programs

Documentation

Overview

Package programs provides the base implementation for eBPF programs.

Package manager provides program management functionality.

Index

• Constants
• type BaseProgram
  • func NewBaseProgram(name, description, objectPath string) *BaseProgram
  • func (p *BaseProgram) AddLink(l link.Link)
  • func (p *BaseProgram) AttachToTracepoint(progName, group, name string) error
  • func (p *BaseProgram) Description() string
  • func (p *BaseProgram) Detach(ctx context.Context) error
  • func (p *BaseProgram) EventStream() core.EventStream
  • func (p *BaseProgram) GetCollection() *ebpf.Collection
  • func (p *BaseProgram) GetStats() (totalEvents, droppedEvents uint64, dropRate float64)
  • func (p *BaseProgram) IsAttached() bool
  • func (p *BaseProgram) IsLoaded() bool
  • func (p *BaseProgram) Load(ctx context.Context) error
  • func (p *BaseProgram) Name() string
  • func (p *BaseProgram) StartRingBufferReader(mapName string, parser core.EventParser) error
• type Manager
  • func NewManager() *Manager
  • func (m *Manager) AttachAll(ctx context.Context) error
  • func (m *Manager) DetachAll(ctx context.Context) error
  • func (m *Manager) EventStream() core.EventStream
  • func (m *Manager) GetProgramStatus() []core.ProgramStatus
  • func (m *Manager) IsRunning() bool
  • func (m *Manager) LoadAll(ctx context.Context) error
  • func (m *Manager) Programs() []core.Program
  • func (m *Manager) RegisterProgram(program core.Program) error

Constants

const (
	// AlertThreshold: Alert when drop rate exceeds 1% over a window
	DropRateAlertThreshold = 0.01
	// Alert interval: Don't spam alerts more than once per minute
	AlertCooldownDuration = time.Minute
	// Event window for calculating drop rate
	DropRateWindowSize = 1000
)

Constants for backpressure handling

Types

type BaseProgram

type BaseProgram struct {
	// contains filtered or unexported fields
}

BaseProgram provides common functionality for eBPF programs.

func NewBaseProgram

func NewBaseProgram(name, description, objectPath string) *BaseProgram

NewBaseProgram creates a new base program.

func (*BaseProgram) AddLink

func (p *BaseProgram) AddLink(l link.Link)

AddLink adds a link to track (for subclasses).

func (*BaseProgram) AttachToTracepoint

func (p *BaseProgram) AttachToTracepoint(progName, group, name string) error

AttachToTracepoint attaches a program to a tracepoint.

func (*BaseProgram) Description

func (p *BaseProgram) Description() string

Description returns the program description.

func (*BaseProgram) Detach

func (p *BaseProgram) Detach(ctx context.Context) error

Detach detaches the program from all kernel hooks.

func (*BaseProgram) EventStream

func (p *BaseProgram) EventStream() core.EventStream

EventStream returns the program's event stream.

func (*BaseProgram) GetCollection

func (p *BaseProgram) GetCollection() *ebpf.Collection

GetCollection returns the eBPF collection (for subclasses).

func (*BaseProgram) GetStats

func (p *BaseProgram) GetStats() (totalEvents, droppedEvents uint64, dropRate float64)

GetStats returns event processing statistics.

func (*BaseProgram) IsAttached

func (p *BaseProgram) IsAttached() bool

IsAttached returns true if the program is attached.

func (*BaseProgram) IsLoaded

func (p *BaseProgram) IsLoaded() bool

IsLoaded returns true if the program is loaded.

func (*BaseProgram) Load

func (p *BaseProgram) Load(ctx context.Context) error

Load compiles and loads the eBPF program.

func (*BaseProgram) Name

func (p *BaseProgram) Name() string

Name returns the program name.

func (*BaseProgram) StartRingBufferReader

func (p *BaseProgram) StartRingBufferReader(mapName string, parser core.EventParser) error

StartRingBufferReader starts reading from a ring buffer map and parsing events.

type Manager

type Manager struct {
	// contains filtered or unexported fields
}

Manager orchestrates multiple eBPF programs.

func NewManager

func NewManager() *Manager

NewManager creates a new program manager.

func (*Manager) AttachAll

func (m *Manager) AttachAll(ctx context.Context) error

AttachAll attaches all loaded programs.

func (*Manager) DetachAll

func (m *Manager) DetachAll(ctx context.Context) error

DetachAll detaches all programs.

func (*Manager) EventStream

func (m *Manager) EventStream() core.EventStream

EventStream returns the unified event stream.

func (*Manager) GetProgramStatus

func (m *Manager) GetProgramStatus() []core.ProgramStatus

GetProgramStatus returns the status of all programs.

func (*Manager) IsRunning

func (m *Manager) IsRunning() bool

IsRunning returns true if the manager is active.

func (*Manager) LoadAll

func (m *Manager) LoadAll(ctx context.Context) error

LoadAll loads all registered programs.

func (*Manager) Programs

func (m *Manager) Programs() []core.Program

Programs returns all registered programs.

func (*Manager) RegisterProgram

func (m *Manager) RegisterProgram(program core.Program) error

RegisterProgram adds a program to the manager.