How Polar Signals leverages eBPF for efficient profiling and cost optimization | Frederic Branczyk

Frederic Branczyk, founder of Polar Signals, discusses his decade-long observability career and how his company leverages eBPF for low-overhead profiling and infrastructure optimization. After 10–12 years in observability, including maintaining the Prometheus project and leading a 35-person observability team at Red Hat, Branczyk founded Polar Signals in late 2020, inspired by Google's continuous profiling practices.

The talk centers on a case study where Polar Signals used eBPF to address high cross-zone traffic costs on Google Cloud (applicable to AWS). Cross-zone traffic—data traveling between pods in different availability zones—incurs per-gigabyte charges. The team built an eBPF solution using netfilter hooks on Cilium-configured GKE clusters to measure this traffic at pod level with low overhead.

The technical implementation uses eBPF to intercept routed packets and capture source/destination IPs. Agents collect this data and send it to a central server, which resolves pod IPs to names and determines zone placement. Prometheus metrics show which pods cause the most cross-zone traffic, while flow logs reveal specific communication patterns. Remarkably, the entire eBPF program is approximately 90 lines of code—mostly struct definitions—and was built in two to three days.

Analysis identified one service unnecessarily transferring large data volumes from the main database. Once optimized, this significantly reduced cloud bills with a path to nearly eliminating cross-zone traffic. Branczyk emphasizes that eBPF's strength is hooking programs at exact system points to extract only necessary information with minimal overhead.

Regarding the eBPF ecosystem, Branczyk notes it was difficult in 2020–2021 but has matured substantially. Tools now exist across ecosystems: LibBPF (C/C++), LibBPF-RS (Rust), Cilium's Go libraries, and Java-to-eBPF compilation. He recommends starting with BPFTrace for exploratory scripting before graduating to full C programs.

Looking ahead, Branczyk predicts observability will evolve from siloed products toward unified platforms using observability-specific databases like Frosty B (created by Polar Signals). This will enable a unified experience across logs, metrics, tracing, and profiling rather than separate tools. Polar Signals plans to continue leveraging eBPF for observability wherever appropriate.