Tag · 7 posts
Closing the series: what six parts proved, the two scaling questions still untested, and the remaining exec-probe and production-kernel boundaries.
Correlating socket syscalls and kubelet probe attempts into the merged timeline, then fixing a real cgroup-attribution bug that left most of those events unresolved.
How the profiler retains pod-startup evidence after deletion, verified by reconstructing a deleted three-pod Tekton PipelineRun with `--timeline`.
How the CLI resolves pod owners and phases, the eBPF tracer captures syscall evidence, and the exporter joins both into a verified startup timeline.
A design for retaining pod-startup evidence after deletion by putting Kubernetes lifecycle records and eBPF syscall observations on the same time axis.
Why existing eBPF tools, continuous profilers, and APM platforms can't provide a durable pod-startup timeline that joins lifecycle records to kernel evidence.