eBPF is often introduced through small demos: attach a program, observe a syscall, inspect a packet, and suddenly the Linux kernel feels much less mysterious.

But what happens when that same idea has to operate across a real Kubernetes environment with dozens of nodes, hundreds of workloads, and a continuously growing stream of telemetry?

In this session, we will start from the fundamentals of eBPF and build the mental model from the ground up. We will look at where eBPF programs run, how they attach to kernel and userspace events, how maps and ring buffers move data back to userspace, and how these primitives make zero-code observability possible.

Then we will move from theory to a live engineering demo.

We will start with an uninstrumented application and use OpenTelemetry eBPF Instrumentation (OBI) to automatically generate telemetry without adding an OpenTelemetry SDK to the application.

From there, we will scale the same architecture to a Kubernetes cluster with approximately 50 Linux worker nodes and explore the engineering problems that appear at scale: per-node eBPF agents, Kubernetes metadata discovery, API server pressure, telemetry volume, OpenTelemetry Collector scaling, load balancing, and stateful processing such as tail sampling.

The goal of the session is not just to show that eBPF works, but to understand what changes when eBPF-based observability moves from a laptop demo to a distributed cloud-native system.

Expect Linux internals, Kubernetes, OpenTelemetry, eBPF, live debugging, and a real scaling story.