Skip to content

Inspecting your Kubernetes cluster with eBPF and Inspektor Gadget#

CfgMgmtCamp Ghent 2026 digest Program Core pick 2–4 February 2026

Abstract

Soham Chakraborty, SRE at Sematext

  • Why: eBPF-based in-cluster observability sits squarely in your cloud-native networking space: seeing TCP connections per pod, DNS requests, and syscall-level behavior in real time is the debugging layer under Cilium-style networking. Inspektor Gadget is the CNCF toolkit that makes eBPF debugging approachable without writing your own programs.
  • What: A practical walkthrough of using Inspektor Gadget's gadget suite for real-time, in-cluster debugging — TCP connections by pod, DNS requests, syscalls, and traceloop, a syscall flight recorder for post-incident root-cause analysis (from abstract only).
  • How: Inspektor Gadget dynamically instruments the Linux kernel with eBPF — no agent installation required — and the talk covers capturing gadget output in a parseable format for later analysis rather than staring at raw bpftrace-style output.
  • Where applicable: General technique for any Kubernetes environment on modern kernels; the speaker is a Sematext SRE, so expect an practitioner's framing rather than a project-maintainer internals talk, and the eBPF intro portion will be 101 if you already live in this space. The flight-recorder (traceloop) pattern for intermittent network issues is the transferable idea.