eBPF vs Sidecar
eBPF: extended Berkeley Packet Filter.
eBPF makes the kernel programmable. Write programs in kernel triggered by events. Similar to JS that allows us to dynamically change the behavior of a web page.
- a sidecar has a view across just one pod (per pod), part of the app configuration (my-app.yaml).
- eBPF does not need any app config change (they live in the kernel).
- eBPF is triggered by events, regardless of whether the pod is running or not.
- eBPF can see ALL activities on the node (all pods on this node).
- sidecar: does not need access to the node.
- eBPF is kernel programming. Sidecars are easier to develop.
eBPF observability tool: Pixie, Cilium Hubble.
Cilium uses eBPF to provide efficient networking. connectivity; sidecarless service mesh (Istio ambient mesh, also sidecarless).