discover

Documentation

Index

• Constants
• func BuildPinPath(cfg *pipe.Config) string
• func ContainerDBUpdaterProvider(cn *ContainerDBUpdater) (node.MiddleFunc[[]Event[Instrumentable], []Event[Instrumentable]], error)
• func CriteriaMatcherProvider(cm CriteriaMatcher) (node.MiddleFunc[[]Event[processAttrs], []Event[ProcessMatch]], error)
• func ExecTyperProvider(ecfg ExecTyper) (node.MiddleFunc[[]Event[ProcessMatch], []Event[Instrumentable]], error)
• func FindingCriteria(cfg *pipe.Config) services.DefinitionCriteria
• func ProcessWatcherProvider(w ProcessWatcher) (node.StartFunc[[]Event[processAttrs]], error)
• func TraceAttacherProvider(ta TraceAttacher) (node.TerminalFunc[[]Event[Instrumentable]], error)
• func WatcherKubeEnricherProvider(wk *WatcherKubeEnricher) (node.MiddleFunc[[]Event[processAttrs], []Event[processAttrs]], error)
• type ContainerDBUpdater
• type CriteriaMatcher
• type Event
• type ExecTyper
• type Instrumentable
• type PID
• type ProcessFinder
  • func NewProcessFinder(ctx context.Context, cfg *pipe.Config, ctxInfo *global.ContextInfo) *ProcessFinder
  • func (pf *ProcessFinder) Start(cfg *pipe.Config) (<-chan *ebpf.ProcessTracer, <-chan *Instrumentable, error)
• type ProcessMatch
• type ProcessWatcher
• type TraceAttacher
• type WatchEventType
• type WatcherKubeEnricher

Constants

const (
	EventCreated = WatchEventType(iota)
	EventDeleted
)

Functions

func BuildPinPath

func BuildPinPath(cfg *pipe.Config) string

pinpath must be unique for a given executable group it will be:

• current beyla PID

func ContainerDBUpdaterProvider

func ContainerDBUpdaterProvider(cn *ContainerDBUpdater) (node.MiddleFunc[[]Event[Instrumentable], []Event[Instrumentable]], error)

func CriteriaMatcherProvider

func CriteriaMatcherProvider(cm CriteriaMatcher) (node.MiddleFunc[[]Event[processAttrs], []Event[ProcessMatch]], error)

func ExecTyperProvider

func ExecTyperProvider(ecfg ExecTyper) (node.MiddleFunc[[]Event[ProcessMatch], []Event[Instrumentable]], error)

func FindingCriteria

func FindingCriteria(cfg *pipe.Config) services.DefinitionCriteria

func ProcessWatcherProvider

func ProcessWatcherProvider(w ProcessWatcher) (node.StartFunc[[]Event[processAttrs]], error)

func TraceAttacherProvider

func TraceAttacherProvider(ta TraceAttacher) (node.TerminalFunc[[]Event[Instrumentable]], error)

func WatcherKubeEnricherProvider

func WatcherKubeEnricherProvider(wk *WatcherKubeEnricher) (node.MiddleFunc[[]Event[processAttrs], []Event[processAttrs]], error)

Types

type ContainerDBUpdater

type ContainerDBUpdater struct {
	DB *kube.Database
}

ContainerDBUpdater is a stage in the Process Finder pipeline that will be enabled only if Kubernetes decoration is enabled. It just updates part of the kubernetes database when a new process is discovered.

type CriteriaMatcher

type CriteriaMatcher struct {
	Cfg *pipe.Config
}

CriteriaMatcher filters the processes that match the discovery criteria.

type Event

type Event[T any] struct {
	Type WatchEventType
	Obj  T
}

type ExecTyper

type ExecTyper struct {
	Cfg     *pipe.Config
	Metrics imetrics.Reporter
}

ExecTyper classifies the discovered executables according to the executable type (Go, generic...), and filters these executables that are not instrumentable.

type Instrumentable

type Instrumentable struct {
	Type                 svc.InstrumentableType
	InstrumentationError error

	// in some runtimes, like python gunicorn, we need to allow
	// tracing both the parent pid and all of its children pid
	ChildPids []uint32

	FileInfo *exec.FileInfo
	Offsets  *goexec.Offsets
}

type PID

type PID int32

type ProcessFinder

type ProcessFinder struct {
	ProcessWatcher       `sendTo:"WatcherKubeEnricher"`
	*WatcherKubeEnricher `forwardTo:"CriteriaMatcher"`
	CriteriaMatcher      `sendTo:"ExecTyper"`
	ExecTyper            `sendTo:"ContainerDBUpdater"`
	*ContainerDBUpdater  `forwardTo:"TraceAttacher"`
	TraceAttacher
}

ProcessFinder pipeline architecture. It uses the Pipes library to instantiate and connect all the nodes. Nodes tagged as "forwardTo" are optional nodes that might not be instantiated. In that case, any information directed to them will be automatically forwarded to the next pipeline stage. For example WatcherKubeEnricher and ContainerDBUpdater will be only enabled (non-nil values) if Kubernetes decoration is enabled

func NewProcessFinder

func NewProcessFinder(ctx context.Context, cfg *pipe.Config, ctxInfo *global.ContextInfo) *ProcessFinder

func (*ProcessFinder) Start

func (pf *ProcessFinder) Start(cfg *pipe.Config) (<-chan *ebpf.ProcessTracer, <-chan *Instrumentable, error)

Start the ProcessFinder pipeline in background. It returns a channel where each new discovered ebpf.ProcessTracer will be notified.

type ProcessMatch

type ProcessMatch struct {
	Criteria *services.Attributes
	Process  *services.ProcessInfo
}

ProcessMatch matches a found process with the first selection criteria it fulfilled.

type ProcessWatcher

type ProcessWatcher struct {
	Ctx context.Context
	Cfg *pipe.Config
}

ProcessWatcher polls every PollInterval for new processes and forwards either new or deleted process PIDs as well as PIDs from processes that setup a new connection

type TraceAttacher

type TraceAttacher struct {
	Cfg               *pipe.Config
	Ctx               context.Context
	DiscoveredTracers chan *ebpf.ProcessTracer
	DeleteTracers     chan *Instrumentable
	Metrics           imetrics.Reporter
	// contains filtered or unexported fields
}

TraceAttacher creates the available trace.Tracer implementations (Go HTTP tracer, GRPC tracer, Generic tracer...) for each received Instrumentable process and forwards an ebpf.ProcessTracer instance ready to run and start instrumenting the executable

type WatchEventType

type WatchEventType int

type WatcherKubeEnricher

type WatcherKubeEnricher struct {
	Informer kubeMetadata
	// contains filtered or unexported fields
}

WatcherKubeEnricher keeps an update relational snapshot of the in-host process-pods-deployments, which is continuously updated from two sources: the input from the ProcessWatcher and the kube.Metadata informers.