# eBPF Published articles for eBPF. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Cilium 1.20: Gateway API ExternalAuth, TCPRoute/UDPRoute, ENI IPAM for IPv6, and more DevFeed: [Cilium 1.20: Gateway API ExternalAuth, TCPRoute/UDPRoute, ENI IPAM for IPv6, and more]() Original publisher: [Read original article]() Author: Nico Vibert and Donia Chaiehloudj, Cilium Published: 2026-09-14T10:45:49Z Content type: article Language: en Sources: [Cloud Native Computing Foundation]() Topics: [Cilium](), [Open Source](), [API](), [networking](), [Kubernetes](), [Amazon Web Services](), [eBPF](), [VPC](), [nginx]() Tags: [2026](), [api](), [authentication](), [authorization](), [aws](), [blog](), [cilium](), [cloud](), [cni](), [ebpf](), [google](), [ingress-nginx](), [ipv4](), [ipv6](), [kubernetes](), [microsoft](), [network](), [networking](), [nginx](), [open-source](), [release]() ### AI overview Cilium 1.20 expands Gateway API support with ExternalAuth, CORS filters, ListenerSets, TCPRoute, and UDPRoute. The release also introduces extensible datapath plugins, advances networking standardization with Kubernetes, and adds beta IPv6 support for AWS ENI IPAM. ### Source excerpt Cilium 1.20, the second major open source Cilium release of 2026 after Cilium 1.19, is finally here. Three themes stand out in this release: Thank you to every contributor, reviewer and maintainer who made Cilium 1.20... ## How AWS Lambda logs every flow across thousands of microVMs per host with eBPF and Rust DevFeed: [How AWS Lambda logs every flow across thousands of microVMs per host with eBPF and Rust]() Original publisher: [Read original article]() Author: Prashant Kumar Singh Published: 2026-09-11T12:00:00Z Content type: article Language: en Sources: [The New Stack]() Topics: [AWS Lambda](), [Architecture & Design](), [SIEM, Security, Observability](), [telemetry](), [Amazon EC2](), [Amazon S3](), [VPC]() Tags: [architecture](), [aws](), [aws-lambda](), [aws-marketplace](), [compliance](), [ebpf](), [firecracker](), [incident](), [incident-response](), [logs](), [monitoring](), [observability](), [post-contributed](), [rust](), [s3](), [scale](), [security](), [server](), [serverless](), [sponsor-aws-marketplace](), [sponsored-post-contributed](), [vpc]() ### AI overview AWS Lambda describes replacing an aging network-capture system with an eBPF and Rust pipeline that records network flows across short-lived, tenant-isolated microVMs. The system prioritizes complete, correctly attributed records with minimal overhead for security investigation, metering, audit, observability, and monitoring. ### Source excerpt On any compute platform, when a security alert fires, the question is always the same. Which workload talked to that The post How AWS Lambda logs every flow across thousands of microVMs per host with eBPF and Rust appeared first on The New Stack. ## Profiling a Yandex Food PHP monolith to identify CPU usage and reduce allocated cores DevFeed: [Profiling a Yandex Food PHP monolith to identify CPU usage and reduce allocated cores]() Original publisher: [Read original article]() Author: m03r (Яндекс) Published: 2026-09-08T07:31:51Z Content type: article Language: ru Sources: [Яндекс - Как мы делаем Яндекс / Статьи]() Topics: [PHP](), [cpu](), [eBPF](), [Linux]() Tags: [cpu](), [ebpf](), [haproxy](), [linux](), [perforator](), [php](), [postgresql]() ### AI overview A backend developer describes investigating unexpectedly high CPU usage in a legacy PHP monolith at Yandex Food. By profiling the application with Perforator and its PHP support, the investigation examined why CPU consumption was unusually high and how the allocated capacity could be reduced. ### Source excerpt Всем привет, меня зовут Миша, и я бэкенд-разработчик в платформе Яндекс Еды. Я уже рассказывал, как мы анализировали наш PHP-монолит и вынесли из него процессинг заказов, и с тех пор роль этого легаси заметно уменьшилась. Заодно туда стали писать гораздо меньше нового кода, релизы стали реже, и он спокойненько себе работал, не привлекая лишнего внимания. Так оно бы и продолжалось, но тут случилась повышенная нагрузка и необходимость зарезервировать побольше мощностей для беспроблемной обработки повышенного спроса. Монолит справился на отлично, но самое интересное случилось потом: возвращая выделение ресурсов к прежним значениям, я случайно обратил внимание, что RPS в пиковые вечерние часы как-то подозрительно совпадает с количеством ядер CPU, выделенных на весь монолит. Количество выделенных ядер, конечно, ещё ничего не означает, поэтому я полез смотреть реальное потребление процессорного времени, сложив CPU usage