Using eBPF in Kubernetes: A security overview

What is eBPF Kubernetes?

eBPF is a powerful Linux kernel feature that allows you to run small, sandboxed programs directly within the kernel space. Developers can use eBPF to extend kernel functionality without modifying the kernel itself. In Kubernetes, eBPF enables teams to observe kernel-level activity across containers and nodes, providing deep visibility into how workloads interact with the underlying system.

Because eBPF operates at the kernel level, it observes and manipulates system behavior with minimal performance overhead. By hooking into various tracepoints, functions, and OS events, eBPF provides observability into network activities, system calls, and other critical operations.

This visibility matters for Kubernetes. Since pods and containers are ephemeral and change rapidly, traditional monitoring tools can miss key activities, such as rapid CPU spikes due to noisy neighbors, privileged pod escapes, or CNI misconfigurations that disrupt network traffic between pods. To resolve these issues, eBPF directly instruments the kernel layer, providing real-time insight into cloud workloads without requiring a sidecar for every pod. This kernel observability helps developers maintain and close visibility loops, ensuring your business remains operational 24/7.

🚨Kubernetes Security Research Report 2025

New insights from 200,000+ cloud accounts uncovers the latest risks, attack trends, and security gaps in Kubernetes environments.

Download PDF

Why is eBPF use rising in Kubernetes operations?

eBPF adoption is increasing rapidly within the Kubernetes ecosystem due to its ability to provide deep, low-overhead visibility into system and network-level activities. As Kubernetes evolves, the role of eBPF in enhancing the resilience and reliability of cloud-native operations will only grow. 

Here's a closer look at the factors fueling eBPF's growth in Kubernetes workloads:

The limitations of traditional monitoring tools

Traditional monitoring tools struggle to manage complex systems like Kubernetes. For instance, older tools like ptrace or similar kernel modules offer limited real-time visibility that can’t keep pace with the rapid changes in containerized environments. This often leads to blind spots in monitoring and security.

Since traditional monitoring tools often run in userspace, they lack deep visibility into the kernel's internal operations. This gap hinders observability, making it difficult to detect and diagnose critical issues, like resource contention and security threats.

The resource overhead of traditional monitoring also brings challenges, especially in dynamic environments like Kubernetes. Because polling-based systems consume valuable CPU and memory, they can degrade performance. This becomes a serious concern in Kubernetes clusters, where efficient resource utilization is crucial, and inefficient monitoring quickly becomes costly and wasteful.

Kubernetes Security Best Practices [Cheat Sheet]

This 6 page cheat sheet goes beyond the basics and covers security best practices for Kubernetes pods, components, and network security.

Download cheat sheet

eBPF's deep visibility into Kubernetes

eBPF provides effective Kubernetes observability by enabling teams to attach eBPF programs to application tracepoints, functions, and network paths, capturing real-time kernel signals. This practice allows for precise monitoring of all network packets, syscalls, and process behavior from the host down to individual containers.

By monitoring network packets at the kernel level, eBPF tools provide a granular view of network traffic within Kubernetes. This kernel-level access allows teams to identify performance bottlenecks, troubleshoot network issues, and ensure compliance with security policies. Teams can also use eBPF programs to trace and analyze system calls, as well as to test application behavior to identify potential attack paths.

Leveraging eBPF, teams can easily enforce security policies, detect anomalous behavior, and prevent potential breaches by sandboxing suspicious code paths. For instance, eBPF can detect non-standard socket inputs, which indicate a possible remote code execution attack, or track attempts to access restricted files, like /etc/shadow. This helps teams identify data breaches and system compromises.

Here’s a quick summary of eBPF’s benefits:

What are the top use cases for eBPF in Kubernetes?

eBPF excels across many core areas of your cloud-native stack. Here are the top use cases where teams can benefit the most from eBPF's integration with Kubernetes:

Observability and performance monitoring

eBPF provides high-quality telemetry data without requiring changes to application code. Because of this, you can use eBPF-based tools to capture packet flows, system calls, and kernel events in real-time. This telemetry-driven approach accelerates troubleshooting and reveals the underlying issues in your Kubernetes environments.

eBPF also helps with Kubernetes observability by providing the following monitoring capabilities:

• Real-time tracing and profiling: Trace requests and CPU usage patterns without manual code instrumentation.

• Network traffic visualization: Map and analyze traffic flows across pods, nodes, and network interfaces.

• Container and pod statistics: Measure pod-level syscalls, latencies, and resource spikes for deep visibility and richer telemetry.

High-performance networking

eBPF moves networking logic into the kernel. This approach lowers latency and increases throughput for demanding services. You can use eBPF to implement load balancing, policy enforcement, and traffic steering directly at the kernel level, eliminating the need for sidecars or heavy polling agents.

