diff --git a/go.mod b/go.mod index 604901cc..a416035e 100644 --- a/go.mod +++ b/go.mod @@ -53,7 +53,7 @@ require ( k8s.io/api v0.31.3 k8s.io/apimachinery v0.31.3 k8s.io/client-go v0.31.3 - k8s.io/cri-api v0.31.3 + k8s.io/cri-api v0.32.1 ) require ( diff --git a/go.sum b/go.sum index 51ac186d..a5b28e50 100644 --- a/go.sum +++ b/go.sum @@ -2065,6 +2065,8 @@ k8s.io/component-base v0.31.2 h1:Z1J1LIaC0AV+nzcPRFqfK09af6bZ4D1nAOpWsy9owlA= k8s.io/component-base v0.31.2/go.mod h1:9PeyyFN/drHjtJZMCTkSpQJS3U9OXORnHQqMLDz0sUQ= k8s.io/cri-api v0.31.3 h1:dsZXzrGrCEwHjsTDlAV7rutEplpMLY8bfNRMIqrtXjo= k8s.io/cri-api v0.31.3/go.mod h1:Po3TMAYH/+KrZabi7QiwQI4a692oZcUOUThd/rqwxrI= +k8s.io/cri-api v0.32.1 h1:XWDw70IJV0GmExhQBYz7H+6iFEaKXcUOpnj5MHQ/JXY= +k8s.io/cri-api v0.32.1/go.mod h1:DCzMuTh2padoinefWME0G678Mc3QFbLMF2vEweGzBAI= k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk= k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE= k8s.io/kube-openapi v0.0.0-20240903163716-9e1beecbcb38 h1:1dWzkmJrrprYvjGwh9kEUxmcUV/CtNU8QM7h1FLWQOo= diff --git a/pkg/ebpftracer/tracer.go b/pkg/ebpftracer/tracer.go index 6f0b4acb..11fa1475 100644 --- a/pkg/ebpftracer/tracer.go +++ b/pkg/ebpftracer/tracer.go @@ -2,7 +2,6 @@ package ebpftracer import ( "context" - "encoding/base64" "encoding/binary" "errors" "fmt" @@ -11,10 +10,8 @@ import ( "sync" "time" - "github.com/castai/kvisor/cmd/agent/daemon/metrics" "github.com/castai/kvisor/pkg/cgroup" "github.com/castai/kvisor/pkg/containers" - "github.com/castai/kvisor/pkg/ebpftracer/decoder" "github.com/castai/kvisor/pkg/ebpftracer/events" "github.com/castai/kvisor/pkg/ebpftracer/signature" "github.com/castai/kvisor/pkg/ebpftracer/types" @@ -22,8 +19,6 @@ import ( "github.com/castai/kvisor/pkg/proc" "github.com/castai/kvisor/pkg/processtree" "github.com/castai/kvisor/pkg/system" - "github.com/cilium/ebpf" - "github.com/cilium/ebpf/ringbuf" "github.com/go-playground/validator/v10" "github.com/google/gopacket/layers" "github.com/samber/lo" @@ -224,55 +219,6 @@ func (t *Tracer) eventsReadLoop(ctx context.Context) error { return t.runPerfBufReaderLoop(ctx, t.module.objects.Events) } -func (t *Tracer) runPerfBufReaderLoop(ctx context.Context, target *ebpf.Map) error { - eventsReader, err := ringbuf.NewReader(target) - if err != nil { - return err - } - - go func() { - <-ctx.Done() - if err := eventsReader.Close(); err != nil { - t.log.Warnf("closing events reader: %v", err) - } - }() - - // Allocate message decoder and perf record once. - // Under the hood per event reader will reuse and grow raw sample backing bytes slice. - ebpfMsgDecoder := decoder.NewEventDecoder(t.log, []byte{}) - var record ringbuf.Record - - for { - select { - case <-ctx.Done(): - return ctx.Err() - default: - } - - err := eventsReader.ReadInto(&record) - if err != nil { - if t.cfg.DebugEnabled { - t.log.Warnf("reading event: %v", err) - } - continue - } - - // Reset decoder with new raw sample bytes. - ebpfMsgDecoder.Reset(record.RawSample) - if err := t.decodeAndExportEvent(ctx, ebpfMsgDecoder); err != nil { - if errors.Is(err, decoder.ErrTooManyArguments) { - data := ebpfMsgDecoder.Buffer() - t.log.Errorf("decoding event: too many arguments for event. payload=%s, err=%v", - base64.StdEncoding.EncodeToString(data), err) - } else if t.cfg.DebugEnabled || errors.Is(err, ErrPanic) { - t.log.Errorf("decoding event: %v", err) - } - metrics.AgentDecodeEventErrorsTotal.Inc() - continue - } - } -} - func (t *Tracer) findAllRequiredEvents(id events.ID, out map[events.ID]struct{}) { // No need to load the whole dependency tree twice if _, found := out[id]; found { diff --git a/pkg/ebpftracer/tracer_linux.go b/pkg/ebpftracer/tracer_linux.go new file mode 100644 index 00000000..6f8636e2 --- /dev/null +++ b/pkg/ebpftracer/tracer_linux.go @@ -0,0 +1,63 @@ +//go:build linux + +package ebpftracer + +import ( + "context" + "encoding/base64" + "errors" + + "github.com/castai/kvisor/cmd/agent/daemon/metrics" + "github.com/castai/kvisor/pkg/ebpftracer/decoder" + "github.com/cilium/ebpf" + "github.com/cilium/ebpf/ringbuf" +) + +func (t *Tracer) runPerfBufReaderLoop(ctx context.Context, target *ebpf.Map) error { + eventsReader, err := ringbuf.NewReader(target) + if err != nil { + return err + } + + go func() { + <-ctx.Done() + if err := eventsReader.Close(); err != nil { + t.log.Warnf("closing events reader: %v", err) + } + }() + + // Allocate message decoder and perf record once. + // Under the hood per event reader will reuse and grow raw sample backing bytes slice. + ebpfMsgDecoder := decoder.NewEventDecoder(t.log, []byte{}) + var record ringbuf.Record + + for { + select { + case <-ctx.Done(): + return ctx.Err() + default: + } + + err := eventsReader.ReadInto(&record) + if err != nil { + if t.cfg.DebugEnabled { + t.log.Warnf("reading event: %v", err) + } + continue + } + + // Reset decoder with new raw sample bytes. + ebpfMsgDecoder.Reset(record.RawSample) + if err := t.decodeAndExportEvent(ctx, ebpfMsgDecoder); err != nil { + if errors.Is(err, decoder.ErrTooManyArguments) { + data := ebpfMsgDecoder.Buffer() + t.log.Errorf("decoding event: too many arguments for event. payload=%s, err=%v", + base64.StdEncoding.EncodeToString(data), err) + } else if t.cfg.DebugEnabled || errors.Is(err, ErrPanic) { + t.log.Errorf("decoding event: %v", err) + } + metrics.AgentDecodeEventErrorsTotal.Inc() + continue + } + } +} diff --git a/pkg/ebpftracer/tracer_other.go b/pkg/ebpftracer/tracer_other.go new file mode 100644 index 00000000..13f909e7 --- /dev/null +++ b/pkg/ebpftracer/tracer_other.go @@ -0,0 +1,12 @@ +//go:build !linux + +package ebpftracer + +import ( + "context" + + "github.com/cilium/ebpf" +) +func (t *Tracer) runPerfBufReaderLoop(ctx context.Context, target *ebpf.Map) error { + return nil +}