--- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.17.1 name: clusterbpfapplications.bpfman.io spec: group: bpfman.io names: kind: ClusterBpfApplication listKind: ClusterBpfApplicationList plural: clusterbpfapplications singular: clusterbpfapplication scope: Cluster versions: - additionalPrinterColumns: - jsonPath: .spec.nodeselector name: NodeSelector type: string - jsonPath: .status.conditions[0].reason name: Status type: string - jsonPath: .metadata.creationTimestamp name: Age type: date name: v1alpha1 schema: openAPIV3Schema: description: |- ClusterBpfApplication is the schema for the cluster scoped BPF Applications API. This API allows applications to use bpfman to load and attach one or more eBPF programs on a Kubernetes cluster. The clusterBpfApplication.status field reports the overall status of the ClusterBpfApplication CRD. A given ClusterBpfApplication CRD can result in loading and attaching multiple eBPF programs on multiple nodes, so this status is just a summary. More granular per-node status details can be found in the corresponding ClusterBpfApplicationState CRD that bpfman creates for each node. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: |- spec defines the desired state of the ClusterBpfApplication. The ClusterBpfApplication describes the set of one or more cluster scoped eBPF programs that should be loaded for a given application and attributes for how they should be loaded. eBPF programs that are grouped together under the same ClusterBpfApplication instance can share maps and global data between the eBPF programs loaded on the same Kubernetes Node. properties: byteCode: description: |- bytecode is a required field and configures where the eBPF program's bytecode should be loaded from. The image must contain one or more eBPF programs. maxProperties: 1 minProperties: 1 properties: image: description: |- image is an optional field and used to specify details on how to retrieve an eBPF program packaged in a OCI container image from a given registry. properties: imagePullPolicy: default: IfNotPresent description: |- pullPolicy is an optional field that describes a policy for if/when to pull a bytecode image. Defaults to IfNotPresent. Allowed values are: Always, IfNotPresent and Never When set to Always, the given image will be pulled even if the image is already present on the node. When set to IfNotPresent, the given image will only be pulled if it is not present on the node. When set to Never, the given image will never be pulled and must be loaded on the node by some other means. enum: - Always - Never - IfNotPresent type: string imagePullSecret: description: |- imagePullSecret is an optional field and indicates the secret which contains the credentials to access the image repository. properties: name: description: |- name is a required field and is the name of the secret which contains the credentials to access the image repository. type: string namespace: description: |- namespace is a required field and is the namespace of the secret which contains the credentials to access the image repository. type: string required: - name - namespace type: object url: description: |- url is a required field and is a valid container image URL used to reference a remote bytecode image. url must not be an empty string, must not exceed 525 characters in length and must be a valid URL. maxLength: 525 pattern: '[a-zA-Z0-9_][a-zA-Z0-9._-]{0,127}' type: string required: - url type: object path: description: |- path is an optional field and used to specify a bytecode object file via filepath on a Kubernetes node. pattern: ^(/[^/\0]+)+/?$ type: string type: object globalData: additionalProperties: format: byte type: string description: |- globalData is an optional field that allows the user to set global variables when the program is loaded. This allows the same compiled bytecode to be deployed by different BPF Applications to behave differently based on globalData configuration values. It uses an array of raw bytes. This is a very low level primitive. The caller is responsible for formatting the byte string appropriately considering such things as size, endianness, alignment and packing of data structures. type: object mapOwnerSelector: description: |- mapOwnerSelector is an optional field used to share maps across applications. eBPF programs loaded with the same ClusterBpfApplication or BpfApplication instance do not need to use this field. This label selector allows maps from a different ClusterBpfApplication or BpfApplication instance to be used by this instance. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic nodeSelector: description: |- nodeSelector is a required field and allows the user to specify which Kubernetes nodes to deploy the eBPF programs. To select all nodes use standard metav1.LabelSelector semantics and make it empty. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic programs: description: |- programs is a required field and is the list of eBPF programs in a BPF Application CRD that should be loaded in kernel memory. At least one entry is required. eBPF programs in this list will be loaded on the system based the nodeSelector. Even if an eBPF program is loaded in kernel memory, it cannot be triggered until an attachment point is provided. The different program types have different ways of attaching. The attachment points can be added at creation time or modified (added or removed) at a later time to activate or deactivate the eBPF program as desired. CAUTION: When programs are added or removed from the list, that requires all programs in the list to be reloaded, which could be temporarily service effecting. For this reason, modifying the list is currently not allowed. items: properties: fentry: description: |- fentry is an optional field, but required when the type field is set to FEntry. fentry defines the