Scheduling eBPF on K8S doesn’t have to be difficult There’s kubectl-trace to help you! 
 Watch here! 📹 Leonardo Di Donato gh:leodido @leodido

Tracers Leonardo Di Donato gh:leodido @leodido 1. bpftrace 2. bcc 3. rbspy 4. more to come…

Leonardo Di Donato gh:leodido @leodido

Leonardo Di Donato gh:leodido @leodido Demos Run a bpftrace program that instruments the caturday binary with an uretprobe on the counterValue function: 
 kubectl trace run \ - e 'uretprobe:/proc/$container_pid/exe:"main.counterValue" { printf("%d\n", retval) }' \ - a -- fetch - headers \ - n caturday pod/caturday-54998fcb5-fsbxk 
 Visit the caturday page and check the bpftrace program outputs the same counter value like it does: 
 curl - v 206.189.248.54 : 8080/raw

Leonardo Di Donato gh:leodido @leodido Demos Run a bpftrace program to trace all the exec() family syscalls happening on a Kubernetes node: 
 kubectl trace run - a \ - e "tracepoint:syscalls:sys_enter_exec * { printf(\"%-10u %-5d \", elapsed / 1e6, pid); join(args -> argv); }" \ node/pool - dido22h-8hom3 - - fetch - headers 
 Observe the output arguments… 


Leonardo Di Donato gh:leodido @leodido Homeworks Do the same as before but with BCC tools. Have fun! 
 
 kubectl trace —tracer=bcc … 


Thank you! Leonardo Di Donato gh:leodido @leodido github.com/iovisor/kubectl-trace #kubectl-trace (k8s slack) 👋