по всем подам. С помощью нехитрой арифметики я обнаружил, что 100% загрузки одного ядра приходятся на 2,5 RPS. Какое-то время я находился в состоянии глубокого изумления, после чего решил, что это никуда не годится, и отправился в увлекательное приключение на 20 минут. Немного спойлеров: дело оказалось далеко не только в PHP. Читать далее ## Beeline: Enforcing application-layer policies in eBPF DevFeed: [Beeline: Enforcing application-layer policies in eBPF]() Original publisher: [Read original article]() Author: Brandner Laurin Published: 2026-09-01T23:30:00Z Content type: article Language: en Sources: [APNIC Blog]() Topics: [eBPF](), [Cloud Native Ecosystem](), [Latency](), [networking]() Tags: [applications](), [cilium](), [ebpf](), [guest-post](), [http](), [latency](), [networking](), [tech-matters]() ### AI overview The article presents Beeline, a system that enforces application-layer (L7) policies directly in the kernel using eBPF. It explains the latency overhead of user-space service proxies and reports that Beeline improves request latency by 46%, while eliminating the service proxy from the critical path for 89% of L7 policies in the wild. ### Source excerpt Guest Post: While many L7 protocols are complex to parse, the logic needed to enforce L7 policies tends to be simple. For the vast majority (89%) of L7 policies in the wild, Beeline can eliminate the service proxy from the critical path. ## We invited a direct competitor into Security Hub Extended. Here's why. DevFeed: [We invited a direct competitor into Security Hub Extended. Here's why.]() Original publisher: [Read original article]() Author: Michael Fuller Published: 2026-08-31T19:00:07Z Content type: opinion Language: en Sources: [AWS Security Blog]() Topics: [AWS Security Hub](), [Security & compliance, Cloud security](), [workload protection](), [vulnerability scanning](), [eBPF](), [Linux Kernel]() Tags: [announcements](), [aws-security-hub](), [cloud-security](), [container](), [ebpf](), [foundational-100](), [linux-kernel](), [security](), [security-blog](), [security-identity-compliance](), [vulnerability-scanning](), [workload-protection]() ### AI overview AWS explains why it invited Upwind, a cloud security competitor, into Security Hub Extended. The post says the partnership responds to customer demand, expands choice between posture management and runtime-first protection, and simplifies integration through AWS billing, support, and operations. ### Source excerpt When customers keep pointing you to a solution that overlaps with parts of your own offering, you have a choice to make. This post is about the choice we made with Upwind, and why we'd make it again. AWS Security Hub Extended exists because customers told us what was working for them in enterprise security [...] ## Fast and Hard Code DevFeed: [Fast and Hard Code]() Original publisher: [Read original article]() Author: Armin Ronacher Published: 2026-08-22T00:00:00Z Content type: opinion Language: en Sources: [Armin Ronacher]() Topics: [Rust](), [LLMs](), [Zig](), [Artificial Intelligence](), [Programming](), [WebAssembly](), [Cloudflare](), [Vercel](), [eBPF]() Tags: [ai](), [cloudflare](), [ebpf](), [llms](), [performant](), [programming](), [rust](), [thoughts](), [vercel](), [webassembly](), [zig]() ### AI overview An opinion article argues that LLM-assisted programming makes language choice less consequential, allowing developers to use unfamiliar or traditionally difficult languages. It focuses on growing interest in fast, small software built with Rust and Zig, while noting examples involving WebAssembly, Cloudflare, Vercel, and other demanding technologies. ### Source excerpt One of the memes on Twitter is that "programming is solved now." I'm not sure to what degree it is, but one thing is pretty clear: the act of familiarizing yourself with a language no longer matters and some of the friction that mattered for humans does not matter for agents. As a result, LLMs make language choice much less consequential than it used to be. If you don't like the choice, you can seemingly rewrite it in another language and you can make it pick a language that you, as a programmer, are entirely unfamiliar with. Which in turn means that people can, and do, choose based on the marketing of languages much more. As a long-term Rust programmer I found it quite fascinating to see people now ship Rust code who previously might not have chosen it. I attribute at least one part of this to two recent vibe shifts: there is a lot more talk about wanting fast software, and about LLMs being exceptional at optimizing code without regressing