desired state of the application's FEntry programs. FEntry programs are attached to the entry of a Linux kernel function or to another eBPF program function. They are attached to the first instruction, before control passes to the function. FEntry programs are similar to KProbe programs, but have higher performance. properties: function: description: |- function is a required field and specifies the name of the Linux kernel function to attach the FEntry program. function must not be an empty string, must not exceed 64 characters in length, must start with alpha characters and must only contain alphanumeric characters. maxLength: 64 minLength: 1 pattern: ^[a-zA-Z][a-zA-Z0-9_]+. type: string links: description: |- links is an optional field and is a flag to indicate if the FEntry program should be attached. The attachment point for a FEntry program is a Linux kernel function. Unlike other eBPF program types, an FEntry program must be provided with the target function at load time. The links field is optional, but unlike other program types where it represents a list of attachment points, for FEntry programs it contains at most one entry that determines whether the program should be attached to the specified function. To attach the program, add an entry to links with mode set to Attach. To detach it, remove the entry from links. items: properties: mode: description: |- mode is a required field. When set to Attach, the FEntry program will attempt to be attached. To detach the FEntry program, remove the link entry. enum: - Attach type: string required: - mode type: object maxItems: 1 type: array required: - function type: object fexit: description: |- fexit is an optional field, but required when the type field is set to FExit. fexit defines the desired state of the application's FExit programs. FExit programs are attached to the exit of a Linux kernel function or to another eBPF program function. The program is invoked when the function returns, independent of where in the function that occurs. FExit programs are similar to KRetProbe programs, but get invoked with the input arguments and the return values. They also have higher performance over KRetProbe programs. properties: function: description: |- function is a required field and specifies the name of the Linux kernel function to attach the FExit program. function must not be an empty string, must not exceed 64 characters in length, must start with alpha characters and must only contain alphanumeric characters. maxLength: 64 minLength: 1 pattern: ^[a-zA-Z][a-zA-Z0-9_]+. type: string links: description: |- links is an optional field and is a flag to indicate if the FExit program should be attached. The attachment point for a FExit program is a Linux kernel function. Unlike other eBPF program types, an FExit program must be provided with the target function at load time. The links field is optional, but unlike other program types where it represents a list of attachment points, for FExit programs it contains at most one entry that determines whether the program should be attached to the specified function. To attach the program, add an entry to links with mode set to Attach. To detach it, remove the entry from links. items: properties: mode: description: |- mode is a required field. When set to Attach, the FExit program will attempt to be attached. To detach the FExit program, remove the link entry. enum: - Attach type: string required: - mode type: object maxItems: 1 type: array required: - function type: object kprobe: description: |- kprobe is an optional field, but required when the type field is set to KProbe. kprobe defines the desired state of the application's Kprobe programs. KProbe programs are attached to a Linux kernel function. Unlike FEntry programs, which must always be attached at the entry point of a Linux kernel function, KProbe programs can be attached at any point in the function using the optional offset field. However, caution must be taken when using the offset, ensuring the offset is still in the function bytecode. FEntry programs have less overhead than KProbe programs. properties: links: description: |- links is an optional field and is the list of attachment points to which the KProbe program should be attached. The eBPF program is loaded in kernel memory when the BPF Application CRD is created and the selected Kubernetes nodes are active. The eBPF program will not be triggered until the program has also been attached to an attachment point described in this list. Items may be added or removed from the list at any point, causing the eBPF program to be attached or detached. The attachment point for a KProbe program is a Linux kernel function. By default, the eBPF program is triggered at the entry of the attachment point, but the attachment point can be adjusted using an optional offset. items: properties: function: description: |- function is a required field and specifies the name of the Linux kernel function to attach the KProbe program. function must not be an empty string, must not exceed 64 characters in length, must start with alpha characters and must only contain alphanumeric characters. maxLength: 64 minLength: 1 pattern: ^[a-zA-Z][a-zA-Z0-9_]+. type: string offset: default: 0 description: |- offset is an optional field and the value is added to the address of the attachment point function. If not provided, offset defaults to 0. format: int64 type: integer required: - function type: object type: array type: object kretprobe: description: |- kretprobe is an optional field, but required when the type field is set to KRetProbe. kretprobe defines the desired state of the application's KRetProbe programs. KRetProbe programs are attached to the exit of a Linux kernel function. FExit programs have less overhead than KRetProbe programs and FExit programs have access to both the input