[CWS] turn fentry on by default #31630

paulcacheux · 2024-11-29T18:26:19Z

What does this PR do?

This PR enables fentry mode for CWS eBPF probes by default. We already have some checks to ensure fentry will work, but as a first step we are going to enforce kernel >= 6.1 to actually turn on fentry.

Since this is enabled by default now, this PR also removes the fentry specific tests (since the regular tests are testing fentry now).

Motivation

Describe how to test/QA your changes

Possible Drawbacks / Trade-offs

Additional Notes

agent-platform-auto-pr · 2024-11-29T18:28:51Z

Gitlab CI Configuration Changes

Modified Jobs

kmt_secagent_tests_join_arm64

  kmt_secagent_tests_join_arm64:
    image: registry.ddbuild.io/ci/datadog-agent-buildimages/system-probe_arm64$DATADOG_AGENT_SYSPROBE_BUILDIMAGES_SUFFIX:$DATADOG_AGENT_SYSPROBE_BUILDIMAGES
    needs:
    - kmt_run_secagent_tests_arm64
    - kmt_run_secagent_tests_arm64_ad
    - kmt_run_secagent_tests_arm64_ebpfless
-   - kmt_run_secagent_tests_arm64_fentry
    - kmt_run_secagent_tests_arm64_docker
    rules:
    - allow_failure: true
      if: $CI_COMMIT_BRANCH == "main"
    - if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
      when: never
    - if: $RUN_KMT_TESTS == 'on'
    - changes:
        compare_to: main
        paths:
        - pkg/ebpf/**/*
        - pkg/security/**/*
        - pkg/eventmonitor/**/*
        - .gitlab/kernel_matrix_testing/security_agent.yml
        - .gitlab/kernel_matrix_testing/common.yml
        - .gitlab/source_test/ebpf.yml
        - test/new-e2e/tests/cws/**/*
        - test/new-e2e/system-probe/**/*
        - test/new-e2e/scenarios/system-probe/**/*
        - test/new-e2e/pkg/runner/**/*
        - test/new-e2e/pkg/utils/**/*
        - test/new-e2e/go.mod
        - tasks/security_agent.py
        - tasks/kmt.py
        - tasks/kernel_matrix_testing/*
    - allow_failure: true
      when: manual
    script:
    - echo "nothing to do here"
    stage: kernel_matrix_testing_cleanup
    tags:
    - arch:arm64

kmt_secagent_tests_join_x64

  kmt_secagent_tests_join_x64:
    image: registry.ddbuild.io/ci/datadog-agent-buildimages/system-probe_arm64$DATADOG_AGENT_SYSPROBE_BUILDIMAGES_SUFFIX:$DATADOG_AGENT_SYSPROBE_BUILDIMAGES
    needs:
    - kmt_run_secagent_tests_x64
    - kmt_run_secagent_tests_x64_required
    - kmt_run_secagent_tests_x64_ad
    - kmt_run_secagent_tests_x64_ebpfless
-   - kmt_run_secagent_tests_x64_fentry
    - kmt_run_secagent_tests_x64_docker
    rules:
    - allow_failure: true
      if: $CI_COMMIT_BRANCH == "main"
    - if: $CI_COMMIT_BRANCH =~ /^mq-working-branch-/
      when: never
    - if: $RUN_KMT_TESTS == 'on'
    - changes:
        compare_to: main
        paths:
        - pkg/ebpf/**/*
        - pkg/security/**/*
        - pkg/eventmonitor/**/*
        - .gitlab/kernel_matrix_testing/security_agent.yml
        - .gitlab/kernel_matrix_testing/common.yml
        - .gitlab/source_test/ebpf.yml
        - test/new-e2e/tests/cws/**/*
        - test/new-e2e/system-probe/**/*
        - test/new-e2e/scenarios/system-probe/**/*
        - test/new-e2e/pkg/runner/**/*
        - test/new-e2e/pkg/utils/**/*
        - test/new-e2e/go.mod
        - tasks/security_agent.py
        - tasks/kmt.py
        - tasks/kernel_matrix_testing/*
    - allow_failure: true
      when: manual
    script:
    - echo "nothing to do here"
    stage: kernel_matrix_testing_cleanup
    tags:
    - arch:arm64

