eBPF vs Sidecar

Last Updated: 2023-02-16

eBPF: extended Berkeley Packet Filter.

eBPF makes the kernel programmable. Write programs in kernel triggered by events. Similar to JS that allows us to dynamically change the behavior of a web page.

  • a sidecar has a view across just one pod (per pod), part of the app configuration (my-app.yaml).
  • eBPF does not need any app config change (they live in the kernel).
  • eBPF is triggered by events, regardless of whether the pod is running or not.
  • eBPF can see ALL activities on the node (all pods on this node).
  • sidecar: does not need access to the node.
  • eBPF is kernel programming. Sidecars are easier to develop.

eBPF observability tool: Pixie, Cilium Hubble.

Cilium uses eBPF to provide efficient networking. connectivity; sidecarless service mesh (Istio ambient mesh, also sidecarless).