Linux bcc/BPF tcplife: TCP Lifespans (2016)

Not sure why K8s comes into the picture. That is, k8s has no mechanisms pertaining to ebpf or require it. Anything you want to do with ebpf on K8s cluster can be done elsewhere.

Thus the second part's question becomes strange. As anything needs to be done on K8s needing ebpf also requires ebpf outside k8s (there often is replacement, but that does not harm the fact that ebpf can be used in those cases).

inbound/outbound tcp connections over time and discovering extremely high connection churn rates on ephemeral ports are both great reasons i've used it.

eBPF can (basically) monitor anything at a low level! check out ebpf_exporter for some other great examples of real-world use.

eBPF at Fly.io:

* routes all our UDP traffic; from edge box to worker box, UDP packets don't touch userland until they hit a customer VM;

* allows our Anycast proxy to listen on every TCP port, instead of a set of well-known ports; and

* implements our private networking, allowing VMs from the same customer organizations to talk to each other.

What has kubernetes to do with what are essencially kernel plugins?