eBPF vs Sidecar

eBPF: extended Berkeley Packet Filter.

eBPF makes the kernel programmable. Write programs in kernel triggered by events. Similar to JS that allows us to dynamically change the behavior of a web page.

• a sidecar has a view across just one pod (per pod), part of the app configuration (my-app.yaml).
• eBPF does not need any app config change (they live in the kernel).
• eBPF is triggered by events, regardless of whether the pod is running or not.
• eBPF can see ALL activities on the node (all pods on this node).
• sidecar: does not need access to the node.
• eBPF is kernel programming. Sidecars are easier to develop.

eBPF observability tool: Pixie, Cilium Hubble.

Cilium uses eBPF to provide efficient networking. connectivity; sidecarless service mesh (Istio ambient mesh, also sidecarless).