Tutorial: Create Your First EBPF Program to Monitor Your System Using Bumblebee

The presentation discusses the use of eBPF programs in cybersecurity and DevOps, specifically in collecting and analyzing metrics for monitoring purposes.

• eBPF programs can be used to collect valuable data from traffic operating on a system
• Bumblebee is an example of a service that provides metrics directly on the server once run
• Prometheus can be used to collect and analyze metrics from various sources, including eBPF programs
• eBPF programs can be reused and deployed on multiple clusters to collect data from traffic going from a service to another
• The Book Info demo application is used as an example to demonstrate the deployment of Prometheus to collect metrics

The speaker gives an example of how eBPF programs can be used to monitor communication between services in a company with multiple clusters. By deploying the program on every cluster, data can be collected and analyzed to create a full graph of communication between services. The Book Info demo application is used to demonstrate the deployment of Prometheus to collect metrics.

eBPF is a revolutionary technology with origins in the Linux kernel that can run sandboxed programs in an operating system kernel. It is used to safely and efficiently extend the capabilities of the kernel without requiring to change kernel source code or load kernel modules. BumbleBee (https://github.com/solo-io/bumblebee) is a new Open Source project which helps to build, run and distribute eBPF programs using OCI images. It allows you to focus on writing eBPF code, while taking care of the user space components - automatically exposing your data as metrics or logs. In this workshop, we're introducing eBPF and the different ways to create eBPF programs. Then, attendees are creating their first eBPF program using BCC and libbpf to have a better understanding of the main concepts. Finally, they are going through several labs to build and deploy an eBPF program with BumbleBee. They also deploy Prometheus and a web application on Kubernetes to display all the communications happening in the Kubernetes cluster.