calico
calico copied to clipboard
BPF rule counters
Description
This PR has changes to increment rule counters.
- Whenever a rule is hit, increment the counters against the 64-bit rule matchID in bpf rule counters map.
- In the bpf endpoint manager, maintain 2 maps. polNameToRuleIDs : policy->set of rules and ruleIdToMatchID: policy->matchID
- Whenever a policy is created, update the polNameToRuleIDs (ruleIDs here are the 16 byte ruleIDs generated by the proto) and also update the ruleId to matchId (64-bit hash)
- When a policy is updated, mark the unused rules as dirty.
- When a policy is deleted, mark all the rules within that policy as dirty.
- Iterate through all the dirty rules and delete from the set as well as from the ruleIdToMatchID map. If the set is empty, delete the entry from the polNameToRuleIDs.
- This PR also has the changes to iterate over a percpu map, dump those maps for use in FV, API to check if a policy is programmed for an interface.
Related issues/PRs
Todos
- [ ] Tests
- [ ] Documentation
- [ ] Release note
Release Note
TBD
Reminder for the reviewer
Make sure that this PR has the correct labels and milestone set.
Every PR needs one docs-* label.
docs-pr-required: This change requires a change to the documentation that has not been completed yet.docs-completed: This change has all necessary documentation completed.docs-not-required: This change has no user-facing impact and requires no docs.
Every PR needs one release-note-* label.
release-note-required: This PR has user-facing changes. Most PRs should have this label.release-note-not-required: This PR has no user-facing changes.
Other optional labels:
cherry-pick-candidate: This PR should be cherry-picked to an earlier release. For bug fixes only.needs-operator-pr: This PR is related to install and requires a corresponding change to the operator.