tetragon: Add support to reconfig cgroup rate

Signed-off-by: Jiri Olsa <[email protected]>
cilium · Mar 7, 2024 · 7c42c49 · 7c42c49
1 parent 062c895
commit 7c42c49
Show file tree

Hide file tree

Showing 6 changed files with 93 additions and 0 deletions.
diff --git a/cmd/tetragon/main.go b/cmd/tetragon/main.go
@@ -21,8 +21,10 @@ import (
 	"syscall"
 	"time"
 
+	"github.com/cilium/ebpf"
 	"github.com/cilium/tetragon/api/v1/tetragon"
 	"github.com/cilium/tetragon/pkg/alignchecker"
+	"github.com/cilium/tetragon/pkg/api/tracingapi"
 	"github.com/cilium/tetragon/pkg/bpf"
 	"github.com/cilium/tetragon/pkg/btf"
 	"github.com/cilium/tetragon/pkg/bugtool"
@@ -439,6 +441,22 @@ func tetragonExecute() error {
 
 	onReconfig := func(data *config.Data) {
 		option.Config.DisableKprobeMulti = data.DisableKprobeMulti
+
+		rateMap := base.ExecveCgroupRate
+
+		var err error
+
+		err = rateMap.MapHandle.Update(uint32(tracingapi.CgroupRateConfigExec),
+			data.ExecCgroupRate, ebpf.UpdateAny)
+		if err != nil {
+			log.Infof("failed to update exec cgroup rate in map '%s' : %w", rateMap.Name, err)
+		}
+
+		err = rateMap.MapHandle.Update(uint32(tracingapi.CgroupRateConfigFork),
+			data.ForkCgroupRate, ebpf.UpdateAny)
+		if err != nil {
+			log.Infof("failed to update fork cgroup rate in map '%s' : %w", rateMap.Name, err)
+		}
 	}
 
 	cfg := config.NewConfig(option.Config.ConfigFile, 5*time.Second, onReconfig)

diff --git a/pkg/api/tracingapi/client_kprobe.go b/pkg/api/tracingapi/client_kprobe.go
@@ -591,3 +591,12 @@ type EventConfig struct {
 	PolicyID        uint32                     `align:"policy_id"`
 	Flags           uint32                     `align:"flags"`
 }
+
+const CgroupRateConfigExec = 0
+const CgroupRateConfigFork = 1
+
+type CgroupRate struct {
+	Tokens   uint64
+	Interval uint64
+	Throttle uint64
+}
diff --git a/pkg/config/api.go b/pkg/config/api.go
@@ -10,7 +10,20 @@ type Value struct {
 	Value string `json:"value"`
 }
 
+type CgroupRate struct {
+	// number of tokens
+	Tokens uint64 `json:"tokens,omitempty"`
+	// interval time (ns)
+	Interval uint64 `json:"interval,omitempty"`
+	// throttle time (ns)
+	Throttle uint64 `json:"throttle,omitempty"`
+}
+
 type Spec struct {
 	// A list of values
 	Values []Value `json:"values,omitempty"`
+
+	// cgroup rate data for exec,fork
+	ExecCgroupRate CgroupRate `json:"exec-cgroup-rate,omitempty"`
+	ForkCgroupRate CgroupRate `json:"fork-cgroup-rate,omitempty"`
 }
diff --git a/pkg/config/config.go b/pkg/config/config.go
@@ -6,10 +6,14 @@ package config
 import (
 	"strconv"
 	"time"
+
+	"github.com/cilium/tetragon/pkg/api/tracingapi"
 )
 
 type Data struct {
 	DisableKprobeMulti bool
+	ExecCgroupRate     tracingapi.CgroupRate
+	ForkCgroupRate     tracingapi.CgroupRate
 }
 
 type reconfigCb func(data *Data)
@@ -34,13 +38,28 @@ func (c *Handler) Stop() {
 func (c *Handler) onReload(_ uint64, spec Spec) {
 	data := Data{}
 
+	// name/value config
 	for _, val := range spec.Values {
 		switch val.Name {
 		case "disable-kprobe-multi":
 			data.DisableKprobeMulti, _ = strconv.ParseBool(val.Value)
 		}
 	}
 
+	// exec cgroup rate data
+	data.ExecCgroupRate = tracingapi.CgroupRate{
+		Tokens:   spec.ExecCgroupRate.Tokens,
+		Interval: spec.ExecCgroupRate.Interval,
+		Throttle: spec.ExecCgroupRate.Throttle,
+	}
+
+	// fork cgroup rate data
+	data.ForkCgroupRate = tracingapi.CgroupRate{
+		Tokens:   spec.ForkCgroupRate.Tokens,
+		Interval: spec.ForkCgroupRate.Interval,
+		Throttle: spec.ForkCgroupRate.Throttle,
+	}
+
 	c.onReconfig(&data)
 }
 

diff --git a/pkg/config/config_test.go b/pkg/config/config_test.go
@@ -7,6 +7,7 @@ import (
 	"os"
 	"testing"
 
+	"github.com/cilium/tetragon/pkg/api/tracingapi"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -44,4 +45,36 @@ values:
 		cfg.Stop()
 	})
 
+	t.Run("exec-cgroup-rate", func(t *testing.T) {
+		write(`
+exec-cgroup-rate:
+  tokens: 12345
+  interval: 1000000000
+  throttle: 5000000000
+`)
+
+		reconfig := func(data *Data) {
+			expected := tracingapi.CgroupRate{12345, 1000000000, 5000000000}
+			assert.Equal(t, expected, data.ExecCgroupRate)
+		}
+
+		cfg := NewConfig(file.Name(), 0, reconfig)
+		cfg.Stop()
+	})
+	t.Run("fork-cgroup-rate", func(t *testing.T) {
+		write(`
+fork-cgroup-rate:
+  tokens: 54321
+  interval: 3000000000
+  throttle: 10000000000
+`)
+
+		reconfig := func(data *Data) {
+			expected := tracingapi.CgroupRate{54321, 3000000000, 10000000000}
+			assert.Equal(t, expected, data.ForkCgroupRate)
+		}
+
+		cfg := NewConfig(file.Name(), 0, reconfig)
+		cfg.Stop()
+	})
 }
diff --git a/pkg/sensors/base/base.go b/pkg/sensors/base/base.go
@@ -121,6 +121,7 @@ func GetDefaultMaps() []*program.Map {
 		ExecveStats,
 		ExecveJoinMapStats,
 		ExecveTailCallsMap,
+		ExecveCgroupRate,
 		ForkTailCallsMap,
 		TCPMonMap,
 		TetragonConfMap,