[Proposal] Options to limit data generation by plugins

[anubhabMajumdar]

Is your feature request related to a problem? Please describe.

Retina currently lacks sufficient options to control how many events we generate from the plugins. This impact the scale at which retina can operate.

Describe the solution you'd like

• Provide an option for users to control what and how much events the plugins generate
• The option should be generic enough - shouldn't expose plugin implementational details
• Provide reasonable number of options that differ from each other in key aspects, but not overwhelm the user

Mechanisms

List of ways to reduce events:

• Less bpf programs: Simply attach fewer bpf programs
• Sampling: Not all events may be needed, sampling can cut down events at userspace level
• Filter: Let the bpf code filter packets in the bpf and decide if needed by userspace
• Protocol specific: Not all packets of a protocol is needed. Example - only interested in TCP drops and TCP connect

Plugin Modes

Annotate

All Drops, All DNS, All TCP/UDP for annotated NS/pods (both at stack and network)

Verbosity

• No L34 - All Drops and All DNS
• All - All Drops, All DNS, All TCP/UDP for everything
• Medium - All Drops, All DNS, only packets sent/received(?) by pods at a configurable(?) sampling rate
• Low - All Drops, All DNS, only TCP connect request to Pods

Additional context

Implementational Details

• We shouldn't push down configurations to plugins. The managers or upper level should make decisions based on configuratiosn
• Existing configurations should be refactored to support above configurations