Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

rthooks fixes #2874

Merged
merged 4 commits into from
Sep 4, 2024
Merged

rthooks fixes #2874

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
2ced3d5
rthooks: deal with .slice and .scope suffixes
kkourt Sep 4, 2024
f7a8c50
update rthooks image to v0.3
kkourt Sep 4, 2024
5ac555b
cgidmap: do not panic if cri is not enabled
kkourt Sep 4, 2024
60986a6
cgidimap: skip warning if cgidmap is disabled
kkourt Sep 4, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions docs/content/en/docs/reference/helm-chart.md
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 2 additions & 2 deletions install/kubernetes/tetragon/README.md
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion install/kubernetes/tetragon/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -394,4 +394,4 @@ rthooks:
image:
override: ~
repository: quay.io/cilium/tetragon-rthooks
tag: v0.2
tag: v0.3
17 changes: 14 additions & 3 deletions pkg/cgidmap/cgidmap.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,6 @@
package cgidmap

import (
"errors"
"sync"

"github.com/cilium/tetragon/pkg/logger"
Expand Down Expand Up @@ -91,6 +90,8 @@ func newMap() (*cgidm, error) {
var criResolver *criResolver
if option.Config.EnableCRI {
criResolver = newCriResolver(m)
} else {
logger.GetLogger().Warn("cgidmap is enabled but cri is not. This means that pod association will not work for existing pods. You can enable cri using --enable-cri")
}
m.criResolver = criResolver
return m, nil
Expand Down Expand Up @@ -234,7 +235,9 @@ func (m *cgidm) Update(podID PodID, contIDs []ContainerID) {
contID: id,
})
}
m.criResolver.enqeue(unmappedIDs)
if m.criResolver != nil {
m.criResolver.enqeue(unmappedIDs)
}
}

// Global state
Expand All @@ -245,12 +248,20 @@ var (
setGlMap sync.Once
)

type cgidDisabledTy struct{}

var cgidDisabled = &cgidDisabledTy{}

func (e *cgidDisabledTy) Error() string {
return "cgidmap disabled"
}

// GetState returns the global map
func GlobalMap() (Map, error) {
setGlMap.Do(func() {
if !option.Config.EnableCgIDmap {
glMap = nil
glError = errors.New("cgidmap disabled")
glError = cgidDisabled
return
}

Expand Down
7 changes: 6 additions & 1 deletion pkg/cgidmap/podhooks.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,8 @@
package cgidmap

import (
"errors"

"github.com/cilium/tetragon/pkg/logger"
"github.com/cilium/tetragon/pkg/podhelpers"
"github.com/cilium/tetragon/pkg/podhooks"
Expand All @@ -26,7 +28,10 @@ func registerPodCallbacks(podInformer cache.SharedIndexInformer) {

m, err := GlobalMap()
if err != nil {
logger.GetLogger().WithError(err).Warn("failed to retrieve cgidmap, not registering rthook")
// if cgidmap is disabled, an error is expected so do not omit a warning
if !errors.Is(err, cgidDisabled) {
logger.GetLogger().WithError(err).Warn("failed to retrieve cgidmap, not registering podhook")
}
return
}

Expand Down
2 changes: 2 additions & 0 deletions pkg/rthooks/args.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,7 @@ func (arg *CreateContainerArg) CgroupID() (uint64, error) {
func podIDFromCgroupPath(p string) string {
podPath := filepath.Dir(p)
podIDstr := filepath.Base(podPath)
podIDstr = strings.TrimSuffix(podIDstr, ".slice")
if len(podIDstr) > uidStringLen {
// remove pod prefix
podIDstr = podIDstr[len(podIDstr)-uidStringLen:]
Expand All @@ -78,6 +79,7 @@ func containerIDFromCgroupPath(p string) string {
if idx := strings.LastIndex(containerID, "-"); idx != -1 {
containerID = containerID[idx+1:]
}
containerID = strings.TrimSuffix(containerID, ".scope")
return containerID
}

Expand Down
6 changes: 6 additions & 0 deletions pkg/rthooks/args_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,9 @@ func TestPodIDFromCgroupPath(t *testing.T) {
}, {
path: "/kubepods/besteffort/pod897277d4-5e6f-4999-a976-b8340e8d075e/crio-a4d6b686848a610472a2eed3ae20d4d64b6b4819feb9fdfc7fd7854deaf59ef3",
id: "897277d4-5e6f-4999-a976-b8340e8d075e",
}, {
path: "/kubepods.slice/kubepods-besteffort.slice/kubepods-besteffort-pod4c9f1974_5c46_44c2_b42f_3bbf0e98eef9.slice/cri-containerd-bacb920470900725e0aa7d914fee5eb0854315448b024b6b8420ad8429c607ba.scope",
id: "4c9f1974_5c46_44c2_b42f_3bbf0e98eef9",
}}

for _, tc := range ts {
Expand All @@ -38,6 +41,9 @@ func TestContainerIDFromCgroupPath(t *testing.T) {
}, {
path: "/kubepods/besteffort/pod897277d4-5e6f-4999-a976-b8340e8d075e/crio-a4d6b686848a610472a2eed3ae20d4d64b6b4819feb9fdfc7fd7854deaf59ef3",
id: "a4d6b686848a610472a2eed3ae20d4d64b6b4819feb9fdfc7fd7854deaf59ef3",
}, {
path: "/kubepods.slice/kubepods-besteffort.slice/kubepods-besteffort-pod4c9f1974_5c46_44c2_b42f_3bbf0e98eef9.slice/cri-containerd-bacb920470900725e0aa7d914fee5eb0854315448b024b6b8420ad8429c607ba.scope",
id: "bacb920470900725e0aa7d914fee5eb0854315448b024b6b8420ad8429c607ba",
}}

for _, tc := range ts {
Expand Down
Loading