arguments as well as the return values. KRetProbes only have access to the return values. properties: links: description: |- links is an optional field and is the list of attachment points to which the KRetProbe program should be attached. The eBPF program is loaded in kernel memory when the BPF Application CRD is created and the selected Kubernetes nodes are active. The eBPF program will not be triggered until the program has also been attached to an attachment point described in this list. Items may be added or removed from the list at any point, causing the eBPF program to be attached or detached. The attachment point for a KRetProbe program is a Linux kernel function. items: properties: function: description: |- function is a required field and specifies the name of the Linux kernel function to attach the KRetProbe program. function must not be an empty string, must not exceed 64 characters in length, must start with alpha characters and must only contain alphanumeric characters. maxLength: 64 minLength: 1 pattern: ^[a-zA-Z][a-zA-Z0-9_]+. type: string required: - function type: object type: array type: object name: description: |- name is a required field and is the name of the function that is the entry point for the eBPF program. name must not be an empty string, must not exceed 64 characters in length, must start with alpha characters and must only contain alphanumeric characters. maxLength: 64 minLength: 1 pattern: ^[a-zA-Z][a-zA-Z0-9_]+. type: string tc: description: |- tc is an optional field, but required when the type field is set to TC. tc defines the desired state of the application's TC programs. TC programs are attached to network devices (interfaces). The program can be attached on either packet ingress or egress, so the program will be called on every incoming or outgoing packet seen by the network device. The TC attachment point is in Linux's Traffic Control (tc) subsystem, which is after the Linux kernel has allocated an sk_buff. TCX is newer implementation of TC with enhanced performance and better support for running multiple programs on a given network device. This makes TC useful for packet classification actions. properties: links: description: |- links is an optional field and is the list of attachment points to which the TC program should be attached. The TC program is loaded in kernel memory when the BPF Application CRD is created and the selected Kubernetes nodes are active. The TC program will not be triggered until the program has also been attached to an attachment point described in this list. Items may be added or removed from the list at any point, causing the TC program to be attached or detached. The attachment point for a TC program is a network interface (or device). The interface can be specified by name, by allowing bpfman to discover each interface, or by setting the primaryNodeInterface flag, which instructs bpfman to use the primary interface of a Kubernetes node. Optionally, the TC program can also be installed into a set of network namespaces. items: properties: direction: description: |- direction is a required field and specifies the direction of traffic. Allowed values are: Ingress, Egress When set to Ingress, the TC program is triggered when packets are received by the interface. When set to Egress, the TC program is triggered when packets are to be transmitted by the interface. enum: - Ingress - Egress type: string interfaceSelector: description: |- interfaceSelector is a required field and is used to determine the network interface (or interfaces) the TC program is attached. Interface list is set by providing a list of interface names, enabling auto discovery, or setting the primaryNodeInterface flag, but only one option is allowed. maxProperties: 1 minProperties: 1 properties: interfaces: description: |- interfaces is an optional field and is a list of network interface names to attach the eBPF program. The interface names in the list are case-sensitive. items: type: string type: array interfacesDiscoveryConfig: description: |- interfacesDiscoveryConfig is an optional field that is used to control if and how to automatically discover interfaces. If the agent should automatically discover and attach eBPF programs to interfaces, use the fields under interfacesDiscoveryConfig to control what is allow and excluded from discovery. properties: allowedInterfaces: description: |- allowedInterfaces is an optional field that contains a list of interface names that are allowed to be discovered. If empty, the agent will fetch all the interfaces in the system, excepting the ones listed in excludeInterfaces. if non-empty, only entries in the list will be considered for discovery. If an entry enclosed by slashes, such as `/br-/` or `/veth*/`, then the entry is considered as a regular expression for matching. Otherwise, the interface names in the list are case-sensitive. This field is only taken into consideration if interfaceAutoDiscovery is set to true. items: type: string type: array excludeInterfaces: default: - lo description: |- excludeInterfaces is an optional field that contains a list of interface names that are excluded from interface discovery. The interface names in the list are case-sensitive. By default, the list contains the loopback interface, "lo". This field is only taken into consideration if interfaceAutoDiscovery is set to true. items: type: string type: array interfaceAutoDiscovery: default: false description: |- interfaceAutoDiscovery is an optional field. When enabled, the agent monitors the creation and deletion of interfaces and automatically attached eBPF programs to the newly discovered interfaces. CAUTION: This has the potential to attach a given eBPF program to a large number of interfaces. Use with caution. type: boolean type: object primaryNodeInterface: description: |- primaryNodeInterface is and optional field and indicates to attach the eBPF program to the primary interface on the Kubernetes node. Only 'true' is accepted. type: boolean type: object networkNamespaces: description: |- networkNamespaces is an optional field that identifies the set of network namespaces in which to attach the eBPF program. If networkNamespaces is not specified, the eBPF program will be attached in the root network namespace. properties: namespace: description: |- namespace is an optional field and indicates the target network namespace. If not provided, the default network namespace is used. type: string pods: description: |- pods is a required field and indicates the target pods. To select all pods use the standard metav1.LabelSelector semantics and make it empty. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic required: - pods type: object priority: description: |- priority is an optional field and determines the execution order of the TC program relative to other TC programs attached to the same attachment point. It must be a value between 0 and 1000, where lower values indicate higher precedence. For TC programs on the same attachment point with the same direction and priority, the most recently attached program has a lower precedence. If not provided, priority will default to 1000. format: int32 maximum: 1000 minimum: 0 type: integer proceedOn: default: - Pipe - DispatcherReturn description: |- proceedOn is an optional field and allows the user to call other TC programs in a chain, or not call the next program in a chain based on the exit code of a TC program. Allowed values, which are the possible exit codes from a TC eBPF program, are: UnSpec, OK, ReClassify, Shot, Pipe, Stolen, Queued, Repeat, ReDirect, Trap, DispatcherReturn Multiple values are supported. Default is OK, Pipe and DispatcherReturn. So using the default values, if a TC program returns Pipe, the next TC program in the chain will be called. If a TC program returns Stolen, the next TC program in the chain will NOT be called. items: enum: - UnSpec - OK - ReClassify - Shot - Pipe - Stolen - Queued - Repeat - ReDirect - Trap - DispatcherReturn type: string type: array required: - direction - interfaceSelector type: object type: array type: object tcx: description: |- tcx is an optional field, but required when the type field is set to TCX. tcx defines the desired state of the application's TCX programs. TCX programs are attached to network devices (interfaces). The program can be attached on either packet ingress or egress, so the program will be called on every incoming or outgoing packet seen by the network device. The TCX attachment point is in Linux's Traffic Control (tc) subsystem, which is after the Linux kernel has allocated an sk_buff. This makes TCX useful for packet classification actions. TCX is a newer implementation of TC with enhanced performance and better support for running multiple programs on a given network device. properties: links: description: |- links is an optional field and is the list of attachment points to which the TCX program should be attached. The TCX program is loaded in kernel memory when the BPF Application CRD is created and the selected Kubernetes nodes are active. The TCX program will not be triggered until the program has also been attached to an attachment point described in this list. Items may be added or removed from the list at any point, causing the TCX program to be attached or detached. The attachment point for a TCX program is a network interface (or device). The interface can be specified by name, by allowing bpfman to discover each interface, or by setting the primaryNodeInterface flag, which instructs bpfman to use the primary interface of a Kubernetes node. Optionally, the TCX program can also be installed into a set of network namespaces. items: properties: direction: description: |- direction is a required field and specifies the direction of traffic. Allowed values are: Ingress, Egress When set to Ingress, the TC program is triggered when packets are received by the interface. When set to Egress, the TC program is triggered when packets are to be transmitted by the interface. enum: - Ingress - Egress type: string interfaceSelector: description: |- interfaceSelector is a required field and is used to determine the network interface (or interfaces) the TCX program is attached. Interface list is set by providing a list of interface names, enabling auto discovery, or setting the primaryNodeInterface flag, but only one option is allowed. maxProperties: 1 minProperties: 1 properties: interfaces: description: |- interfaces is an optional field and is a list of network interface names to attach the eBPF program. The interface names in the list are case-sensitive. items: type: string type: array interfacesDiscoveryConfig: description: |- interfacesDiscoveryConfig is an optional field that is used to control if and how to automatically discover interfaces. If the agent should automatically discover and attach eBPF programs to interfaces, use the fields under interfacesDiscoveryConfig to control what is allow and excluded from discovery. properties: allowedInterfaces: description: |- allowedInterfaces is an optional field that contains a list of interface names that are allowed to be discovered. If empty, the agent will fetch all the interfaces in the system, excepting the ones listed in excludeInterfaces. if non-empty, only entries in the list will be considered for discovery. If an entry enclosed by slashes, such as `/br-/` or `/veth*/`, then the entry is considered as a regular expression for matching. Otherwise, the interface names in the list are case-sensitive. This field is only taken into consideration if interfaceAutoDiscovery is set to true. items: type: string type: array excludeInterfaces: default: - lo description: |- excludeInterfaces