LoginSign Up
← Back to all sparks
I

Inspektor Gadget

INFRA · APIS
Velocity6.3

eBPF-based tool collection for debugging and observing Kubernetes workloads

www.inspektor-gadget.io ↗

Inspektor Gadget v0.56 adds Kubernetes multi-tenancy and GPU telemetry groundwork

ebpfkubernetesobservabilitygpusecuritymulti-tenancy
◆Current state
Inspektor Gadget is expanding from a cluster-admin debugging tool toward a multi-tenant eBPF observability platform. v0.56 ships Kubernetes multi-tenancy (experimental), authenticating gadget requests via TokenReview and scoping them to namespaces authorized by RBAC — the first time the tool can be deployed safely in shared clusters without granting cluster-wide access. v0.55 laid GPU observability groundwork with a userspace daemon publishing telemetry through pinned BPF maps, and expanded eBPF program type support (SockOps, SkSKB, SkMsg).
◆Where it's heading
Inspektor Gadget is building toward production-grade eBPF observability that can operate safely in multi-tenant Kubernetes environments without requiring cluster-admin. The RBAC-scoped multi-tenancy in v0.56, combined with rootless image commands and stripped Go binary uprobes (which now work on production kubelets), shows a team deliberately removing the prerequisites that blocked enterprise adoption. GPU telemetry is early-stage but positions the tool for AI workload observability before competitors have native eBPF coverage there.
◆Prediction
The Kubernetes multi-tenancy mode will graduate from experimental to stable in the next 1-2 releases as the SubjectAccessReview enforcement path gets broader testing. GPU telemetry will gain actual gadget consumers once the bridge daemon interface stabilizes.

◆Recent moves

  1. 8d ago

    Release v0.56.0

    ⚡ SPARK

    v0.56 introduces Kubernetes multi-tenancy as an experimental opt-in: every kubectl-gadget request is now authenticated via TokenReview and scoped to namespaces the user is authorized to access by RBAC. This removes the cluster-admin requirement that has blocked Inspektor Gadget deployment in shared Kubernetes environments. Combined with rootless ig image commands and stripped Go binary uprobe support (attaches to production kubelets without full symbol tables), v0.56 is the most enterprise-readiness-focused release yet.

    View source ↗
  2. 26d ago

    Release v0.55.1

    v0.55.1 patches a security issue where crafted ELF binaries from untrusted containers could exhaust memory or CPU in the privileged uprobe process — bounded stream parsing now caps the risk. A meaningful hardening fix given that Inspektor Gadget processes container workload binaries as part of its normal operation.

    View source ↗
  3. 1mo ago

    Release v0.55.0

    ⚡ SPARK

    v0.55 ships the initial GPU telemetry design: a userspace daemon (gpu-ebpf-bridge) publishes GPU metrics through pinned BPF maps, making them accessible to gadgets without privileged in-kernel GPU access. Alongside this, the eBPF operator gains map pinning, non-destructive iteration, and new program types (SockOps, SkSKB, SkMsg) that expand the network monitoring surface considerably.

    View source ↗
  4. 2mo ago

    Release v0.54.1

    A single-fix bugfix release ensuring the OCI store directory exists before locking — a startup edge case with no user-visible behavior change in normal operation.

    View source ↗
  5. 2mo ago

    Release v0.54.0

    v0.54.0 extends the advise_networkpolicy gadget to produce Cilium NetworkPolicy resources alongside standard Kubernetes NetworkPolicies, selectable via --policy-format. For teams already running Cilium, this removes the conversion step from IG-observed traffic to enforceable policy.

    View source ↗
  6. 3mo ago

    Release v0.53.2

    Patches a fanotify self-deadlock in container-hook by caching config.json — a correctness fix that prevented container hooks from deadlocking on some startup sequences. Routine maintenance with no user-visible capability change.

    View source ↗