Skip to content

feat: added ebpf for sysdig agent #133

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 7 commits into from
Jul 10, 2025
Merged

feat: added ebpf for sysdig agent #133

merged 7 commits into from
Jul 10, 2025

Conversation

Vipin654
Copy link
Contributor

@Vipin654 Vipin654 commented Jul 9, 2025

Description

added ebpf for sysdig agent
Issue

Release required?

  • No release
  • Patch release (x.x.X)
  • Minor release (x.X.x)
  • Major release (X.x.x)
Release notes content

Run the pipeline

If the CI pipeline doesn't run when you create the PR, the PR requires a user with GitHub collaborators access to run the pipeline.

Run the CI pipeline when the PR is ready for review and you expect tests to pass. Add a comment to the PR with the following text:

/run pipeline

Checklist for reviewers

  • If relevant, a test for the change is included or updated with this PR.
  • If relevant, documentation for the change is included or updated with this PR.

For mergers

  • Use a conventional commit message to set the release level. Follow the guidelines.
  • Include information that users need to know about the PR in the commit message. The commit message becomes part of the GitHub release notes.
  • Use the Squash and merge option.

@Vipin654 Vipin654 requested review from jor2 and Aashiq-J as code owners July 9, 2025 11:25
@Vipin654
Copy link
Contributor Author

Vipin654 commented Jul 9, 2025

/run pipeline

@Vipin654
Copy link
Contributor Author

Vipin654 commented Jul 9, 2025

/run pipeline

@Vipin654
Copy link
Contributor Author

Vipin654 commented Jul 9, 2025

/run pipeline

- If not available in the machine already, it tries to build it with the kernel headers
- if kernel headers not available, it tries to download it

To fix this, we need the ability to set the helm values `agent.ebpf.enabled` and `agent.ebpf.kind` if cluster is using nodes based on RHCOS by setting the terraform boolean input variable called `enable_universal_ebpf` to true. Enabling universal ebpf needs kernel version to be `5.8` or higher. RHEL8 already has the kernel headers and enabling `ebpf` will not cause any impact even though kernel version is `4.18`.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should be updated to what consumer needs to know. Why and when would a consumer need to change the value of enable_universal_ebpf.
Please give the markdown a title too

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ocofaigh i changed the doc. Can you please review again and suggest if some other change is needed.

Copy link
Contributor

@ocofaigh ocofaigh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

see latest comments

Copy link
Contributor

@ocofaigh ocofaigh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

much better - final minor comments


### Kernel Compatibility

- **RHCOS and RHEL9**: Since kernel version **5.14** is used. Default value for variable has been set to true.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should it say 5.14 or later is used?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As of now 5.14 is used across all ocp versions. But in future versions it can be newer so i will add "or later".

@ocofaigh
Copy link
Contributor

/run pipeline

ocofaigh
ocofaigh previously approved these changes Jul 10, 2025
@Vipin654
Copy link
Contributor Author

/run pipeline

@ocofaigh ocofaigh merged commit 45e11b2 into main Jul 10, 2025
2 checks passed
@ocofaigh ocofaigh deleted the ebpf-enable branch July 10, 2025 14:09
@terraform-ibm-modules-ops
Copy link
Contributor

🎉 This PR is included in version 1.3.0 🎉

The release is available on:

Your semantic-release bot 📦🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants