filters

Documentation

Index

• Variables
• func BuildFilter(ctx context.Context, ff *tetragon.Filter, filterFuncs []OnBuildFilter) (hubbleFilters.FilterFuncs, error)
• func BuildFilterList(ctx context.Context, ff []*tetragon.Filter, filterFuncs []OnBuildFilter) (hubbleFilters.FilterFuncs, error)
• func FilterByLabelSelectors(labelSelectors []string) (hubbleFilters.FilterFunc, error)
• func GetParent(event *v1.Event) *tetragon.Process
• func GetProcess(event *v1.Event) *tetragon.Process
• func MaybeExecProbe(binary string, args string, execProbe []string) bool
• func ParseFieldFilterList(filters string) ([]*tetragon.FieldFilter, error)
• func ParseFilterList(filters string, enablePidSetFilters bool) ([]*tetragon.Filter, error)
• type ArgumentsRegexFilter
  • func (f *ArgumentsRegexFilter) OnBuildFilter(_ context.Context, ff *tetragon.Filter) ([]hubbleFilters.FilterFunc, error)
• type BinaryRegexFilter
  • func (f *BinaryRegexFilter) OnBuildFilter(_ context.Context, ff *tetragon.Filter) ([]hubbleFilters.FilterFunc, error)
• type ChildCache
• type EventTypeFilter
  • func (f *EventTypeFilter) OnBuildFilter(_ context.Context, ff *tetragon.Filter) ([]hubbleFilters.FilterFunc, error)
• type FieldFilter
  • func FieldFilterFromProto(filter *tetragon.FieldFilter) *FieldFilter
  • func FieldFiltersFromGetEventsRequest(request *tetragon.GetEventsRequest) []*FieldFilter
  • func NewExcludeFieldFilter(eventSet []tetragon.EventType, fields []string, invertEventSet bool) *FieldFilter
  • func NewFieldFilter(eventSet []tetragon.EventType, fields []string, ...) *FieldFilter
  • func NewIncludeFieldFilter(eventSet []tetragon.EventType, fields []string, invertEventSet bool) *FieldFilter
  • func (f *FieldFilter) Filter(event *tetragon.GetEventsResponse) error
• type HealthCheckFilter
  • func (f *HealthCheckFilter) OnBuildFilter(_ context.Context, ff *tetragon.Filter) ([]hubbleFilters.FilterFunc, error)
• type LabelsFilter
  • func (l *LabelsFilter) OnBuildFilter(_ context.Context, filter *tetragon.Filter) ([]hubbleFilters.FilterFunc, error)
• type NamespaceFilter
  • func (f *NamespaceFilter) OnBuildFilter(_ context.Context, ff *tetragon.Filter) ([]hubbleFilters.FilterFunc, error)
• type OnBuildFilter
• type OnBuildFilterFunc
  • func (f OnBuildFilterFunc) OnBuildFilter(ctx context.Context, tetragonFilter *tetragon.Filter) ([]hubbleFilters.FilterFunc, error)
• type PidFilter
  • func (f *PidFilter) OnBuildFilter(_ context.Context, ff *tetragon.Filter) ([]hubbleFilters.FilterFunc, error)
• type PidSetFilter
  • func (f *PidSetFilter) OnBuildFilter(_ context.Context, ff *tetragon.Filter) ([]hubbleFilters.FilterFunc, error)
• type PodRegexFilter
  • func (f *PodRegexFilter) OnBuildFilter(_ context.Context, ff *tetragon.Filter) ([]hubbleFilters.FilterFunc, error)

Variables

var Filters = []OnBuildFilter{
	&BinaryRegexFilter{},
	&HealthCheckFilter{},
	&NamespaceFilter{},
	&PidFilter{},
	&PidSetFilter{},
	&EventTypeFilter{},
	&ArgumentsRegexFilter{},
	&LabelsFilter{},
	&PodRegexFilter{},
}

Filters is the list of default filters

Functions

func BuildFilter

func BuildFilter(ctx context.Context, ff *tetragon.Filter, filterFuncs []OnBuildFilter) (hubbleFilters.FilterFuncs, error)

func BuildFilterList

func BuildFilterList(ctx context.Context, ff []*tetragon.Filter, filterFuncs []OnBuildFilter) (hubbleFilters.FilterFuncs, error)

func FilterByLabelSelectors

func FilterByLabelSelectors(labelSelectors []string) (hubbleFilters.FilterFunc, error)

FilterByLabelSelectors returns a FilterFunc. The FilterFunc returns true if and only if any of the specified selectors select the event. The caller specifies how to extract labels from the event.

func GetParent

func GetParent(event *v1.Event) *tetragon.Process

func GetProcess

func GetProcess(event *v1.Event) *tetragon.Process

func MaybeExecProbe

func MaybeExecProbe(binary string, args string, execProbe []string) bool

func ParseFieldFilterList

func ParseFieldFilterList(filters string) ([]*tetragon.FieldFilter, error)

func ParseFilterList

func ParseFilterList(filters string, enablePidSetFilters bool) ([]*tetragon.Filter, error)

ParseFilterList parses a list of process filters in JSON format into protobuf messages.

