffic control subsystem and discover how to program it using eBPF. Walk through the process of identifying the root cause of the incident, tracing it back to a race condition and pinpointing the culprit function. Master the use of bpftrace and its tools for effective debugging. Conclude by examining ongoing work on eBPF program ownership, its impact on security use cases, and the critical importance of addressing these challenges in the evolving landscape of cloud-native technologies.

Tales from an eBPF Program’s Murder Mystery - Hemanth Malla & Guillaume Fournier, Datadog