Phase 3: Kubernetes

3. Enable OBI via Helm

Now add tracing to the entire cluster without changing any application code just one Helm upgrade.

Upgrade the Collector with OBI Enabled #

helm -n obi-workshop  upgrade splunk-otel-collector \
  splunk-otel-collector-chart/splunk-otel-collector \
  --set="splunkObservability.realm=${REALM}" \
  --set="splunkObservability.accessToken=${ACCESS_TOKEN}" \
  --set="clusterName=${INSTANCE}-k8s" \
  --set="environment=${INSTANCE}-ebpf" \
  --set="obi.enabled=true"

That single --set="obi.enabled=true" is the only change. The Helm chart handles everything else:

• Deploys the OBI DaemonSet (one pod per node)
• Configures RBAC (ServiceAccount, ClusterRole, ClusterRoleBinding)
• Points OBI at the collector automatically
• Grants the required Linux capabilities for eBPF

What Does OBI Need? #

The OBI pods run with elevated privileges because eBPF operates at the kernel level:

hostPID: true        # See all processes on the node, including other pods
hostNetwork: true    # Observe and inject trace context into network traffic
privileged: true     # Attach eBPF probes to the kernel

See the OBI Security Documentation ↗ for details on reducing permissions if your cluster policies require it.

Verify OBI is Running #

kubectl get pods  -n obi-workshop -l app.kubernetes.io/name=obi
kubectl logs  -n obi-workshop -l app.kubernetes.io/name=obi --tail=20

NAME        READY   STATUS    RESTARTS   AGE
obi-abc12   1/1     Running   0          45s

...
level=INFO msg="instrumenting process" service=payment-service
...
level=INFO msg="instrumenting process" service=order-processor
...
level=INFO msg="instrumenting process" service=frontend

Generate some traffic:

curl -s http://localhost:30000/create-order | jq

Check Splunk APM #

Wait 30-60 seconds for traces to flow.