Slash your cloud network costs with eBPF network monitoring#

Mario Macias, Nikola Grcevski (Grafana Labs)

• Why: Cross-AZ data transfer is a large, recurring, and poorly-attributed line item for anyone running Kubernetes in public cloud. This is a production-tested, OSS-only approach to attributing that cost to pods — squarely in the PM's eBPF/Kubernetes observability space.
• What: A walk-through of how Grafana Labs cut their own cloud network costs using eBPF-based packet-level traffic analysis: identifying which pods and workloads generate elevated cross-AZ traffic, with zero application code changes and low overhead (write-up based on the abstract and program page summary).
• How: eBPF performs packet-level analysis in the kernel; the low-level flow data is enriched with Kubernetes pod and node metadata so cross-AZ traffic can be attributed per workload, regardless of CNI, using only open-source tooling. The talk shows how to rebuild the same monitoring stack yourself.
• Where applicable: Any Kubernetes-on-public-cloud environment where cross-AZ egress/transfer billing applies. The cost-saving framing is multi-AZ-cloud specific, but the eBPF-plus-pod-metadata attribution technique transfers to on-prem K8s traffic visibility generally. Rooted in Grafana's own production experience but the method is broadly adoptable.