eventcache

Documentation

Index

• Constants
• Variables
• func HandleGenericEvent(internal *process.ProcessInternal, ev notify.Event) error
• func HandleGenericInternal(ev notify.Event, pid uint32, timestamp uint64) (*process.ProcessInternal, error)
• type Cache
  • func Get() *Cache
  • func New(s *server.Server) *Cache
  • func NewWithTimer(s *server.Server, dur time.Duration) *Cache
  • func (ec *Cache) Add(internal *process.ProcessInternal, e notify.Event, t uint64, s uint64, ...)
  • func (ec *Cache) Needed(proc *tetragon.Process) bool
• type CacheObj

Constants

const (
	// garbage collection retries
	CacheStrikes = 15
	// garbage collection run interval
	EventRetryTimer = time.Second * 2
)

Variables

var (
	ErrFailedToGetPodInfo     = errors.New("failed to get pod info")
	ErrFailedToGetProcessInfo = errors.New("failed to get process info")
	ErrFailedToGetParentInfo  = errors.New("failed to get parent info")
)

Functions

func HandleGenericEvent

func HandleGenericEvent(internal *process.ProcessInternal, ev notify.Event) error

Generic Event handler without any extra msg specific details or debugging so we only need to wait for the internal link to the process context to resolve PodInfo. This happens when the msg populates the internal state but that event is not fully populated yet.

func HandleGenericInternal

func HandleGenericInternal(ev notify.Event, pid uint32, timestamp uint64) (*process.ProcessInternal, error)

Generic internal lookup happens when events are received out of order and this event was handled before an exec event so it wasn't able to populate the process info yet.

Types

type Cache

type Cache struct {
	// contains filtered or unexported fields
}

func Get

func Get() *Cache

func New

func New(s *server.Server) *Cache

func NewWithTimer

func NewWithTimer(s *server.Server, dur time.Duration) *Cache

func (*Cache) Add

func (ec *Cache) Add(internal *process.ProcessInternal,
	e notify.Event,
	t uint64,
	s uint64,
	msg notify.Message)

func (*Cache) Needed

func (ec *Cache) Needed(proc *tetragon.Process) bool

We handle two race conditions here one where the event races with a Tetragon execve event and the other -- much more common -- where we race with K8s watcher case 1 (execve race):

Its possible to receive this Tetragon event before the process event cache
has been populated with a Tetragon execve event. In this case we need to
cache the event until the process cache is populated.

case 2 (k8s watcher race):

Its possible to receive an event before the k8s watcher receives the
podInfo event and populates the local cache. If we expect podInfo,
indicated by having a nonZero dockerID we cache the event until the
podInfo arrives.

type CacheObj

type CacheObj struct {
	// contains filtered or unexported fields
}