Skip to content

Commit 53bb57b

Browse files
msherif1234msherif1234
committed
migrate to recent ebpf manager APIs
Signed-off-by: Mohamed Mahmoud <mmahmoud@redhat.com>
1 parent bbb5f5c commit 53bb57b

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

43 files changed

+2565
-2505
lines changed

‎.golangci.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ linters:
1717
- typecheck
1818
- unused
1919
run:
20-
go: "1.22"
20+
go: "1.23"
2121
linters-settings:
2222
gocritic:
2323
enabled-checks:

‎apis/flowcollector/v1beta2/flowcollector_validation_webhook.go‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -86,8 +86,7 @@ func (r *FlowCollector) warnLogLevels(fc *FlowCollectorSpec) admission.Warnings
8686
func (r *FlowCollector) validateAgent(_ context.Context, fc *FlowCollectorSpec) (admission.Warnings, []error) {
8787
var warnings admission.Warnings
8888
if slices.Contains(fc.Agent.EBPF.Features, NetworkEvents) ||
89-
slices.Contains(fc.Agent.EBPF.Features, UDNMapping) ||
90-
slices.Contains(fc.Agent.EBPF.Features, EbpfManager) {
89+
slices.Contains(fc.Agent.EBPF.Features, UDNMapping) {
9190
// Make sure required version of ocp is installed
9291
if CurrentClusterInfo != nil && CurrentClusterInfo.IsOpenShift() {
9392
b, err := CurrentClusterInfo.OpenShiftVersionIsAtLeast("4.18.0")

‎config/rbac/role.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,10 @@ rules:
8989
- apiGroups:
9090
- bpfman.io
9191
resources:
92+
- clusterbpfapplications
93+
- clusterbpfapplicationstates
9294
- bpfapplications
95+
- bpfapplicationstates
9396
verbs:
9497
- create
9598
- delete

‎controllers/ebpf/agent_controller.go‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -292,7 +292,7 @@ func (c *AgentController) desired(ctx context.Context, coll *flowslatest.FlowCol
292292
volumeMount := corev1.VolumeMount{
293293
Name: bpfNetNSMountName,
294294
MountPath: bpfNetNSMountPath,
295-
MountPropagation: newMountPropagationMode(corev1.MountPropagationBidirectional),
295+
MountPropagation: newMountPropagationMode(corev1.MountPropagationHostToContainer),
296296
}
297297
volumeMounts = append(volumeMounts, volumeMount)
298298
}
@@ -314,7 +314,7 @@ func (c *AgentController) desired(ctx context.Context, coll *flowslatest.FlowCol
314314
volumeMount := corev1.VolumeMount{
315315
Name: bpfTraceMountName,
316316
MountPath: bpfTraceMountPath,
317-
MountPropagation: newMountPropagationMode(corev1.MountPropagationBidirectional),
317+
MountPropagation: newMountPropagationMode(corev1.MountPropagationHostToContainer),
318318
}
319319
volumeMounts = append(volumeMounts, volumeMount)
320320
}
@@ -339,7 +339,7 @@ func (c *AgentController) desired(ctx context.Context, coll *flowslatest.FlowCol
339339
volumeMount := corev1.VolumeMount{
340340
Name: ovnObservMountName,
341341
MountPath: ovnObservMountPath,
342-
MountPropagation: newMountPropagationMode(corev1.MountPropagationBidirectional),
342+
MountPropagation: newMountPropagationMode(corev1.MountPropagationHostToContainer),
343343
}
344344
volumeMounts = append(volumeMounts, volumeMount)
345345

@@ -356,7 +356,7 @@ func (c *AgentController) desired(ctx context.Context, coll *flowslatest.FlowCol
356356
volumeMount = corev1.VolumeMount{
357357
Name: ovsMountName,
358358
MountPath: ovsMountPath,
359-
MountPropagation: newMountPropagationMode(corev1.MountPropagationBidirectional),
359+
MountPropagation: newMountPropagationMode(corev1.MountPropagationHostToContainer),
360360
}
361361
volumeMounts = append(volumeMounts, volumeMount)
362362
}
@@ -379,7 +379,7 @@ func (c *AgentController) desired(ctx context.Context, coll *flowslatest.FlowCol
379379
volumeMount := corev1.VolumeMount{
380380
Name: bpfmanMapsVolumeName,
381381
MountPath: bpfManBpfFSPath,
382-
MountPropagation: newMountPropagationMode(corev1.MountPropagationBidirectional),
382+
MountPropagation: newMountPropagationMode(corev1.MountPropagationHostToContainer),
383383
}
384384
volumeMounts = append(volumeMounts, volumeMount)
385385
}

