tetragon
tetragon copied to clipboard
Refactor policy_filter_maps to use program.Map
Is there an existing issue for this?
- [x] I have searched the existing issues
Is your feature request related to a problem?
No response
Describe the feature you would like
During the discussion on #4331 regarding adding a user-configurable knob for policy_filter_maps size, we identified that policy_filter_maps is implemented as a raw ebpf.Map rather than using Tetragon’s program.Map abstraction. This limits consistency with the rest of the codebase and makes it harder to apply operations such as SetMaxEntries safely and uniformly.
To keep the PR focused on its original scope, @kkourt agreed that the refactoring should happen separately. This issue tracks that work.
Describe your proposed solution
Refactor policy_filter_maps to use program.Map (or a similar consolidated abstraction) instead of a raw ebpf.Map, so that:
- map lifecycle is aligned with how Tetragon manages other BPF maps,
- common map operations (e.g., resizing via
SetMaxEntries) can be applied consistently, - code paths related to initialization and sensor loading become more uniform,
- the loader and policyfilter components can share map-handling utilities.
Code of Conduct
- [x] I agree to follow this project's Code of Conduct