eCHO news is your bi-weekly wrap up of all things eBPF and Cilium. If you want to keep up on the latest in cloud native networking, observability, and security this is your quelle

25th February 2025

For years, eBPF has letting us rebuild parts of Linux better, giving us deep observability, high performance networking enforcement, continuous profiling, and ways to actually mitigate threats in real-time, without slowing systems down. eBPF for Windows has been in development since 2021, and while it still requires a special dev mode, it’s never been closer to reality than 2025.

If you have been wondering about how it all works, check out my colleague's blog introducing eBPF for Windows to get up and running with you first program. At the end you will be able to "add some simple functionality, like blocking a process based on its PID or executable name. I’ll leave that as an exercise to the interested reader."

It’s not every day that something built for the Linux kernel becomes a standardized instruction set (RFC 9669) and then shows up on Windows in just a few years. But here we are. Here for me currently is Brasil for Carnival and I've got some glitter to put on so so let’s 🐝 -gin.

The Technical

Introduction to eBPF for Windows

Get started on your driver journey, Github repo included

How We Optimized CI/MON eBPF Sensor to Handle Thousands of Events per Second

"7 key lessons we’ve learned building a high-performance, robust eBPF sensor"

Getting to Know TGID and PID in eBPF: Essential for Observability

Do you know the difference between Thread Group ID and the Process ID?

My first Aya program

Deep dive into coding eBPF in Rust

Hello eBPF: Concurrency Testing using Custom Linux Schedulers (19)

"a practical tool for shaking more bugs out of applications"

Can eBPF Provide Real-Time PostgreSQL Insights Without Degrading Performance?

"the eBPF program adds an overhead of approximately 0.03 ms on average"

Exploring the OpenTelemetry Go Automatic Instrumentation powered by eBPF: A Deep Dive

Cool to see different approaches converging under OTel

EBPF program to extract data from HTTPS traffic using MITM proxy and Java

Generate logs without the need to write any separate application code

Debug gtp5g kernel module using stacktrace and eBPF

Stop kernel panics from kernel modules with eBPF

Experimenting with OCaml and eBPF

Learn to trace OCaml programs with eBPF

dkorunic/pktstat-bpf

"TC, XDP and KProbe eBPF based simple Ethernet interface traffic monitor and reporting tool"

nomaderr/ebpf-file-blocker

"Block file creation with use of eBPF"

unikzforce/wormhole

"vxlan/unknown unicast flooding technique + eBPF"

eurecom-s3/lemon

"An eBPF Memory Dump Tool for x64 and ARM64"

🐝

The Ecosystem

Is Your CNI Good Enough?

"Replace your outdated, underperforming, or too complex-to-handle CNI with something modern"

How Tetragon Redefines Security and Observability

Great to see Coralogix picking up Tetragon

Visualize End-to-End Google Cloud Cross-Account Traffic with Upwind

"detailed data from Layers 3, 4, and 7 with a high-performance eBPF sensor"

Coralogix Releases eBPF Observability for K8s Workloads

I'm assuming based on the above

Why AI Observability Needs a New Approach(eBPF)

"With eBPF, AI agents are more secure, compliant, and cost-controlled — without sacrificing performance"

🐝

The How To

Mixed Routing Mode with Isovalent Cluster Mesh

Connect clusters using both native routing and encapsulation

Azure Kubernetes Chronicles Networking using eBPF

Deploy an AKS cluster with Cilium and apply a network policy to secure traffic and part 2

Cilium Network Policy: What You Need to Know for CKS

With a few labs to practice too

Securing Cilium's Gateway Api with cert-manager

Create a reverse proxy secured with an auto-renewing certificate

Renforcer la sécurité des microservices avec l’authentification Cilium et SPIFFE

Mettre en œuvre l’authentification pour des applications dans un cluster AKS

🐝

The Video

How Polar Signals leverages eBPF for efficient profiling and cost optimization | Frederic Branczyk

The benefits of eBPF for cost cutting

🐝

The Events

Cilium and Cisco ACI: Best of Both Worlds

February 25th, online webinar

What's new in eBPF Runtime Security with Tetragon 1.15

March 5th, online webinar 

Fast-Tracking Your Journey to Kubernetes for Network Engineers

March 12th, online panel discussion

Isovalent Discovery Workshop: A Fast-Track to Cilium for Network Engineers

March 20th, online workshop: Get hands-on! 

Isovalent Discovery Workshop: A Fast-Track to Cilium for Platform Engineers

March 25th, online workshop: Get hands-on! 

bpfconf

CfP now open for the invite only event on March 24-26 in Montreal

CiliumCon EU

April 1st in London, this is not a joke! Full Schedule out now

🐝 

The Livestreams

eCHO Episode 170:

Cilium Metrics Review

eCHO Episode 171: Migrating and Managing VMs using eBPF