Here's a breakdown of how eBPF enables high-performance networking in Kubernetes:

• Service load balancing: Handle load balancing directly in the kernel to reduce hops, cut latency, and increase throughput.

• Efficient network policies: Apply packet-level filters in the kernel to instantly allow or block traffic.

• Traffic management: Steer, rate-limit, or mirror traffic flows at the NIC or kernel layer to enforce quality and reduce tail latency.

Security and runtime enforcement

eBPF offers runtime signals for spotting attacks and policy violations. Because it runs close to the kernel, it catches attacker behavior that userspace tools frequently miss. 

You can use eBPF in the following scenarios to detect Kubernetes security threats:

• Runtime security monitoring: Gain continuous kernel-level observability for live detection.

• Intrusion detection: Identify suspicious network requests, system calls, or activity patterns.

• System call filtering: Augment existing security controls, such as seccomp, by providing deeper visibility and flexible, programmable filtering of system calls.

Service mesh

eBPF enables you to implement service meshes without deploying sidecars, eliminating the complexity and resource overhead of sidecar-based meshes.

Instead of a separate proxy for each pod, you can attach eBPF probes to the necessary kernel hooks and operate meshes transparently across all pods on a node. Platforms like Cilium and Istio also provide eBPF-based service meshes, which makes this process even easier.

What are the best practices for integrating eBPF in Kubernetes?

As Kubernetes grows in complexity, observability and security approaches must adapt to keep pace. Traditional tools struggle with ephemeral containers, highly distributed services, and multi-cloud deployments. That's where eBPF shines—it lives in the kernel and scales with your infrastructure.

Here are some best practices for integrating eBPF with Kubernetes:

1. Ensure kernel compatibility

Before deploying eBPF programs, you must verify that your Linux kernel version supports eBPF. 

Not all kernel versions have the same level of eBPF support, meaning that some features may only be available in newer kernels. To ensure compatibility, you may need to load specific kernel modules or update to a more recent Linux kernel version.

🛠️ Action steps:

• Check the current kernel version.

• Verify eBPF feature support using bpftool.

• Update the kernel if necessary to ensure compatibility.

Here’s how to check your kernel version and eBPF support in your terminal:

# Check kernel version
uname -r

# Verify eBPF support
sudo apt-get install bpftool
sudo bpftool feature

2. Leverage existing tools and frameworks

To start tracing and monitoring Kubernetes with eBPF, it’s best to begin with well-established tools and frameworks. Options like the BPF Compiler Collection (BCC) and bpftrace simplify this process by providing a high-level interface for writing eBPF programs, which eliminates the need for a deep dive into kernel internals.

🛠️ Action steps:

• Install BCC and bpftrace on your Kubernetes nodes.

• Use bpftrace to write and execute tracing scripts.

• Implement BCC tools to gather performance metrics.

Here’s an example of how to trace system calls with bpftrace:

sudo bpftrace -e 'tracepoint:syscalls:sys_enter_open { printf("filename: %s\n", str(args->filename)); }'

And this is how you can use BCC to monitor network packets in Python:

from bcc import BPF

# Load BPF program
b = BPF(text="""
int kprobe__tcp_sendmsg(struct pt_regs *ctx) {
    bpf_trace_printk("tcp_sendmsg called\\n");
    return 0;
}
""")

# Print output
b.trace_print()

Accademia Wiz

Kubernetes Monitoring Tools and Best Practices to Know

Leggi di più

3. Use eBPF for targeted observability

Attaching eBPF programs to kernel tracepoints, kprobes, or uprobes events lets you collect data on system calls, network packets, or function calls in userspace applications. This provides deep insights with minimal overhead.

🛠️ Action steps:

• Identify critical performance metrics, such as CPU usage, memory, network latency, and I/O operations.

• Use BCC or bpftrace to capture these metrics or develop custom eBPF programs.

• Visualize and analyze data using Grafana and Prometheus, and set up dashboards and alerts for real-time monitoring and analysis.

This code shows how to trace network packets with eBPF in Python:

from bcc import BPF

# Load BPF program to trace network packets
b = BPF(text="""
#include <uapi/linux/ptrace.h>
#include <linux/skbuff.h>
#include <net/sock.h>
#include <bcc/proto.h>

int trace_net_packets(struct pt_regs *ctx, struct sk_buff *skb) {
    u32 len = skb->len;
    bpf_trace_printk("Packet length: %d\\n", len);
    return 0;
}
""")

# Attach to function
b.attach_kprobe(event="netif_receive_skb", fn_name="trace_net_packets")

# Print output
b.trace_print()

4. Integrate eBPF with existing security policies

Integrating eBPF with your existing Kubernetes security policies strengthens runtime protection. By tying eBPF programs to security policies, such as network access controls or system call monitoring, you can detect anomalies in real-time and isolate suspicious behavior before it escalates.