behavior. Folks like Mitchell Hashimoto, Charlie Marsh, Jarred Sumner, Daniel Lemire and quite a few others always carried a certain level of obsession with fast and performant software and they also all happen to be receptive to agents writing code. Maybe as a result, or unrelated others are now joining in. That's because with things like autoresearch you don't even necessarily need to know all the tricks: you just need to put an agent on it -- though knowledge greatly helps! If you look around, there are plenty of projects that want to be fast and small, and they increasingly pick "hard languages". And it's not just Rust that is benefiting. Even Zig -- despite the fact that the creators and parts of the core community are pretty negative on the whole AI thing -- is too. For instance Cloudflare's new Artifacts service uses a pure-Zig Git-protocol engine, compiled to a roughly 100 KB WebAssembly module and Vercel released fx, a Zig coding agent advertised to be small and fast. From what I can tell, all these projects are largely LLM ## Introducing Nirmata Runtime for Kyverno: Kernel-Level Enforcement for AI Workloads DevFeed: [Introducing Nirmata Runtime for Kyverno: Kernel-Level Enforcement for AI Workloads]() Original publisher: [Read original article]() Author: Jim Bugwadia Published: 2026-08-17T01:27:43Z Content type: release Language: en Sources: [Nirmata]() Topics: [Kyverno](), [Security](), [eBPF](), [configuration](), [Kubernetes]() Tags: [agent](), [ai](), [ai-agents](), [ai-governance](), [configuration](), [ebpf](), [kubernetes](), [kyverno](), [policy](), [product](), [security]() ### AI overview Nirmata introduces Nirmata Runtime for Kyverno, which extends workload controls beyond admission-time configuration checks by enforcing selected runtime behaviors in the kernel. The article describes BPF-LSM and cgroup-scoped eBPF enforcement for process execution, file access, network egress, and application protocols, plus DNS observation and reporting. ### Source excerpt Nirmata created Kyverno and donated it to the CNCF in 2020. Kyverno is now a graduated CNCF project and is widely used for enforcing and automating configuration security and best practices. However, admission control answers one question: does this spec look right? It cannot... The post Introducing Nirmata Runtime for Kyverno: Kernel-Level Enforcement for AI Workloads first appeared on Nirmata. ## 【Istio 控制面】选型收束与开放问题：CRD、Gateway API 与 eBPF L4 的排除树 DevFeed: [【Istio 控制面】选型收束与开放问题：CRD、Gateway API 与 eBPF L4 的排除树]() Original publisher: [Read original article]() Author: Liao Tonglang Published: 2026-08-11T00:00:00Z Content type: article Language: zh Sources: [土法炼钢 - 系统与基础设施]() Topics: [istio](), [gateway](), [eBPF]() Tags: [ambient](), [cilium](), [ebpf](), [experimental](), [gamma](), [gateway](), [gateway-api](), [istio](), [kubernetes](), [mesh](), [network](), [open-problems](), [selection](), [xds]() ### AI overview The concluding article in an Istio control-plane series presents a mechanism-based decision tree for choosing among Istio CRDs, Gateway API/GAMMA, and eBPF L4 networking. It explains that Istio CRDs and Gateway API are alternative configuration inputs compiled by istiod into xDS resources, while eBPF L4 avoids xDS entirely. It also identifies open questions around configuration-activation SLOs, Ambient maturity, and coexistence between configuration models. ### Source excerpt 用机制排除树收束 Istio CRD 翻译、Gateway API/GAMMA 与 eBPF L4 的选型边界，回收系列阅读路径，并列出推送 SLO、Ambient 成熟度、GAMMA 双轨等开放问题；不做延迟排行榜。 ## Detection primitives for eBPF rootkits DevFeed: [Detection primitives for eBPF rootkits]() Original publisher: [Read original article]() Author: Lorenzo Susini, Matt Muir Published: 2026-07-27T00:00:00Z Content type: article Language: en Sources: [Datadog Security Labs]() Topics: [eBPF](), [Malware](), [Linux](), [tracing](), [Network](), [Protocol (disambiguation)](), [debug](), [Processes]() Tags: [debug](), [ebpf](), [kernel](), [linux](), [malware](), [payload](), [processes](), [tracing]() ### AI overview The article analyzes how Linux malware families use eBPF rootkits and helpers to evade defenses, focusing on detection primitives and VoidLink's method for hiding active connections. It explains how VoidLink manipulates user-space memory and processes socket statistics obtained through Netlink. ### Source excerpt We analyze how VoidLink, LinkPro, and Atomic Arch abuse eBPF helpers to hide from defenders, and show how to detect them at load time, before they can act. ## What Is Cilium? DevFeed: [What Is Cilium?]