Skip to main content

eBPF Setup

Sentinel's eBPF mode unlocks real-time process events, per-connection network flows, and L7 HTTP tracing.

Requirements​

RequirementMinimum
Linux kernel4.18+ (5.4+ recommended for full feature set)
Pod securityprivileged: true (set automatically by chart)
BPF filesystem/sys/fs/bpf must be mounted on the node

Enable eBPF​

helm upgrade --install saviour \
  oci://ghcr.io/saviourops-labs/charts/saviour \
  --set sentinel.ebpf.enabled=true \
  --reuse-values

Verify eBPF is working​

kubectl logs -n saviour -l app.kubernetes.io/name=sentinel | grep -i ebpf
# Expected: "eBPF programs loaded successfully"

Disable eBPF (baseline mode)​

helm upgrade saviour \
  oci://ghcr.io/saviourops-labs/charts/saviour \
  --set sentinel.ebpf.enabled=false \
  --reuse-values

In baseline mode, Sentinel runs without privileged and only collects procfs-based metrics.