uprobe: Add resolvePathInContainer support#5190
Draft
sayboras wants to merge 9 commits into
Draft
Conversation
✅ Deploy Preview for tetragon ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
sayboras
added
the
release-note/minor
sayboras
force-pushed
the
pr/tammach/uprobe-resolve-in-container
branch
5 times, most recently
from
6fddd31 to
7937133
Compare
sayboras
changed the title
sayboras
force-pushed
the
pr/tammach/uprobe-resolve-in-container
branch
from
7937133 to
00eedc1
Compare
Add the opt-in field, regenerate the CRD/reference docs, and cover field round-trip and defaulting. resolvePathInContainer needs a podSelector to know which containers to attach in; reject policies that omit it. Signed-off-by: Tam Mach <tam.mach@cilium.io>
Resolve an in-container path under a container root via openat2(RESOLVE_IN_ROOT), with a lexical fallback for old kernels. Signed-off-by: Tam Mach <tam.mach@cilium.io>
Track attached containers and drive attach/detach via an Attacher interface, resolving each container root through a pluggable seam. Signed-off-by: Tam Mach <tam.mach@cilium.io>
Route pod add/update/delete to per-policy reconcilers off the shared pod informer; no new informer is created. Signed-off-by: Tam Mach <tam.mach@cilium.io>
Resolve a container's root from the CreateContainer RootDir (new containers) and the CRI container pid (existing containers); discover already-running containers via CRI ListContainers/ListPodSandbox. Signed-off-by: Tam Mach <tam.mach@cilium.io>
Split RIC uprobes into per-container child sensors on policy load, snapshot existing containers via CRI, and resync periodically. Signed-off-by: Tam Mach <tam.mach@cilium.io>
Bake static tester binaries (default: uprobe-simple) from contrib/tester-progs into a busybox image via the PROGS build arg, so e2e tests can run workloads without pulling from an external registry. Signed-off-by: Tam Mach <tam.mach@cilium.io>
The workload runs the in-tree tester-progs image, which e2e-test now builds and loads into the temporary kind cluster via the new -tetragon.tester-progs-image flag. Signed-off-by: Tam Mach <tam.mach@cilium.io>
Signed-off-by: Tam Mach <tam.mach@cilium.io>
sayboras
force-pushed
the
pr/tammach/uprobe-resolve-in-container
branch
from
00eedc1 to
8328cba
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Uprobe paths are interpreted in the agent's own mount namespace, so binaries that only exist inside other pods' images cannot be hooked.
Add a
resolvePathInContaineroption to uprobe specs. When set,pathis resolved relative to the root filesystem of each container selected by the policy'spodSelector, and the uprobe is attached per matching container. Container roots are resolved via runtime hooks, with CRI as fallback. The option requires apodSelectorand comes with documentation, an example policy, and an e2e test backed by a new tester-progs image for test workloads.Fixes: #5105
Changelog