() Original publisher: [Read original article]() Author: Christian Hernandez Published: 2026-07-23T07:01:00Z Content type: tutorial Language: en Sources: [Isovalent - The latest articles covering eBPF-based Networking, Observability, and Security]() Topics: [Cilium](), [eBPF](), [Kubernetes networking](), [observability](), [Security](), [Cloud]() Tags: [cilium](), [cloud-native](), [ebpf](), [infrastructure](), [kubernetes](), [kubernetes-networking](), [observability](), [security]() ### AI overview An introductory article explains Cilium and describes how it uses eBPF for Kubernetes networking, security, and observability in cloud-native infrastructure. ### Source excerpt Learn what Cilium is, how it uses eBPF to power Kubernetes networking, security, and observability, and why organizations choose it for modern cloud-native infrastructure. ## Runtime security monitoring and threat detection: Protecting production without slowing developers DevFeed: [Runtime security monitoring and threat detection: Protecting production without slowing developers]() Original publisher: [Read original article]() Author: Ajay Chankramath Published: 2026-07-23T05:40:01Z Content type: article Language: en Sources: [Platform Engineering Blog]() Topics: [threat detection](), [Platform Engineering](), [Monitoring](), [Security](), [Containers](), [internal developer platform](), [eBPF](), [Network](), [Processes]() Tags: [blog-post](), [containers](), [developer](), [ebpf](), [firewalls](), [internal-developer-platform](), [monitoring](), [network](), [platform](), [platform-engineering](), [processes](), [security](), [threat-detection]() ### AI overview This article explains how runtime security monitoring protects production workloads from threats that static scans may miss, including privilege escalation, container escapes, unexpected processes, sensitive file access, and suspicious network connections. It presents kernel-level monitoring, including eBPF, as a way to provide continuous protection while embedding security policies into the platform and minimizing developer friction. ### Source excerpt Runtime security monitoring detects zero-days, container escapes, and privilege escalations in production. Discover how eBPF enables 'invisible, always-on' protection for platform engineers ## Building Service Topology at Scale: Architecture, Challenges, and Lessons Learned DevFeed: [Building Service Topology at Scale: Architecture, Challenges, and Lessons Learned]() Original publisher: [Read original article]() Author: Netflix Technology Blog Published: 2026-07-13T22:44:11Z Content type: article Language: en Sources: [Netflix](), [Netflix TechBlog - Medium]() Topics: [telemetry](), [Kafka](), [incident](), [cpu]() Tags: [architecture](), [backend-development](), [data-engineering](), [distributed-systems](), [ebpf](), [kafka](), [metrics](), [observability](), [scale](), [software-engineering](), [streaming](), [tracing]() ### AI overview Netflix describes the engineering lessons from building a real-time service-dependency map at scale. The system ingests streaming network-flow, IPC-metric, and tracing data to support topology queries while addressing production issues such as Kafka lag, memory pressure, traffic skew, and garbage-collection overhead. ### Source excerpt By Parth Jain, Rakesh Sukumar, Yingwu Zhao, Renzo Sanchez-Silva & Nathan Fisher A deep dive into the engineering challenges of building a real-time service dependency map at Netflix scale: from streaming architectures and distributed aggregation pipelines to time-travel queries and the methodology that made it work. Introduction In our first post, we introduced the problem: engineers at Netflix needed a unified, real-time view of service dependencies to troubleshoot faster, understand blast radius, and navigate our distributed architecture. We described our multi-source approach, combining eBPF network flows, IPC metrics, and distributed tracing into physically separate graph layers that can be queried independently or merged into a comprehensive view. That post explained what we built and why. This post is about how, the engineering reality of building this system at Netflix scale. Here's the truth: the first version worked perfectly... in our local environment. Production was a different story. Kafka consumers fell behind. Instances ran out of memory. Some nodes received 100x the traffic of others. Garbage collection pauses consumed more CPU than actual business logic. What you'll learn in this post isn't a success story, it's a learning journey. We'll walk through the architecture decisions that enabled scale, the production challenges that tested those decisions, the optimization methodology that guided us through, and the lessons that apply to any distributed system. Along the way, we'll share the innovations that made it possible to process millions of flow records per second, reconstruct topology at any point in time, and provide sub-second query responses, all while maintaining near real-time freshness. Architecture Deep-Dive: Building for Streaming and ScaleStreaming-First: Why Real-Time Matters Traditional service topology systems use batch processing, aggregating data hourly or daily, then storing complete snapshots. This approach works at a modest scale bu ## Inside Cilium CNI: solving mysterious Kubernetes pod setup timeouts DevFeed: [Inside Cilium CNI: solving mysterious Kubernetes pod setup timeouts]() Original publisher: [Read original article]() Author: Adyen Published: 2026-07-13T09:17:40Z Content type: article Language: en Sources: [Adyen Tech]() Topics: [Cilium](), [Kubernetes](), [Kubernetes networking](), [networking](), [eBPF](), [Latency](), [hdfs](), [Apache Spark](), [big-data](), [cpu]() Tags: [big-data](), [cilium](), [cni](), [cpu](), [data](), [devops](), [ebpf](), [hdfs](), [kubernetes](), [kubernetes-networking](), [latency](), [spark](), [speed](), [tracing]() ### AI overview An Adyen engineer investigates Cilium CNI timeouts that prevented new Kubernetes pods from starting. The article attributes the issue to sequential connection-tracking-table garbage collection, which became a bottleneck under workloads involving HDFS, Trino, and short-lived Spark jobs. ### Source excerpt By Jorrick Sleijster - Senior Data Platform Engineer, Adyen I was fully aware a year ago that a single configuration line could break the Kubernetes networking stack. But if they told me that leftovers from Kubernetes pods which terminated hours prior could block new ones from starting, I would have thought they were joking. In high-performance networking, 35 seconds is a lifetime. This was the latency required to iterate through our connection tracking table of 7 million entries at a maximum speed of 200,000 entries per second. At our 16-million-entry peak, this sequential lookup could take up to 80 seconds, leading to Cilium CNI timeouts preventing new pods from starting on affected nodes. We uncovered this linear-time behavior at Adyen by tracing syscalls, inspecting codebases, and analyzing eBPF internals. This investigation revealed how our varied workloads turned the connection tracking table's garbage collection algorithm into a critical bottleneck. Our setup: why we're different At Adyen, we run Cilium CNI across all our 100+ Kubernetes clusters. When we switched from Calico to Cilium, we knew we'd face challenges adapting it to our production workloads. Our production big data Kubernetes clusters have a unique usage pattern compared to the other Kubernetes environments within Adyen: Data extraction from HDFS. Our infrastructure relies on more than 500 datanodes. Trino represents one of our most demanding HDFS workloads, processing analytical queries against data stored on HDFS. Due to the distributed nature of HDFS, each file you download requires a new connection to any of these 500 nodes. Therefore, during peak hours, a single pod can produce approximately 50,000 connections every minute. Pod churn. Many pods we spawn on the Kubernetes cluster run batch jobs, such as Spark jobs. They stay around for anywhere from a second to a couple of hours. Wide variety of workloads. Some workloads are very CPU-intensive, like Spark pods executing complex joins and tra ## Splunk and Isovalent Runtime Security: Protecting the Platform Behind Splunk DevFeed: [Splunk and Isovalent Runtime Security: Protecting the Platform Behind Splunk]() Original publisher: [Read original article]() Author: Dean Lewis Published: 2026-07-09T06:02:44Z Content type: article Language: en Sources: [Isovalent - The latest articles covering eBPF-based Networking, Observability, and Security]() Topics: [Security]() Tags: [cilium](), [customer](), [ebpf](), [hubble](), [isovalent](), [kubernetes-networking](), [load-balancer](), [mesh-networking](), [platform](), [runtime-security](), [security](), [tetragon](), [website]() ### AI overview Splunk uses Isovalent Runtime Security, built on Tetragon, to protect its customer-facing platform. ### Source excerpt Splunk uses Isovalent Runtime Security, built on Tetragon, to protect its customer facing platform. ## Taming the AI Double Threat with Isovalent Runtime Security DevFeed: [Taming the AI Double Threat with Isovalent Runtime Security]() Original publisher: [Read original article]() Author: Paul Arah Published: 2026-06-26T18:47:44Z