🛠️ Action steps:

• Define security policies, such as network access controls, syscall monitoring, and suspicious activity detection.

• Develop eBPF programs that monitor and enforce these security policies.

• Deploy these eBPF programs using Kubernetes DaemonSets and manage them via ConfigMaps or secrets.

• Continuously monitor the effectiveness of eBPF programs, and update and refine them as necessary to address emerging threats.

Here’s an example of enforcing network policies with eBPF in Python:

from bcc import BPF

# Load BPF program to enforce network policies
b = BPF(text="""
#include <uapi/linux/ptrace.h>
#include <net/sock.h>
#include <bcc/proto.h>

int enforce_network_policy(struct pt_regs *ctx, struct sock *sk) {
    u16 dport = sk->__sk_common.skc_dport;
    
    // Example: Block port 80
    if (dport == ntohs(80)) {
        bpf_trace_printk("Blocked connection to port 80\\n");
        return -1; // Block the connection
    }
    return 0; // Allow the connection
}
""")

# Attach to function
b.attach_kprobe(event="tcp_v4_connect", fn_name="enforce_network_policy")

# Print output
b.trace_print()

Accademia Wiz

CI/CD Pipeline Security Best Practices 2025

Leggi di più

What are some popular eBPF tools?

Here's a list of widely used eBPF tools your team can leverage for eBPF-based Kubernetes observability:

Cilium

Cilium is an eBPF-powered container network interface that brings fast, identity-aware networking to Kubernetes. It can replace kube-proxy for efficient service routing and can enforce Layer 3 to Layer 7 (L3–L7) network policies using pod labels. Cilium also includes Hubble for built-in network observability and supports sidecar-free service mesh features.

However, this powerful observability solution has a steep learning curve. Cilium also requires modern Linux kernels (like v4.19+ or v5.8+), making it unsuitable for Windows production environments.

Grafana Beyla

Grafana Beyla is an eBPF-based auto-instrumentation tool that can capture app-level metrics and traces without requiring code changes. It also integrates directly with OpenTelemetry, making it easy to export observability data into monitoring tools like Prometheus.

While it's an ideal choice for quickly getting started with eBPF, Beyla can’t provide deeper, business-specific visibility without some manual instrumentation. 

bpfman

Bpfman is a valuable tool for managing eBPF programs on Linux and Kubernetes. Instead of running eBPF programs as privileged pods, bpfman loads them through a bpfman daemon, centralizing control and enforcing least privilege access. It also enables the safe coexistence of multiple eBPF programs on the same node, which is ideal for teams managing complex Kubernetes environments.

However, bpfman doesn't offer direct networking, security, or observability features. You'll still need to define eBPF programs and manage them via Kubernetes CRDs, which carry their own learning curve.

Calico

Calico is a networking solution that supports multiple data planes, including eBPF, iptables, Windows HNS, and VPP. Its eBPF mode can replace kube-proxy for faster packet handling while allowing fallback to traditional methods for compatibility. Additionally, Calico's mature Layer 3/Layer 4 (L3/L4) policy model is well-tested in production.

However, its eBPF capabilities aren't as deeply integrated as tools like Cilium, which is purpose-built for eBPF. Calico relies on external tools for observability, and its application-layer policies are limited in scope. Because it supports several data planes, it isn't as tightly optimized for eBPF as the other observability tools.

Wiz: A comprehensive Kubernetes security solution

eBPF offers monitoring teams deep visibility and fine-grained control at the kernel level. By doing so, it helps secure workloads, detect threats, and monitor real-time user behavior without slowing down performance.

But tapping into that power isn't always easy. For instance, writing custom eBPF programs or combining multiple open-source tools to achieve effective Kubernetes visibility requires time and expertise. 

That's where Wiz comes in. Our platform delivers deep runtime visibility and security through agentless scanning and eBPF-powered detection. It also leverages eBPF to validate vulnerabilities in real time and surface actionable signals across your containers and hosts. This defense-in-depth approach provides both prevention and detection without adding operational overhead.

Wiz also offers these key features:

• Comprehensive visibility: Obtain detailed insights into all container and network activities.

• Regulatory compliance: Meet industry standards and regulatory requirements effortlessly.

• Kubernetes security posture management: Perform agentless scans to uncover misconfigurations, faulty secrets, vulnerabilities, and more.

• Continuous monitoring: Use real-time signals and event correlations from containers, hosts, control planes, and the cloud to understand and reduce attack surfaces.

• Proactive detection and response: Detect and address potential security threats efficiently.

Want to check how secure your Kubernetes environment really is? Start with a free Kubernetes security assessment for practical insights into misconfigurations, vulnerabilities, and risk areas across your clusters.

Or, if you want more actionable security best practices you can apply immediately, download our Kubernetes Security Best Practices Cheat Sheet for proven tips on hardening your workloads.

FAQ