tetragon icon indicating copy to clipboard operation
tetragon copied to clipboard

support multiple killer sections in tracing policies.

Open kkourt opened this issue 2 years ago • 0 comments

Currently, there can only be a single killer sensor. Tracing policies that include two killer sections, as well as >1 tracing policies with a killer sensor will be rejected.

There are two ways to address this limitation:

  • Have multiple instances of the programs. This would require having a separate instance of the map for the programs.
  • Have the different sensors share the programs. There is some infrastructure for doing that (specifically, refcounts in programs [1]), but I'm not sure if it's used and how well tested it is.

[1]:

https://github.com/cilium/tetragon/blob/506677dc9b70f7d87fe23ac4cfcb2e45481e0ee1/pkg/sensors/program/program.go#L84

kkourt avatar Dec 13 '23 09:12 kkourt