‎controllers/ebpf/bpfmanager-controller.go‎

Lines changed: 57 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,14 @@ import (
44
"context"
55
"encoding/binary"
66
"fmt"
7-
"github.com/netobserv/network-observability-operator/controllers/constants"
8-
"github.com/netobserv/network-observability-operator/pkg/helper"
9-
"github.com/sirupsen/logrus"
7+
"k8s.io/utils/ptr"
108

119
flowslatest "github.com/netobserv/network-observability-operator/apis/flowcollector/v1beta2"
10+
"github.com/netobserv/network-observability-operator/controllers/constants"
11+
"github.com/netobserv/network-observability-operator/pkg/helper"
1212

1313
bpfmaniov1alpha1 "github.com/bpfman/bpfman-operator/apis/v1alpha1"
14+
"github.com/sirupsen/logrus"
1415
"k8s.io/apimachinery/pkg/api/errors"
1516
v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
1617
"k8s.io/klog"
@@ -23,7 +24,7 @@ const (
2324

2425
// bpfmanDetachNetobserv find BpfmanApplication object with all required ebpf hooks and detaches them using bpfman manager
2526
func (c *AgentController) bpfmanDetachNetobserv(ctx context.Context) error {
26-
bpfApp := bpfmaniov1alpha1.BpfApplication{
27+
bpfApp := bpfmaniov1alpha1.ClusterBpfApplication{
2728
ObjectMeta: v1.ObjectMeta{
2829
Name: netobservApp,
2930
},
@@ -49,7 +50,7 @@ func (c *AgentController) bpfmanDetachNetobserv(ctx context.Context) error {
4950
// bpfmanAttachNetobserv Creates BpfmanApplication object with all required ebpf hooks and attaches them using bpfman manager
5051
func (c *AgentController) bpfmanAttachNetobserv(ctx context.Context, fc *flowslatest.FlowCollector) error {
5152
var err error
52-
bpfApp := bpfmaniov1alpha1.BpfApplication{
53+
bpfApp := bpfmaniov1alpha1.ClusterBpfApplication{
5354
ObjectMeta: v1.ObjectMeta{
5455
Name: netobservApp,
5556
},
@@ -83,9 +84,7 @@ func (c *AgentController) bpfmanAttachNetobserv(ctx context.Context, fc *flowsla
8384
return err
8485
}
8586

86-
func prepareBpfApplication(bpfApp *bpfmaniov1alpha1.BpfApplication, fc *flowslatest.FlowCollector, netobservBCImage string) {
87-
interfaces := fc.Spec.Agent.EBPF.Interfaces
88-
87+
func prepareBpfApplication(bpfApp *bpfmaniov1alpha1.ClusterBpfApplication, fc *flowslatest.FlowCollector, netobservBCImage string) {
8988
samplingValue := make([]byte, 4)
9089
dnsPortValue := make([]byte, 2)
9190
var enableDNSValue, enableRTTValue, enableFLowFilterValue, enableNetworkEvents, traceValue, networkEventsGroupIDValue, enablePktTranslation []byte
@@ -148,113 +147,116 @@ func prepareBpfApplication(bpfApp *bpfmaniov1alpha1.BpfApplication, fc *flowslat
148147
"enable_pkt_translation_tracking": enablePktTranslation,
149148
}
150149

