Designing a Lightweight Network Observability Agent for Cloud Applications

Applications are increasingly being deployed on the cloud as microservices using orchestrators like Kubernetes. With microservices-type deployment, performance and observability are critical requirements, especially given the SLAs and strict business guarantee requirements (latency, throughput, etc.) of requests. Network observability is an imperative feature that every orchestrator needs to incorporate to provide the operators visibility into the network communication between the services deployed and the ability to provide necessary metrics to diagnose problems. In this paper, we propose a lightweight network observability agent netobserv-ebpf-agent built using eBPF, that can be deployed in various environments (K8s, Bare-metal, etc.) and runs independent of the underlying network datapath/ Container Network Interfaces (CNIs) deployed by the orchestrator. netobserv-ebpf-agent monitors the network traffic in each host-nodes’ interfaces running in the cluster and summarizes the necessary information of the traffic workloads with very minimal overhead. We articulate the design decisions of netobserv-ebpf-agent using measurements which maximize the performance of the datapath. Our evaluations show that netobserv-ebpf-agent offers significant performance benefits against the existing systems, while keeping the CPU and memory overheads lower by a magnitude. netobserv-ebpf-agent is available in open source and is officially released as part of Red Hat OpenShift Container Platform. ( https://github.com/netobserv/netobserv-ebpf-agent )