tetragon icon indicating copy to clipboard operation
tetragon copied to clipboard

Refactor policy_filter_maps to use program.Map

Open kyledong-suse opened this issue 3 weeks ago • 0 comments

Is there an existing issue for this?

  • [x] I have searched the existing issues

Is your feature request related to a problem?

No response

Describe the feature you would like

During the discussion on #4331 regarding adding a user-configurable knob for policy_filter_maps size, we identified that policy_filter_maps is implemented as a raw ebpf.Map rather than using Tetragon’s program.Map abstraction. This limits consistency with the rest of the codebase and makes it harder to apply operations such as SetMaxEntries safely and uniformly.

To keep the PR focused on its original scope, @kkourt agreed that the refactoring should happen separately. This issue tracks that work.

Describe your proposed solution

Refactor policy_filter_maps to use program.Map (or a similar consolidated abstraction) instead of a raw ebpf.Map, so that:

  • map lifecycle is aligned with how Tetragon manages other BPF maps,
  • common map operations (e.g., resizing via SetMaxEntries) can be applied consistently,
  • code paths related to initialization and sensor loading become more uniform,
  • the loader and policyfilter components can share map-handling utilities.

Code of Conduct

  • [x] I agree to follow this project's Code of Conduct

kyledong-suse avatar Dec 03 '25 16:12 kyledong-suse