// +build ignore

#include "vmlinux.h"
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_tracing.h>
#include <bpf/bpf_core_read.h>

#define MAX_FILENAME_LEN 256
#define TASK_COMM_LEN 16

// Struct layout aligned precisely with Go userspace binary memory layout
struct event {
    u32 pid;
    u32 ppid;
    u32 uid;
    u32 gid;
    char comm[TASK_COMM_LEN];
    char filename[MAX_FILENAME_LEN];
};

// Define eBPF RingBuffer Map (16 MB = 1 << 24 bytes, page-aligned)
struct {
    __uint(type, BPF_MAP_TYPE_RINGBUF);
    __uint(max_entries, 1 << 24);
} events SEC(".maps");

// eBPF Probe attached to sys_execve system call entry point
SEC("kprobe/sys_execve")
int BPF_KPROBE(kprobe_sys_execve, const char *filename, const char *const *argv, const char *const *envp) {
    u64 pid_tgid = bpf_get_current_pid_tgid();
    u32 pid = pid_tgid >> 32;
    u32 uid = bpf_get_current_uid_gid();
    u32 gid = bpf_get_current_uid_gid() >> 32;

    // Reserve ringbuffer memory slot with zero-copy header allocation
    struct event *e = bpf_ringbuf_reserve(&events, sizeof(struct event), 0);
    if (!e) {
        // Ringbuffer full; event dropped (tracked via metrics)
        return 0;
    }

    e->pid = pid;
    e->uid = uid;
    e->gid = gid;

    // Retrieve parent process ID from task structure using CO-RE read
    struct task_struct *task = (struct task_struct *)bpf_get_current_task();
    e->ppid = BPF_CORE_READ(task, real_parent, tgid);

    // Read process command name (executable basename)
    bpf_get_current_comm(&e->comm, sizeof(e->comm));

    // Safely copy user-space filename string pointer
    long res = bpf_probe_read_user_str(&e->filename, sizeof(e->filename), filename);
    if (res < 0) {
        e->filename[0] = '\0';
    }

    // Submit reserved event slot to userspace ringbuffer reader
    bpf_ringbuf_submit(e, 0);
    return 0;
}

// eBPF Probe attached to tcp_connect for network tracing
SEC("kprobe/tcp_connect")
int BPF_KPROBE(kprobe_tcp_connect, struct sock *sk) {
    u64 pid_tgid = bpf_get_current_pid_tgid();
    u32 pid = pid_tgid >> 32;

    struct event *e = bpf_ringbuf_reserve(&events, sizeof(struct event), 0);
    if (!e) {
        return 0;
    }

    e->pid = pid;
    e->uid = bpf_get_current_uid_gid();
    e->ppid = 0;
    bpf_get_current_comm(&e->comm, sizeof(e->comm));
    
    // Copy static trace mark into filename field for network event classification
    const char net_msg[] = "[TCP_CONNECT]";
    __builtin_memcpy(e->filename, net_msg, sizeof(net_msg));

    bpf_ringbuf_submit(e, 0);
    return 0;
}

char _license[] SEC("license") = "GPL";

package main

// Generate Go bindings for little-endian and big-endian targets
//go:generate go run github.com/cilium/ebpf/cmd/bpf2go -target bpf2go -type event bpf execve_monitor.c -- -I./headers

import (
	"bytes"
	"encoding/binary"
	"errors"
	"fmt"
	"log"
	"os"
	"os/signal"
	"syscall"
	"unsafe"

	"github.com/cilium/ebpf/link"
	"github.com/cilium/ebpf/ringbuf"
	"github.com/cilium/ebpf/rlimit"
)

// Binary layout matching C struct event exactly
type KernelEvent struct {
	Pid      uint32
	Ppid     uint32
	Uid      uint32
	Gid      uint32
	Comm     [16]byte
	Filename [256]byte
}

func main() {
	log.Println("[INFO] Starting eBPF Kernel Telemetry Daemon...")

