eBPF Agent

The eBPF agent is optional. It runs as a DaemonSet on every node, measures traffic between workloads and to external destinations, and sends it to the Kubeadapt agent in the same cluster. Kubeadapt uses it to show cross-zone and internet egress traffic and its cost.

What it records

• Per-flow connection metadata: source and destination address and port, protocol, and byte counts.
• DNS query names.
• The TLS server name (SNI).
• HTTP method, route and status code, read from request and response headers.

It does not record request or response bodies.

Enable it

The eBPF agent is disabled by default. Enable it through the parent kubeadapt chart:

kubeadapt-k8s-pulse:
  enabled: true

Or at install time:

helm install kubeadapt kubeadapt/kubeadapt \
  --namespace kubeadapt --create-namespace \
  --set agent.config.token="<your-token>" \
  --set kubeadapt-k8s-pulse.enabled=true

Prerequisites

• Linux nodes only, kernel 5.10 or later.
• Privileged pod. The published chart runs the DaemonSet with privileged: true, hostNetwork: true and hostPID: true. The container runs as root with a read-only root filesystem.
• Not supported on GKE Autopilot, which rejects privileged, hostNetwork and hostPID pods.

Check your kernel version

kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.status.nodeInfo.kernelVersion}{"\n"}{end}'

Every node must run kernel 5.10 or later. On older kernels the BPF programs fail to load.

Resources

Chart defaults:

1kubeadapt-k8s-pulse:
2  resources:
3    requests:
4      cpu: 100m
5      memory: 256Mi
6    limits:
7      cpu: 500m
8      memory: 384Mi

Measured memory is about 130–155 MiB per node. If you see OOMKilled pods, raise the memory limit.

Scheduling

Set these under the kubeadapt-k8s-pulse key:

Full values reference

For every other setting, see the eBPF agent chart's values.yaml.