-
Notifications
You must be signed in to change notification settings - Fork 31
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
NETOBSERV-1129: Add kernel version chk to disable hooks not supported on older version #144
NETOBSERV-1129: Add kernel version chk to disable hooks not supported on older version #144
Conversation
@msherif1234: This pull request references NETOBSERV-1129 which is a valid jira issue. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
Codecov Report
@@ Coverage Diff @@
## main #144 +/- ##
==========================================
- Coverage 40.11% 39.00% -1.11%
==========================================
Files 31 31
Lines 2124 2238 +114
==========================================
+ Hits 852 873 +21
- Misses 1227 1314 +87
- Partials 45 51 +6
Flags with carried forward coverage won't be shown. Click here to find out more.
|
pkg/agent/agent.go
Outdated
TCPDrops: cfg.EnableTCPDrops, | ||
DNSTracker: cfg.EnableDNSTracking, | ||
EnableRTT: cfg.EnableRTT, | ||
SupportOldKernel: cfg.SupportOldKernel, |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Actually, the agent could determine that on its own, without requiring a configuration?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
kernel versions upstream and downstream don't align that will make it hard for me to check on special kernel for example ocp latest showing
5.14.0-284.20.1.el9_2.aarch64
while skb_free is actually in 5.17 upstream
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
somewhere in comments you wrote: For older kernel (< 5.17) kfree_sbk drop hook doesn't exists
so couldn't we just pick the kernel version and compare with 5.17 ?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
e.g. using coreos' https://github.com/coreos/go-semver
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I understood but rhel9 has 5.14 and its supported there, my point is rhel 5.14 isn't the same as fc 5.14 I assume it has contents from newer kernel too so I used 5.14 as base for my check
Code LGTM, maybe it can be improved by having the agent find the kernel version and determine itself if it must run without some hooks; this way we won't even have to worry about that on the operator side. It must be tested with several ocp versions (ideally, all supported) - I can try some tomorrow... |
The userspace side of code can potentially run some command to find out kernel version if needed but would we wanna disable it at runtime or fail to run if older kernel is detected but config is set to enable all hooks. I am asking this because certain nodes of a cluster can have older kernel and in that case agent disabling some feature without informing might be a problem for some users. |
@msherif1234: This pull request references NETOBSERV-1129 which is a valid jira issue. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
w/o doing anything the code as it stands will fail on older releases < 4.13 so the ask was to avoid failing on older release and I displayed warning plus in our doc we state clearly the kernel dependency so users will be aware |
/ok-to-test |
New image: quay.io/netobserv/netobserv-ebpf-agent:fd08b88. It will expire after two weeks. |
/ok-to-test |
New image: quay.io/netobserv/netobserv-ebpf-agent:ffe1789. It will expire after two weeks. |
@msherif1234: This pull request references NETOBSERV-1129 which is a valid jira issue. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
Tested on 4.10 and works like a charm! |
Signed-off-by: msherif1234 <mmahmoud@redhat.com>
Tested on OCP 4.14 $ oc get co
NAME VERSION AVAILABLE PROGRESSING DEGRADED SINCE MESSAGE
authentication 4.14.0-0.nightly-2023-07-05-191022 True False False 4m10s
$ oc exec -i -n default dbgtools-deployment-5c8c449466-p2kgf -- bpftool perf show
pid 17628 fd 7: prog_id 4 tracepoint kfree_skb |
@msherif1234: This pull request references NETOBSERV-1129 which is a valid jira issue. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
/lgtm |
/approve |
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: msherif1234 The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
TCPDrop hook doesn't exists on older kernelwe check for the following version and ignore tcpdrop for any older versions
$ oc get co NAME VERSION AVAILABLE PROGRESSING DEGRADED SINCE MESSAGE authentication 4.13.0-0.nightly-2023-06-20-224158 True False False 31m $ oc exec -i -n default dbgtools-deployment-85dff5ff6-92242 -- bpftool perf show pid 46120 fd 8: prog_id 4 tracepoint kfree_skb