Types

type ArgumentsRegexFilter

type ArgumentsRegexFilter struct{}

func (*ArgumentsRegexFilter) OnBuildFilter

func (f *ArgumentsRegexFilter) OnBuildFilter(_ context.Context, ff *tetragon.Filter) ([]hubbleFilters.FilterFunc, error)

type BinaryRegexFilter

type BinaryRegexFilter struct{}

func (*BinaryRegexFilter) OnBuildFilter

func (f *BinaryRegexFilter) OnBuildFilter(_ context.Context, ff *tetragon.Filter) ([]hubbleFilters.FilterFunc, error)

type ChildCache

type ChildCache = map[uint32]struct{}

We could use an LRU here but we really don't want to evict old entries and risk failing a test that uses this filter. Instead, we take the safer approach from the perspective of testing and opt to grow the map indefinitely and log a warning if the size exceeeds a pre-determined threshold. Since we have protections in place to prevent this filter being used in production, this should be acceptable.

type EventTypeFilter

type EventTypeFilter struct{}

func (*EventTypeFilter) OnBuildFilter

func (f *EventTypeFilter) OnBuildFilter(_ context.Context, ff *tetragon.Filter) ([]hubbleFilters.FilterFunc, error)

type FieldFilter

type FieldFilter struct {
	// contains filtered or unexported fields
}

FieldFilter is a helper for filtering fields in events

func FieldFilterFromProto

func FieldFilterFromProto(filter *tetragon.FieldFilter) *FieldFilter

FieldFilterFromProto constructs a new FieldFilter from a Tetragon API field filter.

func FieldFiltersFromGetEventsRequest

func FieldFiltersFromGetEventsRequest(request *tetragon.GetEventsRequest) []*FieldFilter

FieldFiltersFromGetEventsRequest returns a list of EventFieldFilter for a GetEventsRequest.

func NewExcludeFieldFilter

func NewExcludeFieldFilter(eventSet []tetragon.EventType, fields []string, invertEventSet bool) *FieldFilter

NewExcludeFieldFilter constructs a new exclusion FieldFilter from a set of fields.

func NewFieldFilter

func NewFieldFilter(eventSet []tetragon.EventType, fields []string, action tetragon.FieldFilterAction, invertEventSet bool) *FieldFilter

NewFieldFilter constructs a new FieldFilter from a set of fields.

func NewIncludeFieldFilter

func NewIncludeFieldFilter(eventSet []tetragon.EventType, fields []string, invertEventSet bool) *FieldFilter

NewIncludeFieldFilter constructs a new inclusion FieldFilter from a set of fields.

func (*FieldFilter) Filter

func (f *FieldFilter) Filter(event *tetragon.GetEventsResponse) error

Filter filters the fields in the GetEventsResponse, keeping fields specified in the inclusion filter and discarding fields specified in the exclusion filter. Exclusion takes precedence over inclusion and an empty filter set will keep all remaining fields.

type HealthCheckFilter

type HealthCheckFilter struct{}

func (*HealthCheckFilter) OnBuildFilter

func (f *HealthCheckFilter) OnBuildFilter(_ context.Context, ff *tetragon.Filter) ([]hubbleFilters.FilterFunc, error)

type LabelsFilter

type LabelsFilter struct{}

LabelsFilter implements filtering based on pod labels

func (*LabelsFilter) OnBuildFilter

func (l *LabelsFilter) OnBuildFilter(_ context.Context, filter *tetragon.Filter) ([]hubbleFilters.FilterFunc, error)

OnBuildFilter builds a labels filter

type NamespaceFilter

type NamespaceFilter struct{}

func (*NamespaceFilter) OnBuildFilter

func (f *NamespaceFilter) OnBuildFilter(_ context.Context, ff *tetragon.Filter) ([]hubbleFilters.FilterFunc, error)

type OnBuildFilter

type OnBuildFilter interface {
	OnBuildFilter(context.Context, *tetragon.Filter) ([]hubbleFilters.FilterFunc, error)
}

OnBuildFilter is invoked while building a flow filter

type OnBuildFilterFunc

type OnBuildFilterFunc func(context.Context, *tetragon.Filter) ([]hubbleFilters.FilterFunc, error)

OnBuildFilterFunc implements OnBuildFilter for a single function

func (OnBuildFilterFunc) OnBuildFilter

func (f OnBuildFilterFunc) OnBuildFilter(ctx context.Context, tetragonFilter *tetragon.Filter) ([]hubbleFilters.FilterFunc, error)

OnBuildFilter is invoked while building a flow filter

type PidFilter

type PidFilter struct{}

func (*PidFilter) OnBuildFilter

func (f *PidFilter) OnBuildFilter(_ context.Context, ff *tetragon.Filter) ([]hubbleFilters.FilterFunc, error)

type PidSetFilter

type PidSetFilter struct{}

PidSetFilter is a filter that matches on a process and all of its children by their PID, up to maxChildCacheSize number of children.

func (*PidSetFilter) OnBuildFilter

func (f *PidSetFilter) OnBuildFilter(_ context.Context, ff *tetragon.Filter) ([]hubbleFilters.FilterFunc, error)

type PodRegexFilter

type PodRegexFilter struct{}

func (*PodRegexFilter) OnBuildFilter

func (f *PodRegexFilter) OnBuildFilter(_ context.Context, ff *tetragon.Filter) ([]hubbleFilters.FilterFunc, error)