Removed Jobs

kmt_run_secagent_tests_arm64_fentry
kmt_run_secagent_tests_x64_fentry

Changes Summary

Removed	Modified	Added	Renamed
2	2	0	0

ℹ️ Diff available in the job log.

agent-platform-auto-pr · 2024-11-29T18:49:39Z

Test changes on VM

Use this command from test-infra-definitions to manually test this PR changes on a VM:

inv aws.create-vm --pipeline-id=51450841 --os-family=ubuntu

Note: This applies to commit 66ac16d

cit-pr-commenter · 2024-11-29T19:14:45Z

Regression Detector

Regression Detector Results

Metrics dashboard
Target profiles
Run ID: eae2fee5-251f-4a8e-9163-db46197accbc

Baseline: 52f0517
Comparison: 66ac16d
Diff

Optimization Goals: ✅ No significant changes detected

Fine details of change detection per experiment

perf	experiment	goal	Δ mean %	Δ mean % CI	trials	links
➖	otel_to_otel_logs	ingress throughput	+0.82	[+0.07, +1.57]	1	Logs
➖	file_to_blackhole_1000ms_latency	egress throughput	+0.65	[-0.12, +1.43]	1	Logs
➖	quality_gate_idle_all_features	memory utilization	+0.38	[+0.24, +0.51]	1	Logs bounds checks dashboard
➖	quality_gate_idle	memory utilization	+0.11	[+0.07, +0.15]	1	Logs bounds checks dashboard
➖	file_tree	memory utilization	+0.07	[-0.06, +0.20]	1	Logs
➖	file_to_blackhole_0ms_latency_http1	egress throughput	+0.02	[-0.82, +0.87]	1	Logs
➖	file_to_blackhole_1000ms_latency_linear_load	egress throughput	+0.02	[-0.45, +0.49]	1	Logs
➖	file_to_blackhole_0ms_latency	egress throughput	+0.02	[-0.85, +0.88]	1	Logs
➖	file_to_blackhole_300ms_latency	egress throughput	+0.01	[-0.62, +0.65]	1	Logs
➖	tcp_dd_logs_filter_exclude	ingress throughput	-0.00	[-0.01, +0.01]	1	Logs
➖	file_to_blackhole_500ms_latency	egress throughput	-0.00	[-0.78, +0.77]	1	Logs
➖	uds_dogstatsd_to_api	ingress throughput	-0.01	[-0.10, +0.08]	1	Logs
➖	file_to_blackhole_0ms_latency_http2	egress throughput	-0.02	[-0.92, +0.87]	1	Logs
➖	file_to_blackhole_100ms_latency	egress throughput	-0.04	[-0.75, +0.68]	1	Logs
➖	uds_dogstatsd_to_api_cpu	% cpu utilization	-0.26	[-0.98, +0.45]	1	Logs
➖	quality_gate_logs	% cpu utilization	-1.10	[-4.01, +1.82]	1	Logs
➖	tcp_syslog_to_blackhole	ingress throughput	-1.11	[-1.17, -1.04]	1	Logs

Bounds Checks: ✅ Passed

perf	experiment	bounds_check_name	replicates_passed	links
✅	file_to_blackhole_0ms_latency	lost_bytes	10/10
✅	file_to_blackhole_0ms_latency	memory_usage	10/10
✅	file_to_blackhole_0ms_latency_http1	lost_bytes	10/10
✅	file_to_blackhole_0ms_latency_http1	memory_usage	10/10
✅	file_to_blackhole_0ms_latency_http2	lost_bytes	10/10
✅	file_to_blackhole_0ms_latency_http2	memory_usage	10/10
✅	file_to_blackhole_1000ms_latency	memory_usage	10/10
✅	file_to_blackhole_1000ms_latency_linear_load	memory_usage	10/10
✅	file_to_blackhole_100ms_latency	lost_bytes	10/10
✅	file_to_blackhole_100ms_latency	memory_usage	10/10
✅	file_to_blackhole_300ms_latency	lost_bytes	10/10
✅	file_to_blackhole_300ms_latency	memory_usage	10/10
✅	file_to_blackhole_500ms_latency	lost_bytes	10/10
✅	file_to_blackhole_500ms_latency	memory_usage	10/10
✅	quality_gate_idle	memory_usage	10/10	bounds checks dashboard
✅	quality_gate_idle_all_features	memory_usage	10/10	bounds checks dashboard
✅	quality_gate_logs	lost_bytes	10/10
✅	quality_gate_logs	memory_usage	10/10