151-
bpfApp.Spec.BpfAppCommon.ByteCode = bpfmaniov1alpha1.BytecodeSelector{
152-
Image: &bpfmaniov1alpha1.BytecodeImage{
150+
bpfApp.Spec.BpfAppCommon.ByteCode = bpfmaniov1alpha1.ByteCodeSelector{
151+
Image: &bpfmaniov1alpha1.ByteCodeImage{
153152
Url: netobservBCImage,
154153
ImagePullPolicy: bpfmaniov1alpha1.PullIfNotPresent,
155154
},
156155
}
157-
bpfApp.Spec.Programs = []bpfmaniov1alpha1.BpfApplicationProgram{
156+
bpfApp.Spec.Programs = []bpfmaniov1alpha1.ClBpfApplicationProgram{
158157
{
158+
Name: "tcx_ingress_flow_parse",
159159
Type: bpfmaniov1alpha1.ProgTypeTCX,
160-
TCX: &bpfmaniov1alpha1.TcxProgramInfo{
161-
BpfProgramCommon: bpfmaniov1alpha1.BpfProgramCommon{
162-
BpfFunctionName: "tcx_ingress_flow_parse",
160+
TCX: &bpfmaniov1alpha1.ClTcxProgramInfo{
161+
Links: []bpfmaniov1alpha1.ClTcxAttachInfo{
162+
{
163+
InterfaceSelector: bpfmaniov1alpha1.InterfaceSelector{InterfaceAutoDiscovery: ptr.To(true)},
164+
Direction: bpfmaniov1alpha1.TCIngress,
165+
},
163166
},
164-
InterfaceSelector: bpfmaniov1alpha1.InterfaceSelector{Interfaces: &interfaces},
165-
Direction: "ingress",
166167
},
167168
},
168169
{
170+
Name: "tcx_egress_flow_parse",
169171
Type: bpfmaniov1alpha1.ProgTypeTCX,
170-
TCX: &bpfmaniov1alpha1.TcxProgramInfo{
171-
BpfProgramCommon: bpfmaniov1alpha1.BpfProgramCommon{
172-
BpfFunctionName: "tcx_egress_flow_parse",
172+
TCX: &bpfmaniov1alpha1.ClTcxProgramInfo{
173+
Links: []bpfmaniov1alpha1.ClTcxAttachInfo{
174+
{
175+
InterfaceSelector: bpfmaniov1alpha1.InterfaceSelector{InterfaceAutoDiscovery: ptr.To(true)},
176+
Direction: bpfmaniov1alpha1.TCEgress,
177+
},
173178
},
174-
InterfaceSelector: bpfmaniov1alpha1.InterfaceSelector{Interfaces: &interfaces},
175-
Direction: "egress",
176179
},
177180
},
178181
}
179182

180183
if helper.IsFlowRTTEnabled(&fc.Spec.Agent.EBPF) {
181-
bpfApp.Spec.Programs = append(bpfApp.Spec.Programs, []bpfmaniov1alpha1.BpfApplicationProgram{
184+
bpfApp.Spec.Programs = append(bpfApp.Spec.Programs, []bpfmaniov1alpha1.ClBpfApplicationProgram{
182185
{
186+
Name: "tcp_rcv_fentry",
183187
Type: bpfmaniov1alpha1.ProgTypeFentry,
184-
Fentry: &bpfmaniov1alpha1.FentryProgramInfo{
185-
BpfProgramCommon: bpfmaniov1alpha1.BpfProgramCommon{
186-
BpfFunctionName: "tcp_rcv_fentry",
188+
FEntry: &bpfmaniov1alpha1.ClFentryProgramInfo{
189+
ClFentryLoadInfo: bpfmaniov1alpha1.ClFentryLoadInfo{
190+
Function: "tcp_rcv_established",
187191
},
188-
FunctionName: "tcp_rcv_established",
189-
},
190-
},
191-
{
192-
Type: bpfmaniov1alpha1.ProgTypeKprobe,
193-
Kprobe: &bpfmaniov1alpha1.KprobeProgramInfo{
194-
BpfProgramCommon: bpfmaniov1alpha1.BpfProgramCommon{
195-
BpfFunctionName: "tcp_rcv_kprobe",
192+
Links: []bpfmaniov1alpha1.ClFentryAttachInfo{
193+
{
194+
Mode: bpfmaniov1alpha1.Attach,
195+
},
196196
},
197-
FunctionName: "tcp_rcv_established",
198-
RetProbe: false,
199197
},
200198
},
201199
}...)
202200
}
203201

204202
if helper.IsNetworkEventsEnabled(&fc.Spec.Agent.EBPF) {
205-
bpfApp.Spec.Programs = append(bpfApp.Spec.Programs, []bpfmaniov1alpha1.BpfApplicationProgram{
203+
bpfApp.Spec.Programs = append(bpfApp.Spec.Programs, []bpfmaniov1alpha1.ClBpfApplicationProgram{
206204
{
205+
Name: "rh_network_events_monitoring",
207206
Type: bpfmaniov1alpha1.ProgTypeKprobe,
208-
Kprobe: &bpfmaniov1alpha1.KprobeProgramInfo{
209-
BpfProgramCommon: bpfmaniov1alpha1.BpfProgramCommon{
210-
BpfFunctionName: "rh_network_events_monitoring",
207+
KProbe: &bpfmaniov1alpha1.ClKprobeProgramInfo{
208+
Links: []bpfmaniov1alpha1.ClKprobeAttachInfo{
209+
{
210+
Function: "rh_psample_sample_packet",
211+
},
211212
},
212-
FunctionName: "rh_psample_sample_packet",
213-
RetProbe: false,
214213
},
215214
},
216215
}...)
217216
}
218217