is an optional field that contains a list of interface names that are excluded from interface discovery. The interface names in the list are case-sensitive. By default, the list contains the loopback interface, "lo". This field is only taken into consideration if interfaceAutoDiscovery is set to true. items: type: string type: array interfaceAutoDiscovery: default: false description: |- interfaceAutoDiscovery is an optional field. When enabled, the agent monitors the creation and deletion of interfaces and automatically attached eBPF programs to the newly discovered interfaces. CAUTION: This has the potential to attach a given eBPF program to a large number of interfaces. Use with caution. type: boolean type: object primaryNodeInterface: description: |- primaryNodeInterface is and optional field and indicates to attach the eBPF program to the primary interface on the Kubernetes node. Only 'true' is accepted. type: boolean type: object networkNamespaces: description: |- networkNamespaces is an optional field that identifies the set of network namespaces in which to attach the eBPF program. If networkNamespaces is not specified, the eBPF program will be attached in the root network namespace. properties: namespace: description: |- namespace is an optional field and indicates the target network namespace. If not provided, the default network namespace is used. type: string pods: description: |- pods is a required field and indicates the target pods. To select all pods use the standard metav1.LabelSelector semantics and make it empty. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic required: - pods type: object priority: description: |- priority is an optional field and determines the execution order of the TCX program relative to other TCX programs attached to the same attachment point. It must be a value between 0 and 1000, where lower values indicate higher precedence. For TCX programs on the same attachment point with the same direction and priority, the most recently attached program has a lower precedence. If not provided, priority will default to 1000. format: int32 maximum: 1000 minimum: 0 type: integer required: - direction - interfaceSelector type: object type: array type: object tracepoint: description: |- tracepoint is an optional field, but required when the type field is set to Tracepoint. tracepoint defines the desired state of the application's Tracepoint programs. Whereas KProbes attach to dynamically to any Linux kernel function, Tracepoint programs are programs that can only be attached at predefined locations in the Linux kernel. Use the following command to see the available attachment points: `sudo find /sys/kernel/debug/tracing/events -type d` While KProbes are more flexible in where in the kernel the probe can be attached, the functions and data structure rely on the kernel your system is running. Tracepoints tend to be more stable across kernel versions and are better for portability. properties: links: description: |- links is an optional field and is the list of attachment points to which the Tracepoint program should be attached. The Tracepoint program is loaded in kernel memory when the BPF Application CRD is created and the selected Kubernetes nodes are active. The Tracepoint program will not be triggered until the program has also been attached to an attachment point described in this list. Items may be added or removed from the list at any point, causing the Tracepoint program to be attached or detached. The attachment point for a Tracepoint program is a one of a predefined set of Linux kernel functions. items: properties: name: description: |- name is a required field and specifies the name of the Linux kernel Tracepoint to attach the eBPF program. name must not be an empty string, must not exceed 64 characters in length, must start with alpha characters and must only contain alphanumeric characters. maxLength: 64 minLength: 1 pattern: ^[a-zA-Z][a-zA-Z0-9_]+. type: string required: - name type: object type: array type: object type: description: |- type is a required field used to specify the type of the eBPF program. Allowed values are: FEntry, FExit, KProbe, KRetProbe, TC, TCX, TracePoint, UProbe, URetProbe, XDP When set to FEntry, the program is attached to the entry of a Linux kernel function or to another eBPF program function. When using the FEntry program type, the fentry field is required. See fentry for more details on FEntry programs. When set to FExit, the program is attached to the exit of a Linux kernel function or to another eBPF program function. When using the FExit program type, the fexit field is required. See fexit for more details on FExit programs. When set to KProbe, the program is attached to entry of a Linux kernel function. When using the KProbe program type, the kprobe field is required. See kprobe for more details on KProbe programs. When set to KRetProbe, the program is attached to exit of a Linux kernel function. When using the KRetProbe program type, the kretprobe field is required. See kretprobe for more details on KRetProbe programs. When set to TC, the eBPF program can attach to network devices (interfaces). The program can be attached on either packet ingress or egress, so the program will be called on every incoming or outgoing packet seen by the network device. When using the TC program type, the tc field is required. See tc for more details on TC programs. When set to TCX, the eBPF program can attach to network devices (interfaces). The program can be attached on either packet ingress or egress, so the program will be called on every incoming or outgoing packet seen by the network device. When using the TCX program type, the tcx field is required. See tcx for more details on TCX programs. When set to Tracepoint, the program can attach to one of the predefined set of Linux kernel functions. When