Explanation

Confidence level: 90.00%
Effect size tolerance: |Δ mean %| ≥ 5.00%

Performance changes are noted in the perf column of each table:

✅ = significantly better comparison variant performance
❌ = significantly worse comparison variant performance
➖ = no significant change in performance

A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI".

For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following criteria are true:

Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look.
Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that if our statistical model is accurate, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants.
Its configuration does not mark it "erratic".

CI Pass/Fail Decision

✅ Passed. All Quality Gates passed.

quality_gate_logs, bounds check lost_bytes: 10/10 replicas passed. Gate passed.
quality_gate_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
quality_gate_idle_all_features, bounds check memory_usage: 10/10 replicas passed. Gate passed.
quality_gate_idle, bounds check memory_usage: 10/10 replicas passed. Gate passed.

agent-platform-auto-pr · 2024-12-18T15:14:50Z

Uncompressed package size comparison

Comparison with ancestor 52f0517517169d661a94895a296c73b85424c86d

Diff per package

package	diff	status	size	ancestor	threshold
datadog-iot-agent-x86_64-rpm	0.00MB	⚠️	113.38MB	113.38MB	10.00MB
datadog-iot-agent-x86_64-suse	0.00MB	⚠️	113.38MB	113.38MB	10.00MB
datadog-dogstatsd-x86_64-rpm	0.00MB	⚠️	78.67MB	78.67MB	10.00MB
datadog-dogstatsd-x86_64-suse	0.00MB	⚠️	78.67MB	78.67MB	10.00MB
datadog-agent-amd64-deb	0.00MB	✅	1187.76MB	1187.76MB	140.00MB
datadog-agent-x86_64-rpm	0.00MB	✅	1197.00MB	1197.00MB	140.00MB
datadog-agent-x86_64-suse	0.00MB	✅	1197.00MB	1197.00MB	140.00MB
datadog-agent-arm64-deb	0.00MB	✅	933.78MB	933.78MB	140.00MB
datadog-agent-aarch64-rpm	0.00MB	✅	943.00MB	943.00MB	140.00MB
datadog-dogstatsd-amd64-deb	0.00MB	✅	78.59MB	78.59MB	10.00MB
datadog-dogstatsd-arm64-deb	0.00MB	✅	55.79MB	55.79MB	10.00MB
datadog-heroku-agent-amd64-deb	0.00MB	✅	505.06MB	505.06MB	70.00MB
datadog-iot-agent-amd64-deb	0.00MB	✅	113.31MB	113.31MB	10.00MB
datadog-iot-agent-aarch64-rpm	-0.00MB	✅	108.84MB	108.85MB	10.00MB
datadog-iot-agent-arm64-deb	-0.00MB	✅	108.78MB	108.78MB	10.00MB

Decision

⚠️ Warning

paulcacheux · 2024-12-18T21:59:03Z

/merge

dd-devflow · 2024-12-18T21:59:11Z

Devflow running: `/merge`

View all feedbacks in Devflow UI.

2024-12-18 21:59:11 UTC ℹ️ MergeQueue: pull request added to the queue

The median merge time in main is 28m.

