tetragon
tetragon copied to clipboard
support multiple killer sections in tracing policies.
Currently, there can only be a single killer sensor. Tracing policies that include two killer sections, as well as >1 tracing policies with a killer sensor will be rejected.
There are two ways to address this limitation:
- Have multiple instances of the programs. This would require having a separate instance of the map for the programs.
- Have the different sensors share the programs. There is some infrastructure for doing that (specifically, refcounts in programs [1]), but I'm not sure if it's used and how well tested it is.
[1]:
https://github.com/cilium/tetragon/blob/506677dc9b70f7d87fe23ac4cfcb2e45481e0ee1/pkg/sensors/program/program.go#L84