Content type: opinion Language: en Sources: [Isovalent - The latest articles covering eBPF-based Networking, Observability, and Security]() Topics: [Security](), [ai-assisted attacks](), [Artificial Intelligence]() Tags: [ai](), [ai-assisted-attacks](), [attacks](), [cilium](), [ebpf](), [hubble](), [infrastructure](), [isovalent](), [kubernetes-networking](), [load-balancer](), [mesh-networking](), [runtime-security](), [security](), [tetragon](), [website]() ### AI overview This blog post examines how AI-assisted attacks change assumptions about adversaries, the new attack surface introduced by AI workloads, and the infrastructure, identity, and runtime controls needed to address these risks with Isovalent Runtime Security. ### Source excerpt This blog post explores how AI-assisted attacks are changing the assumptions we make about the adversary, the new attack surface AI workloads introduce, and the infrastructure, identity, and runtime controls they require, and finally, how teams can address this new threat landscape with Isovalent Runtime Security. ## 【eBPF 内核实现深度拆解】从验证器到 JIT，从 BTF 到调度器 DevFeed: [【eBPF 内核实现深度拆解】从验证器到 JIT，从 BTF 到调度器]() Original publisher: [Read original article]() Author: Liao Tonglang Published: 2026-06-12T00:00:00Z Content type: article Language: zh Sources: [土法炼钢 - 系统与基础设施]() Topics: [eBPF](), [Linux](), [JIT](), [Benchmark](), [clang](), [hash](), [benchmarking](), [RISC-V](), [ast-matchers]() Tags: [arm](), [array](), [benchmark](), [bpf-jit](), [bpf-maps](), [bpf-verifier](), [btf](), [clang](), [co-re](), [cpu](), [ebpf](), [fentry](), [hash](), [jit](), [kernel](), [libbpf](), [linux](), [linux-kernel](), [precision](), [risc-v](), [sched-ext](), [trampoline](), [x86](), [xdp]() ### AI overview This Chinese-language series systematically explains eBPF's Linux kernel implementation, covering the BPF instruction set and registers, verifier algorithms, JIT compilation, map data structures and concurrency, helper type checking, BTF and CO-RE relocation, libbpf loading, trampolines, and sched_ext interfaces. It is aimed at engineers who want to understand eBPF kernel source code and build production BPF programs. ### Source excerpt eBPF 内核虚拟机内部实现系统讲解：BPF 指令集与寄存器机器、验证器的抽象解释与状态裁剪、JIT 编译器后端、Map 各类型的并发与内存模型、helper 函数注册与类型检查、BTF 格式规范与 CO-RE 重定位引擎、libbpf 加载器工程、fentry/fexit 蹦床机制、sched_ext 调度器内核接口。面向想读懂 eBPF 内核源码、写生产级 BPF 程序的系统工程师。 ## Tetragon 1.7 adds fentry sensing, environment variable capture, parent-process visibility, and scoped policies DevFeed: [Tetragon 1.7 adds fentry sensing, environment variable capture, parent-process visibility, and scoped policies]() Original publisher: [Read original article]() Author: Paul Arah Published: 2026-06-09T14:01:46Z Content type: release Language: en Sources: [Isovalent - The latest articles covering eBPF-based Networking, Observability, and Security]() Topics: [Processes](), [Environment Variables](), [context]() Tags: [cilium](), [ebpf](), [environment-variables](), [hubble](), [isovalent](), [kubernetes-networking](), [load-balancer](), [mesh-networking](), [policy](), [process](), [runtime-security](), [sensor](), [tetragon](), [visibility](), [website]() ### AI overview Tetragon 1.7 introduces a new fentry sensor, environment variable capture, parent-process visibility, and granular policy scoping with hostSelector. ### Source excerpt Tetragon 1.7 introduces a new fentry sensor, environment variables capturing, parent process visibility, granular policy scoping with hostSelector and more! ## Isovalent Private Networks and Cisco Nexus One: BGP EVPN Integration for the Enterprise Data Center DevFeed: [Isovalent Private Networks and Cisco Nexus One: BGP EVPN Integration for the Enterprise Data Center]() Original publisher: [Read original article]() Author: Marcos Hernandez, Camillo Rossi Published: 2026-06-04T16:42:52Z Content type: release Language: en Sources: [Isovalent - The latest articles covering eBPF-based Networking, Observability, and Security]() Topics: [virtualization](), [networking](), [BGP](), [Cisco](), [evpn](), [VXLAN](), [datacenter]() Tags: [bgp](), [cilium](), [cisco](), [data-center](), [ebpf](), [evpn](), [hubble](), [isovalent](), [kubernetes-networking](), [load-balancer](), [mesh-networking](), [networking](), [nexus-one](), [runtime-security](), [tetragon](), [virtualization](), [vxlan](), [website]() ### AI overview Isovalent announces the general availability of Isovalent Networking for Virtualization and highlights its BGP EVPN/VXLAN integration with Cisco NX-OS for enterprise data centers. ### Source excerpt Today we're announcing the General Availability (GA) of