:_mod-docs-content-type: ASSEMBLY
[id="bpfman-operator-about"]
= About the eBPF Manager Operator
include::_attributes/common-attributes.adoc[]
:context: bpfman-operator-about

toc::[]

[role="_abstract"]
You can use the eBPF Manager Operator to centralize and secure the deployment of eBPF programs in a Kubernetes cluster. The eBPF Manager Operator streamlines lifecycle management and provides system-wide visibility so that you can focus on program interaction rather than manual configuration.

:FeatureName: eBPF Manager Operator
include::snippets/technology-preview.adoc[]

[id="about-ebpf_{context}"]
== About Extended Berkeley Packet Filter (eBPF)

eBPF extends the original Berkeley Packet Filter for advanced network traffic filtering. It acts as a virtual machine inside the Linux kernel, allowing you to run sandboxed programs in response to events such as network packets, system calls, or kernel functions.

// Per legal, the approved name for this is exactly: "eBPF Manager"

[id="about-bpfman-operator_{context}"]
== About the eBPF Manager Operator

eBPF Manager simplifies the management and deployment of eBPF programs within Kubernetes, as well as enhancing the security around using eBPF programs. It utilizes Kubernetes custom resource definitions (CRDs) to manage eBPF programs packaged as OCI container images. This approach helps to delineate deployment permissions and enhance security by restricting program types deployable by specific users.

eBPF Manager is a software stack designed to manage eBPF programs within Kubernetes. It facilitates the loading, unloading, modifying, and monitoring of eBPF programs in Kubernetes clusters. It includes a daemon, CRDs, an agent, and an operator:

bpfman:: A system daemon that manages eBPF programs via a gRPC API.
eBPF CRDs:: A set of CRDs like XdpProgram and TcProgram for loading eBPF programs, and a bpfman-generated CRD (BpfProgram) for representing the state of loaded programs.
bpfman-agent:: Runs within a daemonset container, ensuring eBPF programs on each node are in the desired state.
bpfman-operator:: Manages the lifecycle of the bpfman-agent and CRDs in the cluster using the Operator SDK.

The eBPF Manager Operator offers the following features:

- Enhances security by centralizing eBPF program loading through a controlled daemon. eBPF Manager has the elevated privileges so the applications don't need to be. eBPF program control is regulated by standard Kubernetes Role-based access control (RBAC), which can allow or deny an application's access to the different eBPF Manager CRDs that manage eBPF program loading and unloading.
- Provides detailed visibility into active eBPF programs, improving your ability to debug issues across the system.
- Facilitates the coexistence of multiple eBPF programs from different sources using protocols like libxdp for XDP and TC programs, enhancing interoperability.
- Streamlines the deployment and lifecycle management of eBPF programs in Kubernetes. Developers can focus on program interaction rather than lifecycle management, with support for existing eBPF libraries like Cilium, libbpf, and Aya.

[role="_additional-resources"]
[id="additional-resources_{context}"]
== Additional resources

* link:https://ebpf.io/what-is-ebpf/[eBPF Documentation]
* link:https://bpfman.io/latest[bpfman]
* link:https://bpfman.io/latest/developer-guide/api-spec/[eBPF Manager custom resource definition (CRD) API specification]