feat: merge socket tracker into redirector #102
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ctrox
force-pushed
the
socket-tracker-activator
branch
16 times, most recently
from
961a7e6 to
55e77e7
Compare
This merges the two bpf programs into one. This has several advantages: * we don't need to match container traffic via PIDs anymore as the activator already runs once per container. So we can just track activity in there. * we no longer need to have a special PID resolver for running in kind. * should be more reliable in general as long-running TCP connections will be tracked more accurately. One disadvantage is that we now do more processing in the hot-path of ingress traffic as we track activity on every packet, not just on every TCP accept. Looking at bpftop the ingress path takes ~1700ns and egress (which is unchanged) ~700ns. But the ingress path was already more expensive before this change as it needs to do the disabled check. There might still be room for optimization here.
ctrox
force-pushed
the
socket-tracker-activator
branch
from
8467820 to
7e6af71
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This merges the two bpf programs into one. This has several advantages:
One disadvantage is that we now do more processing in the hot-path of ingress traffic as we track activity on every packet, not just on every TCP accept. Looking at bpftop the ingress path takes ~1700ns and egress (which is unchanged) ~700ns. But the ingress path was already more expensive before this change as it needs to do the disabled check. There might still be room for optimization here.