Isovalent Networking for Virtualization alongside a deeper look at one of its core connectivity capabilities: BGP EVPN/VXLAN integration with Cisco NX-OS, part of the Cisco Nexus One strategic alignment. ## OpenAI Uses Isovalent for a Common Networking for AI Infrastructure DevFeed: [OpenAI Uses Isovalent for a Common Networking for AI Infrastructure]() Original publisher: [Read original article]() Author: Dean Lewis Published: 2026-06-03T10:42:00Z Content type: article Language: en Sources: [Isovalent - The latest articles covering eBPF-based Networking, Observability, and Security]() Topics: [Cilium](), [OpenAI](), [AI Infrastructure](), [Kubernetes](), [networking]() Tags: [ai](), [ai-infrastructure](), [cilium](), [ebpf](), [hubble](), [infrastructure](), [isovalent](), [kubernetes](), [kubernetes-networking](), [load-balancer](), [mesh-networking](), [networking](), [openai](), [policy](), [runtime-security](), [tetragon](), [troubleshooting](), [uses](), [website]() ### AI overview The article reports that OpenAI uses Isovalent Networking for Kubernetes, built on Cilium, to provide consistent networking, policy, and troubleshooting across its AI infrastructure. ### Source excerpt OpenAI uses Isovalent Networking for Kubernetes, built on Cilium, for consistent networking, policy, and troubleshooting across AI infrastructure. ## Isovalent Networking for Virtualization: Enterprise-Grade Network Segmentation and Multi-Tenancy for VMs in Kubernetes DevFeed: [Isovalent Networking for Virtualization: Enterprise-Grade Network Segmentation and Multi-Tenancy for VMs in Kubernetes]() Original publisher: [Read original article]() Author: Marcos Hernandez Published: 2026-06-02T12:59:28Z Content type: release Language: en Sources: [Isovalent - The latest articles covering eBPF-based Networking, Observability, and Security]() Topics: [virtualization](), [Network Segmentation](), [Multi-tenancy](), [Kubernetes]() Tags: [cilium](), [ebpf](), [hubble](), [isovalent](), [kubernetes](), [kubernetes-networking](), [load-balancer](), [mesh-networking](), [migrations](), [multi-tenancy](), [network-segmentation](), [policy](), [product](), [runtime-security](), [tetragon](), [virtualization](), [website]() ### AI overview Isovalent announced the general availability of Isovalent Networking for Virtualization, a product that provides network segmentation, multi-tenancy, and policy enforcement for virtual machine workloads running in Kubernetes. It also streamlines migrations to KubeVirt. ### Source excerpt We're formally announcing the General Availability of Isovalent Networking for Virtualization (INV), a purpose-built product that brings full network segmentation, multi-tenancy, and policy enforcement to virtual machine workloads running in Kubernetes, in addition to streamlining migrations to KubeVirt. ## Blog: Introducing Falco 0.44.0 DevFeed: [Blog: Introducing Falco 0.44.0]() Original publisher: [Read original article]() Published: 2026-05-26T00:00:00Z Content type: release Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [eBPF](), [Kernel](), [Command-line interface](), [Kubernetes]() Tags: [cli](), [deprecated](), [ebpf](), [falco](), [kernel](), [kubernetes](), [release](), [version]() ### AI overview Falco 0.44.0 removes the legacy eBPF probe, gVisor engine, and gRPC output and server. The release adds rule-language list modifiers, a hard capture-file size limit, stricter schema validation, JSON output for listing commands, faster process-tree lookups, and multi-thread safety fixes. It also includes updated libraries, drivers, plugins, and rules. ### Source excerpt Dear Falco Community, we are happy to announce the release of Falco 0.44.0 today! This release completes the deprecation cycle started in 0.42.0 and 0.43.0: the legacy eBPF probe, the gVisor engine, and the gRPC output (along with the gRPC server) are now fully removed from the entire stack. On top of that, 0.44.0 brings new rule-language capabilities, a long-requested safety knob for the capture feature, JSON output for the --list family of commands, a substantial round of performance work on process tree lookups, and a wave of multi-thread safety fixes that lay the groundwork for the upcoming multi-threaded Falco architecture. During this release cycle, we merged: 60 PRs on Falco, including 14 release note-worthy changes 160 PRs on Falco libs, including 54 release note-worthy changes 16 PRs on Falco drivers, including 3 release note-worthy changes We upgraded libs to version 0.25.2 and drivers to 10.2.0+driver. We also ship falcoctl 0.13.0, the container plugin 0.7.1, and the falco-rules ruleset 5.1.0. Thank