Edge Delta Kubernetes Trace Source

Overview

You can use the Kubernetes Trace source node to ingest eBPF traces for specific resources from the Linux kernel.

• outgoing_data_types: trace

This node requires Edge Delta agent version v1.18.0 or higher.

Resource Considerations

This source uses eBPF (Extended Berkeley Packet Filter) to capture kernel-level network traces, which is a resource-intensive operation. Consider the following when using this source:

Resource Impact:

• High CPU usage: eBPF tracing captures and processes network packets at the kernel level
• High memory consumption: Trace data buffering and processing requires significant memory
• Volume dependent: Resource usage scales with network traffic volume

When to Use:

• You need detailed network-level trace visibility for troubleshooting
• Service-to-service tracing is critical for your observability strategy
• You have sufficient cluster resources to support eBPF operations

When to Disable:

• Using alternative APM or distributed tracing solutions
• Resource constraints are critical in your environment
• Network visibility is not a priority

To disable eBPF-based sources globally, set tracerProps.enabled=false when deploying via Helm. For optimization strategies, see Reducing Agent Resource Consumption.

Example Configuration

nodes:
  - name: Kubernetes_Trace_Input
    type: k8s_trace_input

Required Parameters

name

A descriptive name for the node. This is the name that will appear in pipeline builder and you can reference this node in the YAML using the name. It must be unique across all nodes. It is a YAML list element so it begins with a - and a space followed by the string. It is a required parameter for all nodes.

nodes:
  - name: <node name>
    type: <node type>

type: k8s_trace_input

The type parameter specifies the type of node being configured. It is specified as a string from a closed list of node types. It is a required parameter.

nodes:
  - name: <node name>
    type: <node type>

Optional Parameters

exclude

The exclude parameter is used to excluded traces from certain namespaces from being ingested by the agent. It is specified in OTEL format with Golang regex or full text. If exclude is specified it drops traces that match its Golang regex rules. Exclude is optional.

• If include is specified as well as exclude, then traces matching in include are passed unless they are dropped by exclude.

nodes:
  - name: <node name>
    type: k8s_trace_input
    include:
      - k8s.namespace.name=.*
    exclude:
      - k8s.namespace.name=test

include

The include parameter is used to specify namespaces from which traces should be ingested by the agent. It is specified in OTEL format with Golang regex or full text. If exclude is also specified, then traces matching in include are ingested unless they are dropped by exclude. Include is optional.

nodes:
  - name: <node name>
    type: k8s_trace_input
    include:
      - k8s.namespace.name=.*

source_metadata

This option is used to define which detected resources and attributes to add to each data item as it is ingested by Edge Delta. You can select:

• Required Only: This option includes the minimum required resources and attributes for Edge Delta to operate.
• Default: This option includes the required resources and attributes plus those selected by Edge Delta
• High: This option includes the required resources and attributes along with a larger selection of common optional fields.
• Custom: With this option selected, you can choose which attributes and resources to include. The required fields are selected by default and can’t be unchecked.

Based on your selection in the GUI, the source_metadata YAML is populated as two dictionaries (resource_attributes and attributes) with Boolean values.

See Choose Data Item Metadata for more information on selecting metadata.