Configuration

eBPF Agent

Configuration reference for the Kubeadapt eBPF agent. Captures pod-to-pod network traffic for cross-AZ and egress cost visibility.

The eBPF agent runs as a DaemonSet on every node. It captures pod-to-pod network traffic and provides visibility into cross-AZ and egress data transfer.

Enable It

The eBPF agent is disabled by default. Enable it through the parent kubeadapt chart:

yaml

ebpf-agent:
  enabled: true

Or at install time:

bash

helm install kubeadapt kubeadapt/kubeadapt \
  --namespace kubeadapt \
  --create-namespace \
  --set agent.config.token="<your-token>" \
  --set ebpf-agent.enabled=true

Prerequisites

Linux nodes only with kernel 5.8 or later
Privileged container access (the DaemonSet runs as privileged)
hostNetwork: true and hostPID: true must be allowed by your pod security policy or admission controller

Check Your Kernel Version

bash

kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.status.nodeInfo.kernelVersion}{"\n"}{end}'

All nodes must be running kernel 5.8+. Older kernels will fail to load the BPF programs.

Resources

yaml

1ebpf-agent:
2  resources:
3    requests:
4      cpu: 100m
5      memory: 128Mi
6    limits:
7      cpu: 500m
8      memory: 384Mi

If you see OOMKilled pods, increase the memory limit.

Scheduling

Value	Type	Default	Description
`tolerations`	list	`[]`	Pod tolerations.
`nodeSelector`	object	`{}`	Node selector constraints.
`affinity`	object	`{}`	Pod affinity rules.
`topologySpreadConstraints`	list	`[]`	Topology spread constraints.

Full Values Reference

The sections above cover what you need for enabling and scheduling the eBPF agent. For other configurations, see the full values.yaml.

Enable It

The eBPF agent is disabled by default. Enable it through the parent kubeadapt chart:

yaml

ebpf-agent:
  enabled: true

Or at install time:

bash

helm install kubeadapt kubeadapt/kubeadapt \
  --namespace kubeadapt \
  --create-namespace \
  --set agent.config.token="<your-token>" \
  --set ebpf-agent.enabled=true

Prerequisites

Linux nodes only with kernel 5.8 or later

Privileged container access (the DaemonSet runs as privileged)

hostNetwork: true and hostPID: true must be allowed by your pod security policy or admission controller

Check Your Kernel Version

bash

kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.status.nodeInfo.kernelVersion}{"\n"}{end}'

All nodes must be running kernel 5.8+. Older kernels will fail to load the BPF programs.

Value

Type

Default

Description

tolerations

list

[]

Pod tolerations.

nodeSelector

object

{}

Node selector constraints.

affinity

object

{}

Pod affinity rules.

topologySpreadConstraints

list

[]

Topology spread constraints.