you to our maintainers and contributors. This would not have been possible without your support and dedication! To learn everything about the changes, read on! What's new? TL;DR Major features and improvements: Comparison operator list modifiers (oneof/anyof/allof) Hard limit on capture file size Stricter rule schema validation Backslash escaping in -o dotted key paths JSON output for the listing CLI commands Faster process tree lookups Multi-thread safety hardening Drivers: The kernel module pre-builds for this release are still being produced and will be available within a couple of days from the release. In the meantime, falcoctl can build the kernel module locally on the host. Drivers: new syscall, kernel 7.0, and BPF iterators Plugins: Container plugin fix for containerd v2.3.0 Plugin library path traversal hardening Event generator: Event generator: HTTP output and new suite namespace Rules: Updated ruleset (falco-rules 5.1.0) Kubernetes: Kubernetes Oper ## Buzzing Beyond Clouds: The Illustrated Children's Guide to Cilium DevFeed: [Buzzing Beyond Clouds: The Illustrated Children's Guide to Cilium]() Original publisher: [Read original article]() Author: Bill Mulligan, Katie Meinders Published: 2026-05-19T10:23:39Z Content type: release Language: en Sources: [Isovalent - The latest articles covering eBPF-based Networking, Observability, and Security]() Topics: [Cilium]() Tags: [book](), [cilium](), [ebpf](), [hubble](), [isovalent](), [kubernetes-networking](), [load-balancer](), [mesh-networking](), [runtime-security](), [tetragon](), [website]() ### AI overview Buzzing Beyond Clouds is an illustrated children's guide to Cilium. The book is presented as a follow-up to an illustrated guide to eBPF and is intended for readers with varying levels of technical expertise. ### Source excerpt Buzzing Beyond Clouds: The Illustrated Children's Guide to Cilium, and follow up to Buzzing Across Space: The Illustrated Children's Guide to eBPF, is now available. This second illustrated book brings the Cilium story to life in a way that can be digested by readers of all ages and levels of technical expertise. ## Stop guessing in production: Full fidelity tracing at scale with ClickHouse and Odigos DevFeed: [Stop guessing in production: Full fidelity tracing at scale with ClickHouse and Odigos]() Original publisher: [Read original article]() Author: Will Searle Published: 2026-05-05T00:00:00Z Content type: article Language: en Sources: [ClickHouse Blog]() Topics: [tracing](), [Instrumentation](), [observability](), [telemetry](), [clickhouse](), [OpenTelemetry](), [eBPF](), [Scalability](), [Kafka]() Tags: [clickhouse](), [ebpf](), [instrumentation](), [kafka](), [observability](), [opentelemetry](), [scalability](), [telemetry](), [tracing]() ### AI overview The article explains how combining ClickStack, a ClickHouse-native observability backend, with Odigos, a zero-code OpenTelemetry instrumentation platform, can reduce observability gaps. It focuses on capturing complete, contextual telemetry across distributed and asynchronous systems, including trace context crossing Kafka and background-processing boundaries, while addressing the operational overhead and scalability risks of OpenTelemetry pipelines. ### Source excerpt How ClickStack and Odigos eliminate observability gaps with zero-code eBPF instrumentation and full-fidelity distributed tracing at scale. ## Service Mesh Architecture: Sidecar Overhead, Istio, and Alternatives Without Sidecars DevFeed: [Service Mesh Architecture: Sidecar Overhead, Istio, and Alternatives Without Sidecars]() Original publisher: [Read original article]() Author: Liao Tonglang Published: 2026-04-13T00:00:00Z Content type: article Language: zh Sources: [土法炼钢 - 系统与基础设施]() Topics: [Architecture & Design](), [istio](), [Kubernetes](), [Cilium](), [eBPF](), [linkerd]() Tags: [architecture](), [cilium](), [ebpf](), [envoy](), [istio](), [kubernetes](), [linkerd](), [observability](), [proxy](), [security](), [service-mesh](), [sidecar](), [tls]() ### AI overview This article explains the core problems addressed by service meshes and examines the Sidecar architecture, including traffic interception, proxy processing, Envoy's xDS configuration model, and Istio's istiod control plane. It focuses on the performance and operational overhead of Sidecars and compares them with approaches such as Cilium's eBPF-based implementation and Istio Ambient Mesh. ### Source excerpt 2023 年，某头部电商平台在全量接入 Istio 后发现：每个 Pod 的内存占用增加了 40-70 MB，p99 延迟从 12 ms 上升到 18 ms，整个集群每月多出数万美元的计算成本。这并非个例。CNCF 2024 年度调查显示，超过 60% 的受访企业已在生产环境中使用或评估服务网格（Service Mes... [Next page]()