	// 1. Remove memory lock limits (legacy kernel support, no-op on kernel >= 5.11)
	if err := rlimit.RemoveMemlock(); err != nil {
		log.Fatalf("[FATAL] Failed to remove memlock limit: %v", err)
	}

	// 2. Load compiled eBPF bytecode objects into kernel
	objs := bpfObjects{}
	if err := loadBpfObjects(&objs, nil); err != nil {
		log.Fatalf("[FATAL] Failed to load eBPF objects: %v", err)
	}
	defer objs.Close()

	// 3. Attach kprobe to sys_execve
	kpExec, err := link.Kprobe("sys_execve", objs.KprobeSysExecve, nil)
	if err != nil {
		log.Fatalf("[FATAL] Failed to attach sys_execve kprobe: %v", err)
	}
	defer kpExec.Close()

	// 4. Attach kprobe to tcp_connect
	kpConnect, err := link.Kprobe("tcp_connect", objs.KprobeTcpConnect, nil)
	if err != nil {
		log.Fatalf("[FATAL] Failed to attach tcp_connect kprobe: %v", err)
	}
	defer kpConnect.Close()

	log.Println("[INFO] eBPF kprobes successfully attached to sys_execve and tcp_connect.")

	// 5. Open RingBuffer reader on the shared memory map
	rd, err := ringbuf.NewReader(objs.Events)
	if err != nil {
		log.Fatalf("[FATAL] Failed to initialize ringbuf reader: %v", err)
	}
	defer rd.Close()

	// 6. Handle graceful shutdown signals
	stop := make(chan os.Signal, 1)
	signal.Notify(stop, os.Interrupt, syscall.SIGTERM)

	go func() {
		<-stop
		log.Println("[INFO] Received shutdown signal. Closing ringbuf reader...")
		if err := rd.Close(); err != nil {
			log.Printf("[ERROR] Error closing ringbuf reader: %v", err)
		}
	}()

	log.Println("[INFO] Listening for kernel execve & tcp_connect events...")

	// 7. Zero-copy ringbuffer event consumption loop
	var event KernelEvent
	for {
		record, err := rd.Read()
		if err != nil {
			if errors.Is(err, ringbuf.ErrClosed) {
				log.Println("[INFO] Ringbuf reader closed cleanly. Exiting consumer loop.")
				return
			}
			log.Printf("[WARN] Error reading from ringbuf: %v", err)
			continue
		}

		// Fast binary decoding from raw sample memory
		if len(record.RawSample) < int(unsafe.Sizeof(event)) {
			log.Printf("[WARN] Received truncated sample (%d bytes)", len(record.RawSample))
			continue
		}

		if err := binary.Read(bytes.NewReader(record.RawSample), binary.LittleEndian, &event); err != nil {
			log.Printf("[WARN] Failed to parse event struct: %v", err)
			continue
		}

		comm := string(bytes.TrimRight(event.Comm[:], "\x00"))
		filename := string(bytes.TrimRight(event.Filename[:], "\x00"))

		fmt.Printf("[EVENT] PID: %-6d | PPID: %-6d | UID: %-4d | COMM: %-15s | PATH: %s\n",
			event.Pid, event.Ppid, event.Uid, comm, filename)
	}
}

package v1alpha1

import (
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
)

// EbpfTracerSpec defines the desired state of EbpfTracer
type EbpfTracerSpec struct {
	// TargetNamespaces specifies namespaces to monitor (empty means cluster-wide)
	// +optional
	TargetNamespaces []string `json:"targetNamespaces,omitempty"`

	// ProcessFilters specifies process command names to monitor
	// +optional
	ProcessFilters []string `json:"processFilters,omitempty"`

	// RingBufferSizeMB specifies size of eBPF RingBuffer in Megabytes (must be power of 2)
	// +kubebuilder:default=16
	// +kubebuilder:validation:Minimum=2
	// +kubebuilder:validation:Maximum=128
	RingBufferSizeMB int32 `json:"ringBufferSizeMB,omitempty"`

	// Image specifies the eBPF DaemonSet container image
	// +kubebuilder:default="quay.io/observability/ebpf-agent:v1.0.0"
	Image string `json:"image,omitempty"`
}

// EbpfTracerStatus defines the observed state of EbpfTracer
type EbpfTracerStatus struct {
	// ActiveNodes represents number of worker nodes currently running the eBPF probe
	ActiveNodes int32 `json:"activeNodes"`

	// DesiredNodes represents target number of worker nodes
	DesiredNodes int32 `json:"desiredNodes"`

	// Phase represents current operator reconciliation status
	Phase string `json:"phase"`

	// Conditions represent detailed status conditions
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// ObservedGeneration reflects the most recent generation observed by controller
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
}