2024-12-18 22:25:23 UTC ℹ️ MergeQueue: This merge request was merged

github-actions bot added team/ebpf-platform short review PR is simple enough to be reviewed quickly labels Nov 29, 2024

github-actions bot added component/system-probe medium review PR review might take time and removed short review PR is simple enough to be reviewed quickly labels Nov 30, 2024

paulcacheux force-pushed the paulcacheux/fentry-default branch from dd4dd30 to a569ac0 Compare December 2, 2024 09:42

github-actions bot added short review PR is simple enough to be reviewed quickly and removed component/system-probe medium review PR review might take time labels Dec 2, 2024

paulcacheux added the changelog/no-changelog label Dec 2, 2024

paulcacheux changed the title ~~Paulcacheux/fentry default~~ [CWS] turn fentry on by default Dec 2, 2024

paulcacheux force-pushed the paulcacheux/fentry-default branch from a569ac0 to 4219793 Compare December 2, 2024 12:02

github-actions bot added component/system-probe medium review PR review might take time and removed short review PR is simple enough to be reviewed quickly labels Dec 2, 2024

paulcacheux added the qa/done QA done before merge and regressions are covered by tests label Dec 2, 2024

paulcacheux force-pushed the paulcacheux/fentry-default branch from 4219793 to 5151a47 Compare December 2, 2024 22:47

github-actions bot added short review PR is simple enough to be reviewed quickly and removed component/system-probe medium review PR review might take time labels Dec 2, 2024

paulcacheux added 2 commits December 18, 2024 15:45

[CWS] enable fentry mode by default

8ad074e

remove fentry tests

66ac16d

paulcacheux force-pushed the paulcacheux/fentry-default branch from 5151a47 to 66ac16d Compare December 18, 2024 14:46

paulcacheux added the team/agent-security label Dec 18, 2024

paulcacheux marked this pull request as ready for review December 18, 2024 14:46

paulcacheux requested review from a team as code owners December 18, 2024 14:46

Gui774ume approved these changes Dec 18, 2024

View reviewed changes

usamasaqib approved these changes Dec 18, 2024

View reviewed changes

spikat approved these changes Dec 18, 2024

View reviewed changes

dd-mergequeue bot merged commit f4ae8f0 into main Dec 18, 2024
336 checks passed

dd-mergequeue bot deleted the paulcacheux/fentry-default branch December 18, 2024 22:25

github-actions bot added this to the 7.62.0 milestone Dec 18, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[CWS] turn fentry on by default #31630

[CWS] turn fentry on by default #31630

paulcacheux commented Nov 29, 2024 •

edited

Loading

agent-platform-auto-pr bot commented Nov 29, 2024 •

edited

Loading

agent-platform-auto-pr bot commented Nov 29, 2024 •

edited

Loading

cit-pr-commenter bot commented Nov 29, 2024 •

edited

Loading

Fine details of change detection per experiment

Bounds Checks: ✅ Passed

Explanation

agent-platform-auto-pr bot commented Dec 18, 2024

paulcacheux commented Dec 18, 2024

dd-devflow bot commented Dec 18, 2024 •

edited

Loading

[CWS] turn fentry on by default #31630

[CWS] turn fentry on by default #31630

Conversation

paulcacheux commented Nov 29, 2024 • edited Loading

What does this PR do?

Motivation

Describe how to test/QA your changes

Possible Drawbacks / Trade-offs

Additional Notes

agent-platform-auto-pr bot commented Nov 29, 2024 • edited Loading

Gitlab CI Configuration Changes

Modified Jobs

Removed Jobs

Changes Summary

agent-platform-auto-pr bot commented Nov 29, 2024 • edited Loading

Test changes on VM

cit-pr-commenter bot commented Nov 29, 2024 • edited Loading

Regression Detector

Regression Detector Results

Optimization Goals: ✅ No significant changes detected

Fine details of change detection per experiment

Bounds Checks: ✅ Passed

Explanation

CI Pass/Fail Decision

agent-platform-auto-pr bot commented Dec 18, 2024

Uncompressed package size comparison

Decision

paulcacheux commented Dec 18, 2024

dd-devflow bot commented Dec 18, 2024 • edited Loading

Devflow running: /merge

paulcacheux commented Nov 29, 2024 •

edited

Loading

agent-platform-auto-pr bot commented Nov 29, 2024 •

edited

Loading

agent-platform-auto-pr bot commented Nov 29, 2024 •

edited

Loading

cit-pr-commenter bot commented Nov 29, 2024 •

edited

Loading

dd-devflow bot commented Dec 18, 2024 •

edited

Loading

Devflow running: `/merge`