Thriving 
RS Lightweight eBPF-based observability agent for AI/LLM workloads - monitors token usage, latency, and sensitive file access in Kubernetes without code changes.
HEALTH ? 90 / Healthy
Thriving RS // readme
honeybeepf-llm
Per-pod LLM token, request and latency metrics from eBPF — no code changes, no proxy, no SDK.
honeybeepf-llm is a Rust eBPF agent that runs as a DaemonSet. It attaches uprobes to OpenSSL’s SSL_write and
SSL_read, reads the plaintext HTTP of calls to LLM providers, and exports token usage, request counts and
latency per Kubernetes namespace and pod over OpenTelemetry.
image; the client pods call a local mock of the provider APIs with fake keys.
Architecture
Why
- No code changes. Applications keep their SDKs and their real provider hostnames. Nothing to import, wrap or redeploy.
- No proxy. Traffic goes straight from the pod to the provider; the agent only reads copies of the buffers that OpenSSL encrypts and decrypts. If the agent stops, requests carry on unaffected.
- API keys stay out of logs and metrics. The agent logs only the request path (without its query), pid, model and token counts, never headers or bodies. A test sends fake keys in headers, bodies and query strings and checks every log record at every level (#45).
- Per pod. Calls from pods…