using the Tracepoint program type, the tracepoint field is required. See tracepoint for more details on Tracepoint programs. When set to UProbe, the program can attach in user-space. The UProbe is attached to a binary, library or function name, and optionally an offset in the code. When using the UProbe program type, the uprobe field is required. See uprobe for more details on UProbe programs. When set to URetProbe, the program can attach in user-space. The URetProbe is attached to the return of a binary, library or function name, and optionally an offset in the code. When using the URetProbe program type, the uretprobe field is required. See uretprobe for more details on URetProbe programs. When set to XDP, the eBPF program can attach to network devices (interfaces) and will be called on every incoming packet received by the network device. When using the XDP program type, the xdp field is required. See xdp for more details on XDP programs. enum: - XDP - TC - TCX - FEntry - FExit - KProbe - KRetProbe - UProbe - URetProbe - TracePoint type: string uprobe: description: |- uprobe is an optional field, but required when the type field is set to UProbe. uprobe defines the desired state of the application's UProbe programs. UProbe programs are user-space probes. A target must be provided, which is the library name or absolute path to a binary or library where the probe is attached. Optionally, a function name can also be provided to provide finer granularity on where the probe is attached. They can be attached at any point in the binary, library or function using the optional offset field. However, caution must be taken when using the offset, ensuring the offset is still in the desired bytecode. properties: links: description: |- links is an optional field and is the list of attachment points to which the UProbe or URetProbe program should be attached. The eBPF program is loaded in kernel memory when the BPF Application CRD is created and the selected Kubernetes nodes are active. The eBPF program will not be triggered until the program has also been attached to an attachment point described in this list. Items may be added or removed from the list at any point, causing the eBPF program to be attached or detached. The attachment point for a UProbe and URetProbe program is a user-space binary or function. By default, the eBPF program is triggered at the entry of the attachment point, but the attachment point can be adjusted using an optional function name and/or offset. Optionally, the eBPF program can be installed in a set of containers or limited to a specified PID. items: properties: containers: description: |- containers is an optional field that identifies the set of containers in which to attach the UProbe or URetProbe program. If containers is not specified, the eBPF program will be attached in the bpfman container. properties: containerNames: description: |- containerNames is an optional field and is a list of container names in a pod to attach the eBPF program. If no names are specified, all containers in the pod are selected. items: type: string type: array namespace: description: |- namespace is an optional field and indicates the target Kubernetes namespace. If not provided, all Kubernetes namespaces are included. type: string pods: description: |- pods is a required field and indicates the target pods. To select all pods use the standard metav1.LabelSelector semantics and make it empty. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic required: - pods type: object function: description: |- function is an optional field and specifies the name of a user-space function to attach the UProbe or URetProbe program. If not provided, the eBPF program will be triggered on the entry of the target. function must not be an empty string, must not exceed 64 characters in length, must start with alpha characters and must only contain alphanumeric characters. maxLength: 64 minLength: 1 pattern: ^[a-zA-Z][a-zA-Z0-9_]+. type: string offset: default: 0 description: |- offset is an optional field and the value is added to the address of the attachment point function. format: int64 type: integer pid: description: |- pid is an optional field and if provided, limits the execution of the UProbe or URetProbe to the provided process identification number (PID). If pid is not provided, the UProbe or URetProbe executes for all PIDs. format: int32 type: integer target: description: |- target is a required field and is the user-space library name or the absolute path to a binary or library. type: string required: - target type: object type: array type: object uretprobe: description: |- uretprobe is an optional field, but required when the type field is set to URetProbe. uretprobe defines the desired state of the application's URetProbe programs. URetProbe programs are user-space probes. A target must be provided, which is the library name or absolute path to a binary or library where the probe is attached. Optionally, a function name can also be provided to provide finer granularity on where the probe is attached. They are attached to the return point of the binary, library or function, but can be set anywhere using the optional offset field. However, caution must be taken when using the offset, ensuring the offset is still in the desired bytecode. properties: links: description: |- links is an optional field and is the list of attachment points to which the UProbe or URetProbe program should be attached. The eBPF program is loaded in kernel memory when the BPF Application CRD is created and the selected Kubernetes nodes are active. The eBPF program will not be triggered until the program has also been attached to an attachment point described in this list. Items may be added or removed from the list at any point, causing the eBPF program to be attached or detached. The