Documentation
¶
Index ¶
- Constants
- Variables
- func DecodeQueryEvent(b []byte) (runtimeevent.Event, error)
- type Observer
- func (o *Observer) AddCgids(cgids []uint64) error
- func (o *Observer) Attach(cgroupPath string) (link.Link, error)
- func (o *Observer) Close() error
- func (o *Observer) DeleteCgids(cgids []uint64) error
- func (o *Observer) ReadStats() ([statCount]uint64, error)
- func (o *Observer) Reader() (*ringbuf.Reader, error)
- type Option
- type Source
Constants ¶
const ( // MaxName is the key width shared with the domain interning in // pkg/bpf/egressfilter, so a question this decoder accepts is a question a // policy could have named. MaxName = 128 // EventSize is the minimum number of bytes DecodeQueryEvent needs. EventSize = offName + MaxName // 140 )
Byte layout of `struct dns_query_event` in _cprog/maps.h. Little-endian, in the natural C field order with no internal padding:
off size field
0 8 cgroup_id __u64
8 4 name_len __u32 (offset of whatever follows the name, so it
counts the terminating zero byte)
12 128 name __u8[128] (wire format, lowercased, zero padded)
The kernel never writes the terminating zero: it is the zero padding, which is why the decodable name is name_len-1 bytes long.
const ( StatRingbufFull = 0 StatNameUnreadable = 1 )
Stat indices in the BPF `stats` per-CPU array, mirroring enum dns_query_stat in _cprog/maps.h.
const DefaultStatsInterval = 30 * time.Second
DefaultStatsInterval is how often the kernel-side loss counters are read.
const SourceName = "dnsquery"
SourceName is the name this source reports to the collector. It is also the label used for its drop metrics.
Variables ¶
var ( // ErrTruncated means the kernel handed over fewer bytes than the layout // requires; the Go and C sides disagree, or the record is damaged. ErrTruncated = errors.New("dnsquery: truncated kernel event") // ErrBadName means name_len or the label sequence itself is invalid. ErrBadName = errors.New("dnsquery: malformed question name") )
var ErrNotLoaded = errors.New("dnsquery: bpf objects not loaded")
ErrNotLoaded is returned by map-touching methods on an Observer built without kernel objects.
var StatNames = [statCount]string{ StatRingbufFull: "ringbuf_full", StatNameUnreadable: "name_unreadable", }
StatNames labels each stat index for metrics and logs.
Functions ¶
func DecodeQueryEvent ¶
func DecodeQueryEvent(b []byte) (runtimeevent.Event, error)
DecodeQueryEvent converts one kernel record into a normalized event.
Time is left zero: the record carries no timestamp, so the source stamps it. Count is 1 — every record is exactly one observed question, unlike the poll sources, which aggregate.
Types ¶
type Observer ¶
type Observer struct {
// contains filtered or unexported fields
}
Observer owns the loaded question observer: one program, one ring buffer, and one cgroup-id gate shared by every cgroup it is attached to.
A single instance is deliberate. cgroup_skb programs attach per cgroup, so observing N pods means N links, but sharing one object keeps one ring buffer and one reader goroutine instead of N of each.
func (*Observer) AddCgids ¶
AddCgids admits cgroup ids to the kernel-side gate. A question from a cgroup absent from this map produces no record at all, which is what keeps an unselected pod free of observation cost.
func (*Observer) Attach ¶
Attach hooks the program onto one container cgroup's egress path. The returned link must be closed to detach.
func (*Observer) DeleteCgids ¶
DeleteCgids revokes cgroup ids. A key that is already gone is not an error: pod deletion and policy deletion can both revoke the same cgroup.
type Option ¶
type Option func(*Source)
func WithLossFunc ¶
func WithLossFunc(f runtimeevent.LossFunc) Option
WithLossFunc reports kernel-side loss deltas, normally to a metrics counter.
func WithStatsInterval ¶
WithStatsInterval overrides the loss-counter poll period.
type Source ¶
type Source struct {
// contains filtered or unexported fields
}
Source drains the question ring buffer into the collector.
Source Files