// +kubebuilder:object:root=true
// +kubebuilder:subresource:status
// +kubebuilder:printcolumn:name="Phase",type=string,JSONPath=`.status.phase`
// +kubebuilder:printcolumn:name="Active Nodes",type=integer,JSONPath=`.status.activeNodes`
// +kubebuilder:printcolumn:name="Desired Nodes",type=integer,JSONPath=`.status.desiredNodes`
// +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp"

// EbpfTracer is the Schema for the ebpftracers API
type EbpfTracer struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   EbpfTracerSpec   `json:"spec,omitempty"`
	Status EbpfTracerStatus `json:"status,omitempty"`
}

// +kubebuilder:object:root=true

// EbpfTracerList contains a list of EbpfTracer
type EbpfTracerList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []EbpfTracer `json:"items"`
}

func init() {
	SchemeBuilder.Register(&EbpfTracer{}, &EbpfTracerList{})
}

package controller

import (
	"context"
	"fmt"
	"time"

	appsv1 "k8s.io/api/apps/v1"
	corev1 "k8s.io/api/core/v1"
	"k8s.io/apimachinery/pkg/api/errors"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/runtime"
	"k8s.io/client-go/util/retry"
	ctrl "sigs.k8s.io/controller-runtime"
	"sigs.k8s.io/controller-runtime/pkg/client"
	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
	"sigs.k8s.io/controller-runtime/pkg/log"
	"sigs.k8s.io/controller-runtime/pkg/predicate"

	telemetryv1alpha1 "github.com/example/ebpf-operator/api/v1alpha1"
)

const ebpfFinalizer = "telemetry.example.com/finalizer"

// EbpfTracerReconciler reconciles a EbpfTracer object
type EbpfTracerReconciler struct {
	client.Client
	Scheme *runtime.Scheme
}

// +kubebuilder:rbac:groups=telemetry.example.com,resources=ebpftracers,verbs=get;list;watch;create;update;patch;delete
// +kubebuilder:rbac:groups=telemetry.example.com,resources=ebpftracers/status,verbs=get;update;patch
// +kubebuilder:rbac:groups=telemetry.example.com,resources=ebpftracers/finalizers,verbs=update
// +kubebuilder:rbac:groups=apps,resources=daemonsets,verbs=get;list;watch;create;update;patch;delete

func (r *EbpfTracerReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
	logger := log.FromContext(ctx)

	// 1. Fetch current EbpfTracer CRD instance
	tracer := &telemetryv1alpha1.EbpfTracer{}
	if err := r.Get(ctx, req.NamespacedName, tracer); err != nil {
		if errors.IsNotFound(err) {
			logger.Info("EbpfTracer resource not found. Top-level object deleted.")
			return ctrl.Result{}, nil
		}
		return ctrl.Result{}, err
	}

	// 2. Handle Finalizers and Deletion Logic
	if !tracer.ObjectMeta.DeletionTimestamp.IsZero() {
		if controllerutil.ContainsFinalizer(tracer, ebpfFinalizer) {
			logger.Info("Performing cleanup before deleting EbpfTracer...")
			// Perform graceful node-level teardown if necessary
			controllerutil.RemoveFinalizer(tracer, ebpfFinalizer)
			if err := r.Update(ctx, tracer); err != nil {
				return ctrl.Result{}, err
			}
		}
		return ctrl.Result{}, nil
	}

	// Ensure finalizer is attached to active resource
	if !controllerutil.ContainsFinalizer(tracer, ebpfFinalizer) {
		controllerutil.AddFinalizer(tracer, ebpfFinalizer)
		if err := r.Update(ctx, tracer); err != nil {
			return ctrl.Result{}, err
		}
	}

	// 3. Construct Desired DaemonSet for eBPF Probes
	desiredDS := r.buildDaemonSet(tracer)

	// Set OwnerReference to enable Kubernetes automatic cascading garbage collection
	if err := controllerutil.SetControllerReference(tracer, desiredDS, r.Scheme); err != nil {
		return ctrl.Result{}, err
	}