attachment point for a UProbe and URetProbe program is a user-space binary or function. By default, the eBPF program is triggered at the entry of the attachment point, but the attachment point can be adjusted using an optional function name and/or offset. Optionally, the eBPF program can be installed in a set of containers or limited to a specified PID. items: properties: containers: description: |- containers is an optional field that identifies the set of containers in which to attach the UProbe or URetProbe program. If containers is not specified, the eBPF program will be attached in the bpfman container. properties: containerNames: description: |- containerNames is an optional field and is a list of container names in a pod to attach the eBPF program. If no names are specified, all containers in the pod are selected. items: type: string type: array namespace: description: |- namespace is an optional field and indicates the target Kubernetes namespace. If not provided, all Kubernetes namespaces are included. type: string pods: description: |- pods is a required field and indicates the target pods. To select all pods use the standard metav1.LabelSelector semantics and make it empty. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic required: - pods type: object function: description: |- function is an optional field and specifies the name of a user-space function to attach the UProbe or URetProbe program. If not provided, the eBPF program will be triggered on the entry of the target. function must not be an empty string, must not exceed 64 characters in length, must start with alpha characters and must only contain alphanumeric characters. maxLength: 64 minLength: 1 pattern: ^[a-zA-Z][a-zA-Z0-9_]+. type: string offset: default: 0 description: |- offset is an optional field and the value is added to the address of the attachment point function. format: int64 type: integer pid: description: |- pid is an optional field and if provided, limits the execution of the UProbe or URetProbe to the provided process identification number (PID). If pid is not provided, the UProbe or URetProbe executes for all PIDs. format: int32 type: integer target: description: |- target is a required field and is the user-space library name or the absolute path to a binary or library. type: string required: - target type: object type: array type: object xdp: description: |- xdp is an optional field, but required when the type field is set to XDP. xdp defines the desired state of the application's XDP programs. XDP program can be attached to network devices (interfaces) and will be called on every incoming packet received by the network device. The XDP attachment point is just after the packet has been received off the wire, but before the Linux kernel has allocated an sk_buff, which is used to pass the packet through the kernel networking stack. properties: links: description: |- links is an optional field and is the list of attachment points to which the XDP program should be attached. The XDP program is loaded in kernel memory when the BPF Application CRD is created and the selected Kubernetes nodes are active. The XDP program will not be triggered until the program has also been attached to an attachment point described in this list. Items may be added or removed from the list at any point, causing the XDP program to be attached or detached. The attachment point for an XDP program is a network interface (or device). The interface can be specified by name, by allowing bpfman to discover each interface, or by setting the primaryNodeInterface flag, which instructs bpfman to use the primary interface of a Kubernetes node. Optionally, the XDP program can also be installed into a set of network namespaces. items: properties: interfaceSelector: description: |- interfaceSelector is a required field and is used to determine the network interface (or interfaces) the XDP program is attached. Interface list is set by providing a list of interface names, enabling auto discovery, or setting the primaryNodeInterface flag, but only one option is allowed. maxProperties: 1 minProperties: 1 properties: interfaces: description: |- interfaces is an optional field and is a list of network interface names to attach the eBPF program. The interface names in the list are case-sensitive. items: type: string type: array interfacesDiscoveryConfig: description: |- interfacesDiscoveryConfig is an optional field that is used to control if and how to automatically discover interfaces. If the agent should automatically discover and attach eBPF programs to interfaces, use the fields under interfacesDiscoveryConfig to control what is allow and excluded from discovery. properties: allowedInterfaces: description: |- allowedInterfaces is an optional field that contains a list of interface names that are allowed to be discovered. If empty, the agent will fetch all the interfaces in the system, excepting the ones listed in excludeInterfaces. if non-empty, only entries in the list will be considered for discovery. If an entry enclosed by slashes, such as `/br-/` or `/veth*/`, then the entry is considered as a regular expression for matching. Otherwise, the interface names in the list are case-sensitive. This field is only taken into consideration if interfaceAutoDiscovery is set to true. items: type: string type: array excludeInterfaces: default: - lo description: |- excludeInterfaces is an optional field that contains a list of interface names that are excluded from interface discovery. The interface names in the list are case-sensitive. By default, the list contains the loopback interface, "lo". This field is only taken into consideration if interfaceAutoDiscovery is set to true. items: type: string type: array interfaceAutoDiscovery: default: false description: |- interfaceAutoDiscovery is an optional field. When