Modern Kubernetes platforms run hundreds or thousands of workloads, often written in different languages and owned by different teams. Instrumenting these applications reliably and efficiently at scale is still one of the hardest problems for platform and SRE teams. In this talk, we’ll explore how kernel-level instrumentation using eBPF enables high-performance, low-overhead observability for Kubernetes workloads without modifying application code or deploying language-specific agents. Based on real-world experience maintaining the OpenTelemetry eBPF profiler, we’ll explain how this level of performance is achieved in practice: from sampling strategies and kernel execution models, to minimizing overhead when collecting CPU profiles and stack traces across containers and namespaces, including JVM-based services and native workloads. We’ll focus on practical platform concerns such as performance overhead, kernel compatibility, security constraints, and operational trade-offs. The talk will highlight real failures encountered in production Kubernetes clusters, what broke, and how we redesigned the system to make it safe, efficient, and scalable. Attendees will leave with a clear understanding of when kernel-level instrumentation is a good fit for Kubernetes platforms, why it can remain efficient at scale, how it complements existing OpenTelemetry pipelines, and where traditional in-process instrumentation is still required.

Session Speakers

Roger Coll

Elastic, Senior Software Engineer