219218
if helper.IsPktDropEnabled(&fc.Spec.Agent.EBPF) {
220-
bpfApp.Spec.Programs = append(bpfApp.Spec.Programs, []bpfmaniov1alpha1.BpfApplicationProgram{
219+
bpfApp.Spec.Programs = append(bpfApp.Spec.Programs, []bpfmaniov1alpha1.ClBpfApplicationProgram{
221220
{
221+
Name: "kfree_skb",
222222
Type: bpfmaniov1alpha1.ProgTypeTracepoint,
223-
Tracepoint: &bpfmaniov1alpha1.TracepointProgramInfo{
224-
BpfProgramCommon: bpfmaniov1alpha1.BpfProgramCommon{
225-
BpfFunctionName: "kfree_skb",
223+
TracePoint: &bpfmaniov1alpha1.ClTracepointProgramInfo{
224+
Links: []bpfmaniov1alpha1.ClTracepointAttachInfo{
225+
{
226+
Name: "skb/kfree_skb",
227+
},
226228
},
227-
Names: []string{"skb/kfree_skb"},
228229
},
229230
},
230231
}...)
231232
}
232233

233234
if helper.IsPacketTranslationEnabled(&fc.Spec.Agent.EBPF) {
234-
bpfApp.Spec.Programs = append(bpfApp.Spec.Programs, []bpfmaniov1alpha1.BpfApplicationProgram{
235+
bpfApp.Spec.Programs = append(bpfApp.Spec.Programs, []bpfmaniov1alpha1.ClBpfApplicationProgram{
235236
{
237+
Name: "track_nat_manip_pkt",
236238
Type: bpfmaniov1alpha1.ProgTypeKprobe,
237-
Kprobe: &bpfmaniov1alpha1.KprobeProgramInfo{
238-
BpfProgramCommon: bpfmaniov1alpha1.BpfProgramCommon{
239-
BpfFunctionName: "track_nat_manip_pkt",
239+
KProbe: &bpfmaniov1alpha1.ClKprobeProgramInfo{
240+
Links: []bpfmaniov1alpha1.ClKprobeAttachInfo{
241+
{
242+
Function: "nf_nat_manip_pkt",
243+
},
240244
},
241-
FunctionName: "nf_nat_manip_pkt",
242-
RetProbe: false,
243245
},
244246
},
245247
}...)
246248
}
247249
}
248250

249-
func (c *AgentController) deleteBpfApplication(ctx context.Context, bpfApp *bpfmaniov1alpha1.BpfApplication) error {
251+
func (c *AgentController) deleteBpfApplication(ctx context.Context, bpfApp *bpfmaniov1alpha1.ClusterBpfApplication) error {
250252
klog.Info("Deleting BpfApplication Object")
251253
return c.Delete(ctx, bpfApp)
252254
}
253255

254-
func (c *AgentController) createBpfApplication(ctx context.Context, bpfApp *bpfmaniov1alpha1.BpfApplication) error {
256+
func (c *AgentController) createBpfApplication(ctx context.Context, bpfApp *bpfmaniov1alpha1.ClusterBpfApplication) error {
255257
return c.CreateOwned(ctx, bpfApp)
256258
}
257259

258-
func (c *AgentController) updateBpfApplication(ctx context.Context, bpfApp *bpfmaniov1alpha1.BpfApplication) error {
260+
func (c *AgentController) updateBpfApplication(ctx context.Context, bpfApp *bpfmaniov1alpha1.ClusterBpfApplication) error {
259261
return c.UpdateOwned(ctx, bpfApp, bpfApp)
260262
}

‎controllers/ebpf/internal/permissions/permissions.go‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,11 @@ import (
1919
"sigs.k8s.io/controller-runtime/pkg/log"
2020
)
2121

22+
// AllowedCapabilities description of what capabilities netobserv requires when running w/o ebpf manager
23+
// BPF: Allows netobserv to use eBPF programs and maps.
24+
// PERFMON: Allows access to perf monitoring and profiling features.
25+
// NET_ADMIN: required for TC programs to attach/detach to/from qdisc and for TCX hooks.
26+
// SYS_RESOURCE: allows a process to override resource limits and manage system-wide resource usage.
2227
var AllowedCapabilities = []v1.Capability{"BPF", "PERFMON", "NET_ADMIN", "SYS_RESOURCE"}
2328

