Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

tetragon: persistent monitoring fixes #2795

Merged
merged 2 commits into from
Aug 13, 2024
Merged

tetragon: persistent monitoring fixes #2795

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b8098c3
tetragon: Do not rename old sysfs directory for --release-pinned-bpf …
olsajiri Aug 13, 2024
dfb4de0
tetragon: Warn for --release-pinned-bpf and --keep-sensors-on-exit
olsajiri Aug 13, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 17 additions & 0 deletions cmd/tetragon/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,6 +158,10 @@ func stopProfile() {
}

func getOldBpfDir(path string) (string, error) {
// sysfs directory will be removed, so we don't care
if option.Config.ReleasePinned {
return "", nil
}
if _, err := os.Stat(path); err != nil {
return "", nil
}
Expand Down Expand Up @@ -252,6 +256,12 @@ func tetragonExecute() error {
}

if option.Config.KeepSensorsOnExit {
// The effect of having both --release-pinned-bpf and --keep-sensors-on-exit options
// enabled is that the previous sysfs instance will be removed early before the new
// config is set. Not a big problem, but better to warn..
if option.Config.ReleasePinned {
log.Warn("Options --release-pinned-bpf and --keep-sensors-on-exit enabled together, we will remove sysfs instance early.")
}
log.Info("Not unloading sensors on exit")
}

Expand Down Expand Up @@ -279,6 +289,13 @@ func tetragonExecute() error {
bpf.CheckOrMountCgroup2()
bpf.SetMapPrefix(option.Config.BpfDir)

// We try to detect previous instance, which might be there for legitimate reasons
// (--keep-sensors-on-exit) and rename to 'tetragon_old'.
// Then we do the 'best' effort to keep running sensors as long as possible and remove
// 'tetragon_old' directory when tetragon is started and its policy is loaded.
// If there's --release-pinned-bpf option enabled, we need to remove previous sysfs
// instance right away (see check for option.Config.ReleasePinned below), so we don't
// bother renaming in that case.
oldBpfDir, err := getOldBpfDir(bpf.MapPrefixPath())
if err != nil {
return fmt.Errorf("Failed to move old tetragon base directory: %w", err)
Expand Down
Loading