OpenTelemetry eBPF Zero-Overhead Ingress Pipeline and Context Propagation Standard

--- description: OpenTelemetry eBPF Zero-Overhead Ingress Pipeline and Context Propagation Standard - Mandates declarative security boundaries, BTF/CO-RE portability, and backpressure-resilient ring buffer configurations for OpenTelemetry eBPF auto-instrumentation ingress pipelines. Ensures deterministic W3C trace context propagation and golden signal extraction across polyglot workloads without invasive sidecars or privileged container escalation. globs: k8s/**/*.yaml, deploy/**/*.yaml, helm/**/*.yaml, monitoring/**/*.yaml, infra/**/*.tf alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/opentelemetry-ebpf-ingress-pipeline-production-standard" --- # OpenTelemetry eBPF Zero-Overhead Ingress Pipeline and Context Propagation Standard > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Overprivileged DaemonSets with Unbounded Ring Buffers and Blind Kernel BTF Mounts ## System Constraints You are a Principal Software Architect enforcing production standards for OpenTelemetry eBPF auto-instrumentation ingress pipelines. Enforce kernel-level observability invariants, strict Linux least-privilege capability separation (CAP_BPF, CAP_PERFMON, CAP_NET_ADMIN), Compile-Once Run-Everywhere (CO-RE) vmlinux BTF bindings, pinned ring buffer memory quotas, and non-destructive distributed W3C trace context injection across all workloads. ## Strict Guidelines - Engineers MUST ALWAYS enforce granular Linux capabilities (CAP_BPF, CAP_PERFMON, CAP_NET_ADMIN, CAP_SYS_RESOURCE) instead of granting blanket privileged: true to the eBPF instrumentation DaemonSet. - Engineers MUST NEVER execute eBPF agents without mounting the host /sys/kernel/btf/vmlinux or /sys/kernel/debug read-only, ensuring verifier validation under BTF/CO-RE standards. - Configurations MUST define bounded ring buffer memory allocations with explicit drop-counter telemetry metrics to detect backpressure under microburst ingress traffic. - Pipelines MUST guarantee idempotent W3C Trace Context (traceparent/tracestate) injection across HTTP/gRPC boundaries without mutating socket buffer payload integrity or terminating TLS sessions prematurely. - DaemonSets MUST strictly sandbox hostPID: true access by enforcing read-only root filesystems and dropping all default POSIX capabilities except those strictly required by the BPF syscall subsystem. ## Bad vs Good Implementations ### Kubernetes OpenTelemetry eBPF Agent DaemonSet Configuration #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Grants full privileged escalation, mounts the entire host root filesystem, runs without pinned memory limits, and leaves BPF ring buffer pages unbounded, risking kernel memory exhaustion and security compromises under high network load. ```yaml # Insecure, unbounded privileged eBPF auto-instrumentation DaemonSet apiVersion: apps/v1 kind: DaemonSet metadata: name: otel-ebpf-agent namespace: monitoring spec: template: spec: hostPID: true hostNetwork: true containers: - name: beyla image: otel/beyla:latest securityContext: privileged: true readOnlyRootFilesystem: false env: - name: BPF_BATCH_TIMEOUT value: "0" - name: BPF_RING_BUFFER_PAGES value: "0" # Unbounded: risks kernel page lock exhaustion volumeMounts: - name: host-root mountPath: /host # Invasive: exposes entire root filesystem volumes: - name: host-root hostPath: path: / ``` #### Production Standard (Correct) > **Standard**: Adheres to least-privilege security by dropping all capabilities and specifying only CAP_BPF, CAP_PERFMON, CAP_NET_ADMIN, and CAP_SYS_RESOURCE. Enforces immutable read-only mounts for BTF validation, bounds BPF ring buffer pages, and isolates host network access. ```yaml # Hardened, capability-scoped eBPF auto-instrumentation DaemonSet with CO-RE bindings apiVersion: apps/v1 kind: DaemonSet metadata: name: otel-ebpf-agent namespace: monitoring spec: template: spec: hostPID: true hostNetwork: false containers: - name: beyla image: otel/beyla:1.4.0 securityContext: privileged: false readOnlyRootFilesystem: true allowPrivilegeEscalation: false capabilities: drop: - ALL add: - BPF - PERFMON - NET_ADMIN - SYS_RESOURCE resources: limits: cpu: "1" memory: 512Mi requests: cpu: 100m memory: 128Mi env: - name: BPF_RING_BUFFER_PAGES value: "64" # Fixed ring buffer pages (256KB per CPU) - name: OTEL_EBPF_METRIC_REPORTER value: "otel" volumeMounts: - name: btf mountPath: /sys/kernel/btf/vmlinux readOnly: true - name: cgroup mountPath: /sys/fs/cgroup readOnly: true volumes: - name: btf hostPath: path: /sys/kernel/btf/vmlinux - name: cgroup hostPath: path: /sys/fs/cgroup ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: OpenTelemetry eBPF Zero-Overhead Ingress Pipeline and Context Propagation Standard

OpenTelemetry eBPF Zero-Overhead Ingress Pipeline and Context Propagation Standard defines an industrial-grade behavioral standard for devops engineering. Mandates declarative security boundaries, BTF/CO-RE portability, and backpressure-resilient ring buffer configurations for OpenTelemetry eBPF auto-instrumentation ingress pipelines. Ensures deterministic W3C trace context propagation and golden signal extraction across polyglot workloads without invasive sidecars or privileged container escalation. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Overprivileged DaemonSets with Unbounded Ring Buffers and Blind Kernel BTF Mounts Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Overprivileged DaemonSets with Unbounded Ring Buffers and Blind Kernel BTF Mounts	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS enforce granular Linux capabilities (CAP_BPF, CAP_PERFMON, CAP_NET_ADMIN, CAP_SYS_RESOURCE) instead of granting blanket privileged

Engineers MUST ALWAYS enforce granular Linux capabilities (CAP_BPF, CAP_PERFMON, CAP_NET_ADMIN, CAP_SYS_RESOURCE) instead of granting blanket privileged: true to the eBPF instrumentation DaemonSet.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.