Technology · Ebook

Inspektor Gadget: eBPF Observability for Kubernetes and Linux

by Shriira Press

Inspektor Gadget is a CNCF sandbox project that makes eBPF approachable for the people who run clusters rather than write kernel code. The kernel sees every file opened, process spawned, and packet sent, but it speaks in mount namespaces and PIDs, not pods and containers. Inspektor Gadget closes that gap: it packages eBPF programs as portable OCI images called gadgets, loads them on demand, and enriches their events with Kubernetes context. This book builds the mental model from the ground up — the observability gap, eBPF and its verifier, what a gadget is, image-based distribution, the per-node DaemonSet architecture, the operator pipeline, daily use with kubectl gadget and ig, authoring your own gadgets, and running it all responsibly in production.

Contents

1. 1Preface
2. 2Chapter 1 — The Observability Gap
3. 3Chapter 2 — eBPF in a Nutshell
4. 4Chapter 3 — What Is a Gadget
5. 5Chapter 4 — Image-Based Gadgets
6. 6Chapter 5 — Architecture and Deployment
7. 7Chapter 6 — Operators and the Data Pipeline
8. 8Chapter 7 — Using Inspektor Gadget
9. 9Chapter 8 — Building Your Own Gadget
10. 10Chapter 9 — Inspektor Gadget in Practice