pkg/option: allow policy-filter-map-entries configurable via flag #4331

kyledong-suse · 2025-11-11T16:55:46Z

Description

This commit introduces a new flag to configure the number of entries in policy filter maps. This allows users to tune the map size based on workload scale and system resources, improving flexibility in policy handling.

Note: this commit only affects policies with k8s segmentation primitives (i.e., either podSelectors or namespaced policies).

Fixes: #4260

netlify · 2025-11-11T16:56:34Z

✅ Deploy Preview for tetragon ready!

Name	Link
🔨 Latest commit	`7475a97`
🔍 Latest deploy log	https://app.netlify.com/projects/tetragon/deploys/69136d5a6f473c0008bcfaf1
😎 Deploy Preview	https://deploy-preview-4331--tetragon.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

This commit introduces a new flag to configure the number of entries in policy filter maps. This allows users to tune the map size based on workload scale and system resources, improving flexibility in policy handling. Note: this commit only affects policies with k8s segmentation primitives (i.e., either podSelectors or namespaced policies). Fixes: cilium#4260 Signed-off-by: Kyle Dong <[email protected]>

kyledong-suse · 2025-11-12T23:47:18Z

@mtardy and @kkourt, would you please review this PR when you get a chance. Thanks!

mtardy

Thanks for the patch, I think it's the right direction and a good idea, just need a few changes in how it's done :)

mtardy · 2025-11-20T18:13:28Z

bpf/process/policy_filter.h

 struct {
 	__uint(type, BPF_MAP_TYPE_HASH_OF_MAPS);
-	__uint(max_entries, POLICY_FILTER_MAX_POLICIES);
+	__uint(max_entries, 1); // will be resized by agent when needed


This is used by policy_filter_cgroup_maps just nearby. Maybe we would need to update both and remove that const?

Sure, I think it makes sense to me. I'll update both of them and remove that const.

mtardy · 2025-11-20T18:16:47Z

pkg/sensors/program/loader_linux.go

+	// Set MaxEntries for policy_filter_maps if it exists in the spec.
+	// This ensures the spec matches the user-defined value.
+	if ms, ok := spec.Maps["policy_filter_maps"]; ok {
+		ms.MaxEntries = uint32(option.Config.PolicyFilterMapEntries)
+	}
+


ah yes already have a facility to do that higher level in the loader (it's just above your new code btw), please use the SetMaxEntries on the map itself directly, you need to have the map handle.

I was thinking to reuse SetMaxEntries. However, after digging into the code, I had the following findings:

policy_filter_maps is not a program.Map.

policy_filter_maps is created as raw ebpf.Map in newPfMap(), which is called during policyfilter.New()

policyfilter.GetState() is called in StartSensorManager(), which happens before sensors load.

So your suggestion is to refactor policy_filter_maps from ebpf.Map to program.Map? Also need to refactor this PfMap struct.

Let's ask since we can before investing time in this :)!

Hey @tpapagian and @kkourt, I see you are the one you touched this code, any reason why you didn't use program.Map in the first place?

Not reason I remember. Is the idea be to make the map a part of the base/exec sensor?

IMO, I think it makes sense to add policy_filter_maps to base sensor (similar to execve_map).

mtardy · 2025-11-20T18:17:01Z

pkg/policyfilter/map.go

+	if _, ok := spec.Maps["policy_filter_maps"]; ok {
+		spec.Maps["policy_filter_maps"].MaxEntries = uint32(option.Config.PolicyFilterMapEntries)
+	}


see other comment about using SetMaxEntries, you should see example by grepping

mtardy · 2025-11-20T18:17:46Z

pkg/policyfilter/map.go

 		if ret.cgroupMap, err = openMap(spec, CgroupMapName, polMaxPolicies); err != nil {
 			releaseMap(ret.policyMap)
-			return PfMap{}, fmt.Errorf("opening cgroup map %s failed: %w", MapName, err)
+			return PfMap{}, fmt.Errorf("opening cgroup map %s failed: %w", CgroupMapName, err)


maybe this could be part of another commit fixing this typo?

Sure, I'll remove the typo fix from this commit.
Do you like another commit to fix this typo in the same PR or a separate PR?

same PR is fine :)

mtardy · 2025-11-20T18:19:35Z

pkg/option/flags.go


 	flags.Int(KeyRetprobesCacheSize, defaults.DefaultRetprobesCacheSize, "Set {k,u}retprobes events cache maximum size")
+
+	flags.Int(KeyPolicyFilterMapEntries, defaults.DefaultPolicyFilterMapEntries, "Set entries for policy_filter_map table (default 128)")


could you be a little bit more explicit in the help what this map is for and why changing its size would matter (why you want to increase or decrease its size). Succinct is still better than extra verbose, but out of context on the map, it's not clear why this matters with this help (at least for me :)).

WDYT about this one?
"Set maximum number of policies in policy_filter_maps (default 128). This map restricts tracing policies to specific pods/containers. Increase if you have many policies, decrease to save memory if you have few policies."

yep it's a nice suggestion! Don't need to repeat the default as cobra should display it in the help.

kyledong-suse requested a review from a team as a code owner November 11, 2025 16:55

kyledong-suse requested a review from FedeDP November 11, 2025 16:55

kyledong-suse force-pushed the pr/kyledong-suse/allow-configuring-policy-filter-map-size branch from db01b6c to 7475a97 Compare November 11, 2025 17:07

kyledong-suse force-pushed the pr/kyledong-suse/allow-configuring-policy-filter-map-size branch from 7475a97 to 444c976 Compare November 11, 2025 18:23

mtardy requested review from kkourt and mtardy November 20, 2025 18:13

mtardy requested changes Nov 20, 2025

View reviewed changes

kkourt added the release-note/minor This PR introduces a minor user-visible change label Nov 21, 2025


		flags.Int(KeyRetprobesCacheSize, defaults.DefaultRetprobesCacheSize, "Set {k,u}retprobes events cache maximum size")

		flags.Int(KeyPolicyFilterMapEntries, defaults.DefaultPolicyFilterMapEntries, "Set entries for policy_filter_map table (default 128)")

pkg/option: allow policy-filter-map-entries configurable via flag #4331

Are you sure you want to change the base?

pkg/option: allow policy-filter-map-entries configurable via flag #4331

Conversation

kyledong-suse commented Nov 11, 2025

Description

Uh oh!

netlify bot commented Nov 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for tetragon ready!

Uh oh!

kyledong-suse commented Nov 12, 2025

Uh oh!

mtardy left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kyledong-suse Nov 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

netlify bot commented Nov 11, 2025 •

edited

Loading

kyledong-suse Nov 21, 2025 •

edited

Loading