enabled, the agent monitors the creation and deletion of interfaces and automatically attached eBPF programs to the newly discovered interfaces. CAUTION: This has the potential to attach a given eBPF program to a large number of interfaces. Use with caution. type: boolean type: object primaryNodeInterface: description: |- primaryNodeInterface is and optional field and indicates to attach the eBPF program to the primary interface on the Kubernetes node. Only 'true' is accepted. type: boolean type: object networkNamespaces: description: |- networkNamespaces identifies the set of network namespaces in which to attach the eBPF program. If networkNamespaces is not specified, the eBPF program will be attached in the root network namespace. properties: namespace: description: |- namespace is an optional field and indicates the target network namespace. If not provided, the default network namespace is used. type: string pods: description: |- pods is a required field and indicates the target pods. To select all pods use the standard metav1.LabelSelector semantics and make it empty. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic required: - pods type: object priority: description: |- priority is an optional field and determines the execution order of the XDP program relative to other XDP programs attached to the same attachment point. It must be a value between 0 and 1000, where lower values indicate higher precedence. For XDP programs on the same attachment point with the same priority, the most recently attached program has a lower precedence. If not provided, priority will default to 1000. format: int32 maximum: 1000 minimum: 0 type: integer proceedOn: default: - Pass - DispatcherReturn description: |- proceedOn is an optional field and allows the user to call other XDP programs in a chain, or not call the next program in a chain based on the exit code of an XDP program. Allowed values, which are the possible exit codes from an XDP eBPF program, are: Aborted, Drop, Pass, TX, ReDirect, DispatcherReturn Multiple values are supported. Default is Pass and DispatcherReturn. So using the default values, if an XDP program returns Pass, the next XDP program in the chain will be called. If an XDP program returns Drop, the next XDP program in the chain will NOT be called. items: enum: - Aborted - Drop - Pass - TX - ReDirect - DispatcherReturn type: string type: array required: - interfaceSelector type: object type: array type: object required: - name - type type: object x-kubernetes-validations: - message: xdp configuration is required when type is xdp, and forbidden otherwise rule: 'has(self.type) && self.type == ''XDP'' ? has(self.xdp) : !has(self.xdp)' - message: tc configuration is required when type is tc, and forbidden otherwise rule: 'has(self.type) && self.type == ''TC'' ? has(self.tc) : !has(self.tc)' - message: tcx configuration is required when type is tcx, and forbidden otherwise rule: 'has(self.type) && self.type == ''TCX'' ? has(self.tcx) : !has(self.tcx)' - message: fentry configuration is required when type is fentry, and forbidden otherwise rule: 'has(self.type) && self.type == ''FEntry'' ? has(self.fentry) : !has(self.fentry)' - message: fexit configuration is required when type is fexit, and forbidden otherwise rule: 'has(self.type) && self.type == ''FExit'' ? has(self.fexit) : !has(self.fexit)' - message: kprobe configuration is required when type is kprobe, and forbidden otherwise rule: 'has(self.type) && self.type == ''KProbe'' ? has(self.kprobe) : !has(self.kprobe)' - message: kretprobe configuration is required when type is kretprobe, and forbidden otherwise rule: 'has(self.type) && self.type == ''KRetProbe'' ? has(self.kretprobe) : !has(self.kretprobe)' - message: uprobe configuration is required when type is uprobe, and forbidden otherwise rule: 'has(self.type) && self.type == ''UProbe'' ? has(self.uprobe) : !has(self.uprobe)' - message: uretprobe configuration is required when type is uretprobe, and forbidden otherwise rule: 'has(self.type) && self.type == ''URetProbe'' ? has(self.uretprobe) : !has(self.uretprobe)' - message: tracepoint configuration is required when type is tracepoint, and forbidden otherwise rule: 'has(self.type) && self.type == ''TracePoint'' ? has(self.tracepoint) : !has(self.tracepoint)' minItems: 1 type: array required: - byteCode - nodeSelector - programs type: object status: description: |- status reflects the status of a BPF Application and indicates if all the eBPF programs for a given instance loaded successfully or not. properties: conditions: description: |- conditions contains the summary state for all eBPF programs defined in the BPF Application instance for all the Kubernetes nodes in the cluster. items: description: Condition contains details for one aspect of the current state of this API Resource. properties: lastTransitionTime: description: |- lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. format: date-time type: string message: description: |- message is a human readable message indicating details about the transition. This may be an empty string. maxLength: 32768 type: string observedGeneration: description: |- observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: description: |- reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. maxLength: 1024 minLength: 1 pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ type: string status: description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: description: type of condition in CamelCase or in foo.example.com/CamelCase. maxLength: 316 pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ type: string required: - lastTransitionTime - message - reason - status - type type: object type: array x-kubernetes-list-map-keys: - type x-kubernetes-list-type: map type: object type: object served: true storage: true subresources: status: {}