2429
// Reconciler reconciles the different resources to enable the privileged operation of the
@@ -164,9 +169,13 @@ func (c *Reconciler) reconcileOpenshiftPermissions(
164169
if desired.Privileged {
165170
scc.AllowPrivilegedContainer = true
166171
scc.AllowHostDirVolumePlugin = true
172+
scc.ReadOnlyRootFilesystem = true
167173
} else {
168174
scc.AllowedCapabilities = AllowedCapabilities
169175
}
176+
if helper.IsAgentFeatureEnabled(desired, flowslatest.EbpfManager) {
177+
scc.RequiredDropCapabilities = []v1.Capability{"ALL"}
178+
}
170179
actual := &osv1.SecurityContextConstraints{}
171180
if err := c.Get(ctx, client.ObjectKeyFromObject(scc), actual); err != nil {
172181
if errors.IsNotFound(err) {

‎go.mod‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,8 @@ module github.com/netobserv/network-observability-operator
22

33
go 1.23.0
44

5-
toolchain go1.23.4
6-
75
require (
8-
github.com/bpfman/bpfman-operator v0.5.6
6+
github.com/bpfman/bpfman-operator v0.5.7-0.20250306131041-cd301fcfe248
97
github.com/coreos/go-semver v0.3.1
108
github.com/go-logr/logr v1.4.2
119
github.com/google/go-cmp v0.6.0
@@ -177,3 +175,5 @@ require (
177175
)
178176

179177
replace github.com/prometheus/common => github.com/netobserv/prometheus-common v0.59.1-netobserv
178+
179+
replace github.com/bpfman/bpfman-operator => github.com/msherif1234/bpfman-operator v0.0.0-20250318200857-a55d6df33ba8

‎go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -124,8 +124,6 @@ github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM
124124
github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
125125
github.com/bmizerany/pat v0.0.0-20170815010413-6226ea591a40/go.mod h1:8rLXio+WjiTceGBHIoTvn60HIbs7Hm7bcHjyrSqYB9c=
126126
github.com/boltdb/bolt v1.3.1/go.mod h1:clJnj/oiGkjum5o1McbSZDSLxVThjynRyGBgiAx27Ps=
127-
github.com/bpfman/bpfman-operator v0.5.6 h1:xAqr+lFsyvWOtmCvNEQEvAUmgH5NeVc+TQcdk87cgXw=
128-
github.com/bpfman/bpfman-operator v0.5.6/go.mod h1:J1IKF3ypl2XmuLU+2Iffs7xcUBXs0mGrR0gV6FqUWpE=
129127
github.com/c-bata/go-prompt v0.2.2/go.mod h1:VzqtzE2ksDBcdln8G7mk2RX9QyGjH+OVqOCSiVIqS34=
130128
github.com/casbin/casbin/v2 v2.1.2/go.mod h1:YcPU1XXisHhLzuxH9coDNf2FbKpjGlbCg3n9yuLkIJQ=
131129
github.com/cenk/hub v1.0.1 h1:RBwXNOF4a8KjD8BJ08XqN8KbrqaGiQLDrgvUGJSHuPA=
@@ -679,6 +677,8 @@ github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjY
679677
github.com/montanaflynn/stats v0.0.0-20171201202039-1bf9dbcd8cbe/go.mod h1:wL8QJuTMNUDYhXwkmfOly8iTdp5TEcJFWZD2D7SIkUc=
680678
github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
681679
github.com/mschoch/smat v0.0.0-20160514031455-90eadee771ae/go.mod h1:qAyveg+e4CE+eKJXWVjKXM4ck2QobLqTDytGJbLLhJg=
680+
github.com/msherif1234/bpfman-operator v0.0.0-20250318200857-a55d6df33ba8 h1:TM0A2g9n2T+Skkv5mqJ6snd4DL9y0b11hzlW4Gu8tNg=
681+
github.com/msherif1234/bpfman-operator v0.0.0-20250318200857-a55d6df33ba8/go.mod h1:KS3AJlUDBVwUR/SmnQ5uwmRxkmzE8E740D5xWxh8o9g=
682682
github.com/munnerz/goautoneg v0.0.0-20120707110453-a547fc61f48d/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
683683
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
684684
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=

0 commit comments

Comments
 (0)