pkg/option: allow policy-filter-map-entries configurable via flag

This commit introduces a new flag to configure the number of entries
in policy filter maps. This allows users to tune the map size based
on workload scale and system resources, improving flexibility in
policy handling.

Note: this commit only affects policies with k8s segmentation
primitives (i.e., either podSelectors or namespaced policies).

Fixes: #4260
Signed-off-by: Kyle Dong <[email protected]>

Author: kyledong-suse

bpf/process/policy_filter.h

@@ -20,7 +20,7 @@ struct {
 
 struct {
 	__uint(type, BPF_MAP_TYPE_HASH_OF_MAPS);
-	__uint(max_entries, POLICY_FILTER_MAX_POLICIES);
+	__uint(max_entries, 1); // will be resized by agent when needed
 	__type(key, u32); /* policy id */
 	__array(
 		values, struct {

docs/data/tetragon_flags.yaml

@@ -59,6 +59,9 @@ const (
 
 	// defaults for the {k,u}retprobes lru cache
 	DefaultRetprobesCacheSize = 4096
+
+	// defaults for the policy filter map
+	DefaultPolicyFilterMapEntries = 128
 )
 
 var (

pkg/defaults/defaults.go

@@ -51,4 +51,7 @@ const (
 
 	// defaults for the {k,u}retprobes lru cache
 	DefaultRetprobesCacheSize = 4096
+
+	// defaults for the policy filter map
+	DefaultPolicyFilterMapEntries = 128
 )

pkg/defaults/defaults_windows.go

@@ -130,6 +130,8 @@ type config struct {
 	ExecveMapSize    string
 
 	RetprobesCacheSize int
+
+	PolicyFilterMapEntries int
 }
 
 var (
@@ -155,6 +157,9 @@ var (
 
 		// Set default value for {k,u}retprobes lru events cache
 		RetprobesCacheSize: defaults.DefaultRetprobesCacheSize,
+
+		// set default value for the policy filter map
+		PolicyFilterMapEntries: defaults.DefaultPolicyFilterMapEntries,
 	}
 )
 

pkg/option/config.go

@@ -135,6 +135,8 @@ const (
 	KeyExecveMapSize    = "execve-map-size"
 
 	KeyRetprobesCacheSize = "retprobes-cache-size"
+
+	KeyPolicyFilterMapEntries = "policy-filter-map-entries"
 )
 
 type UsernameMetadaCode int
@@ -289,6 +291,8 @@ func ReadAndSetFlags() error {
 	Config.ExecveMapSize = viper.GetString(KeyExecveMapSize)
 
 	Config.RetprobesCacheSize = viper.GetInt(KeyRetprobesCacheSize)
+
+	Config.PolicyFilterMapEntries = viper.GetInt(KeyPolicyFilterMapEntries)
 	return nil
 }
 
@@ -483,4 +487,6 @@ func AddFlags(flags *pflag.FlagSet) {
 	flags.String(KeyExecveMapSize, "", "Set size for execve_map table (allows K/M/G suffix)")
 
 	flags.Int(KeyRetprobesCacheSize, defaults.DefaultRetprobesCacheSize, "Set {k,u}retprobes events cache maximum size")
+
+	flags.Int(KeyPolicyFilterMapEntries, defaults.DefaultPolicyFilterMapEntries, "Set entries for policy_filter_map table (default 128)")
 }

pkg/option/flags.go

@@ -14,6 +14,7 @@ import (
 
 	"github.com/cilium/tetragon/pkg/bpf"
 	"github.com/cilium/tetragon/pkg/config"
+	"github.com/cilium/tetragon/pkg/option"
 )
 
 const (
@@ -72,6 +73,10 @@ func newPfMap(enableCgroupMap bool) (PfMap, error) {
 		return PfMap{}, fmt.Errorf("loading spec for %s failed: %w", objPath, err)
 	}
 
+	if _, ok := spec.Maps["policy_filter_maps"]; ok {
+		spec.Maps["policy_filter_maps"].MaxEntries = uint32(option.Config.PolicyFilterMapEntries)
+	}
+
 	var ret PfMap
 	if ret.policyMap, err = openMap(spec, MapName, polMapSize); err != nil {
 		return PfMap{}, fmt.Errorf("opening map %s failed: %w", MapName, err)
@@ -80,7 +85,7 @@ func newPfMap(enableCgroupMap bool) (PfMap, error) {
 	if enableCgroupMap {
 		if ret.cgroupMap, err = openMap(spec, CgroupMapName, polMaxPolicies); err != nil {
 			releaseMap(ret.policyMap)
-			return PfMap{}, fmt.Errorf("opening cgroup map %s failed: %w", MapName, err)
+			return PfMap{}, fmt.Errorf("opening cgroup map %s failed: %w", CgroupMapName, err)
 		}
 	}
 

pkg/policyfilter/map.go

@@ -18,6 +18,7 @@ import (
 	cachedbtf "github.com/cilium/tetragon/pkg/btf"
 	"github.com/cilium/tetragon/pkg/logger"
 	"github.com/cilium/tetragon/pkg/logger/logfields"
+	"github.com/cilium/tetragon/pkg/option"
 	"github.com/cilium/tetragon/pkg/sensors/unloader"
 )
 
@@ -976,6 +977,12 @@ func doLoadProgram(
 		}
 	}
 
+	// Set MaxEntries for policy_filter_maps if it exists in the spec.
+	// This ensures the spec matches the user-defined value.
+	if ms, ok := spec.Maps["policy_filter_maps"]; ok {
+		ms.MaxEntries = uint32(option.Config.PolicyFilterMapEntries)
+	}
+
 	// Find all the maps referenced by the program, so we'll rewrite only
 	// the ones used.
 	var progSpec *ebpf.ProgramSpec