inspektor-gadget/inspektor-gadget

Features

• eBPF Tooling - Provides a framework for executing eBPF-based inspection tools as container images across Linux hosts and Kubernetes clusters.
• Inspection Gadget Execution - Runs bundled eBPF inspection images on clusters or hosts to collect system data.
• Linux Resource Monitors - Provides a comprehensive suite of tools for monitoring system calls, network traffic, and resource usage on Linux hosts.
• eBPF-Based Collection - Uses eBPF programs to collect high-performance system telemetry directly from the Linux kernel.
• Wasm Post-Processing - Executes WebAssembly modules to transform or analyze telemetry data before it is exported.
• Wasm-Based Telemetry Processing - Implements a modular data processing pipeline using WebAssembly modules to transform and filter kernel telemetry.
• Kubernetes Node Debugging - Investigates specific Kubernetes cluster nodes using transient debug environments to troubleshoot workloads.
• OCI-Compliant Packaging - Packages inspection tools as OCI-compliant artifacts for deployment across clusters and hosts.
• Container Image Packaging - Bundles eBPF programs, metadata, and modules into standard OCI container images.
• Container Image Distribution - Bundles inspection tools and metadata into OCI-compliant container images for portable deployment across hosts.
• Telemetry Analysis Modules - Executes WebAssembly code to process and analyze collected system data for observability.
• Kubernetes Node Debuggers - Investigates specific Kubernetes cluster nodes using transient debug environments and containerized inspection images.
• eBPF Program Deployment - Manages the loading and execution of eBPF bytecode within the Linux kernel from a userspace application.
• CO-RE Portable eBPF Deployments - Ensures eBPF programs run across different kernel versions using Compile Once Run Everywhere (CO-RE) and BTF data.
• eBPF Program Bundling - Bundles eBPF programs and metadata into OCI-compliant images for standardized distribution across environments.
• Program Packaging Frameworks - Provides a framework for building, packaging, and deploying eBPF programs as OCI-compliant container images.
• eBPF Program Development - Provides a framework for creating and packaging system inspection tools as eBPF programs.
• Kernel Telemetry Collection - Gathers low-level kernel data and enriches it with Kubernetes-native identities like pod and container names.
• Portable Type Bindings - Generates type information using BTF to ensure eBPF programs remain portable across different kernel versions.
• System Call Tracing - Monitors kernel system calls in real time, including arguments and return values, for system tracing.
• Monitoring and Observability - Implements a comprehensive framework for collecting kernel-level telemetry for system visibility.
• Kernel Metadata Enrichment - Maps raw kernel primitives to high-level identities, such as Kubernetes pod names, using a processing pipeline.
• Per-Process Resource Metrics - Collects per-process CPU and memory usage metrics by reading kernel data structures.
• System State Snapshotting - Captures a point-in-time view of active processes, files, and sockets.
• Hybrid Host-Container Execution - Enables executing inspection programs either directly on a Linux host or within a container environment.
• Runtime Debugging - Detects mutex deadlocks and monitors memory allocations to troubleshoot active application behavior.
• Image Integrity Verification - Validates container image signatures via a policy controller to block unsigned or unauthorized code from running.
• Lifecycle Event Detection - Tracks when containers start and stop to trigger specific inspection programs.
• Runtime API Tracing - Inspects containers by communicating with runtime APIs and sockets across various container platforms.
• Inspection Daemon Deployment - Installs background services on nodes to execute inspection images with specific security profiles.
• Kubernetes Deployments - Deploys inspection programs across Kubernetes worker nodes to collect telemetry from workloads.
• Remote Execution Interfaces - Implements a gRPC-based remote execution interface to manage daemons and trigger gadgets on remote machines.
• gRPC Administrative Interfaces - Exposes system inspection capabilities via gRPC administrative interfaces for remote triggering from external applications.
• gRPC Interfaces - Implements a gRPC interface to remotely manage inspection tools and retrieve system telemetry.
• Application-Layer Protocol Inspections - Parses and analyzes application-layer protocols such as DNS, TLS, and TCP to inspect network traffic.
• BTF Data Loading - Loads BPF Type Format files to enable the kernel to understand necessary data structures for eBPF programs.
• File Access Tracing - Monitors and reports when processes open files to identify applications accessing sensitive system files.
• Linux System State Collection - Executes data collection binaries directly on a Linux host to monitor system behavior.
• Background Daemons - Operates as a persistent background system process to allow for remote execution and management.
• Gadget Packaging Pipelines - Provides toolchains to compile eBPF source code and package it into distributable container images.
• Daemon Client Connections - Allows connecting to a remote daemon on Linux hosts to execute and manage inspection programs from any OS.
• Image Digest Whitelists - Limits program execution to a predefined whitelist of authorized container image digests or tags.
• Application Execution Controls - Manages which specific inspection programs are permitted to run on the host to maintain system stability.
• Binary Execution Restrictions - Implements security controls to prevent the execution of unauthorized binaries or image assets on the host.
• Container Image Signing - Provides digital signing for container image manifests to ensure the authenticity and integrity of inspection tools.
• Repository Trust Restrictions - Restricts the retrieval of inspection tools to a set of defined trusted remote repositories.
• Privileged Container Execution - Operates within privileged containers to access host namespaces and load eBPF programs into the kernel.
• Modular Data Pipelines - Implements modular data pipelines to modify how system telemetry is fetched, enriched, and filtered.
• Wasm-Based Plugins - Executes WebAssembly modules within the telemetry pipeline to transform and filter system data.
• Runtime Event Filters - Filters live kernel event streams in real time to reduce noise before data is exported.
• Security Auditing - Records system calls and monitors kernel security tracepoints to audit capability checks and system activity.
• Host Metadata Enrichments - Augments network addresses with pod and host identities to improve infrastructure visibility.
• System Metrics Collection - Gathers native system-level performance metrics from the kernel for later analysis.
• System Usage Monitoring - Reports periodic statistics for CPU, memory, and disk I/O consumption.
• Container Network Connection Tracers - Traces live network connections, DNS queries, and TCP states within container contexts.
• Network Traffic Analysis - Provides tools for isolating and filtering network data to identify high-bandwidth applications and hosts.
• OpenTelemetry Exporters - Collects system metrics and profiles and exports them using the OpenTelemetry standard.
• Orchestration Resource Filters - Translates pod names into kernel resources to perform high-performance filtering directly in-kernel.
• Performance Profiling Tools - Samples stack traces and measures CPU and memory to identify performance bottlenecks.
• Process State Inspection - Captures snapshots of running processes, open files, and active sockets for state analysis.
• System Resource Monitors - Reports real-time statistics for processes, files, and sockets to track system load.
• Remote System Inspection - Enables the execution and management of inspection tools on remote Linux machines through a centralized controller.
• Telemetry Collection - Captures performance data and exports it using standard telemetry protocols.
• Telemetry Exporters - Forwards system metrics and performance data to external storage or analysis platforms.
• Kernel Stack Trace Capture - Analyzes kernel and user-space stack traces to diagnose performance bottlenecks and system latency.
• Trace Event Filters - Limits gathered execution events via kernel or user-space filters to minimize system overhead.
• User-Space Function Tracing - Instruments binary or library functions in user-space to detect memory issues or deadlocks.
• Remote Program Executions - Allows managing and executing inspection tools on remote Linux machines from a centralized controller.

Star history