How cortexflow/cortexbrain works
CortexBrain is a sidecarless, eBPF-based monitoring and network-policy platform for distributed workloads. Its main workflow is to attach kernel probes, collect network and system events, and expose telemetry for monitoring; the identity service also tracks interfaces and connections and supports packet blocking. The repository additionally includes a Kubernetes-focused CLI, an agent gRPC API, and an MCP server centered on Prometheus. Some service wiring is not shown in the sampled source, so the graph omits uncertain connections.
Main entry points: src/main.rs cfcli · src/main.rs Metrics service · install.rs Install and lifecycle · service.rs Service management
Components 19
Cluster management
- cfcli
cli/src/main.rs - Install and lifecycle
cli/src/install.rs - Service management
cli/src/service.rs - Monitoring commands
cli/src/monitoring.rs - Network policies
cli/src/policies.rs - Logs and status
cli/src/logs.rs
Kernel observability
- Connection and veth probes
core/src/components/conntracker/src/main.rs - Kernel metrics probes
core/src/components/metrics_tracer/src/main.rs
Telemetry runtime
- Identity service
core/src/components/identity/src/main.rs - Metrics service
core/src/components/metrics/src/main.rs - BPF map handling
core/common/src/map_handlers.rs
Agent API
- Agent gRPC server
core/api/src/main.rs - Agent client
core/api/src/client.rs
Monitoring integrations
- Prometheus MCP server
mcp/src/main.rs - Prometheus tool
mcp/src/tools.rs
Other components
- Operator
- Kubernetes cluster
- OpenTelemetry collector
- Prometheus
Connections 18
- Operator → cfcli: runs commands
- cfcli → Install and lifecycle: dispatches install
- cfcli → Service management: dispatches service
- cfcli → Monitoring commands: dispatches monitoring
- cfcli → Network policies: dispatches policies
- cfcli → Logs and status: dispatches logs
- Install and lifecycle → Kubernetes cluster: manages deployment
- Service management → Kubernetes cluster: queries services
- Logs and status → Kubernetes cluster: queries cluster
- Connection and veth probes → Identity service: emits kernel events
- Kernel metrics probes → Metrics service: emits perf events
- Metrics service → OpenTelemetry collector: exports telemetry
- Identity service → BPF map handling: initializes maps
- Metrics service → BPF map handling: initializes maps
- Agent client → Agent gRPC server: connects via gRPC
- Operator → Prometheus MCP server: starts server
- Prometheus MCP server → Prometheus tool: serves tool
- Prometheus tool → Prometheus: queries metrics