	// 4. Reconcile DaemonSet (Create or Update)
	existingDS := &appsv1.DaemonSet{}
	err := r.Get(ctx, client.ObjectKey{Name: desiredDS.Name, Namespace: desiredDS.Namespace}, existingDS)
	if err != nil && errors.IsNotFound(err) {
		logger.Info("Creating new eBPF Telemetry DaemonSet", "Name", desiredDS.Name)
		if err := r.Create(ctx, desiredDS); err != nil {
			return ctrl.Result{}, err
		}
	} else if err != nil {
		return ctrl.Result{}, err
	} else {
		// Update DaemonSet image or env if spec changed
		existingDS.Spec.Template.Spec.Containers[0].Image = tracer.Spec.Image
		if err := r.Update(ctx, existingDS); err != nil {
			return ctrl.Result{}, err
		}
	}

	// 5. Update CRD Status Subresource with retry on conflict
	err = retry.RetryOnConflict(retry.DefaultRetry, func() error {
		latestTracer := &telemetryv1alpha1.EbpfTracer{}
		if err := r.Get(ctx, req.NamespacedName, latestTracer); err != nil {
			return err
		}

		latestDS := &appsv1.DaemonSet{}
		if err := r.Get(ctx, client.ObjectKey{Name: desiredDS.Name, Namespace: desiredDS.Namespace}, latestDS); err == nil {
			latestTracer.Status.ActiveNodes = latestDS.Status.NumberReady
			latestTracer.Status.DesiredNodes = latestDS.Status.DesiredNumberScheduled
			if latestDS.Status.NumberReady == latestDS.Status.DesiredNumberScheduled && latestDS.Status.DesiredNumberScheduled > 0 {
				latestTracer.Status.Phase = "Running"
			} else {
				latestTracer.Status.Phase = "Deploying"
			}
		} else {
			latestTracer.Status.Phase = "Pending"
		}
		latestTracer.Status.ObservedGeneration = latestTracer.Generation

		return r.Status().Update(ctx, latestTracer)
	})

	if err != nil {
		logger.Error(err, "Failed to update EbpfTracer status")
		return ctrl.Result{RequeueAfter: 5 * time.Second}, err
	}

	return ctrl.Result{}, nil
}

// Helper to construct DaemonSet with host capabilities for eBPF
func (r *EbpfTracerReconciler) buildDaemonSet(tracer *telemetryv1alpha1.EbpfTracer) *appsv1.DaemonSet {
	privileged := true
	hostPathCharDev := corev1.HostPathDirectoryOrCreate

	return &appsv1.DaemonSet{
		ObjectMeta: metav1.ObjectMeta{
			Name:      fmt.Sprintf("%s-agent", tracer.Name),
			Namespace: tracer.Namespace,
		},
		Spec: appsv1.DaemonSetSpec{
			Selector: &metav1.LabelSelector{
				MatchLabels: map[string]string{"app": "ebpf-telemetry-agent"},
			},
			Template: corev1.PodTemplateSpec{
				ObjectMeta: metav1.ObjectMeta{
					Labels: map[string]string{"app": "ebpf-telemetry-agent"},
				},
				Spec: corev1.PodSpec{
					HostPID:     true,
					HostNetwork: true,
					Containers: []corev1.Container{
						{
							Name:            "ebpf-agent",
							Image:           tracer.Spec.Image,
							ImagePullPolicy: corev1.PullIfNotPresent,
							SecurityContext: &corev1.SecurityContext{
								Privileged: &privileged,
								Capabilities: &corev1.Capabilities{
									Add: []corev1.Capability{"SYS_ADMIN", "SYS_RESOURCE", "BPF", "PERFMON"},
								},
							},
							VolumeMounts: []corev1.VolumeMount{
								{Name: "sys-kernel-debug", MountPath: "/sys/kernel/debug", ReadOnly: true},
								{Name: "sys-fs-bpf", MountPath: "/sys/fs/bpf"},
							},
						},
					},
					Volumes: []corev1.Volume{
						{Name: "sys-kernel-debug", VolumeSource: corev1.VolumeSource{HostPath: &corev1.HostPathVolumeSource{Path: "/sys/kernel/debug", Type: &hostPathCharDev}}},
						{Name: "sys-fs-bpf", VolumeSource: corev1.VolumeSource{HostPath: &corev1.HostPathVolumeSource{Path: "/sys/fs/bpf", Type: &hostPathCharDev}}},
					},
				},
			},
		},
	}
}

// SetupWithManager configures controller event filters
func (r *EbpfTracerReconciler) SetupWithManager(mgr ctrl.Manager) error {
	return ctrl.NewControllerManagedBy(mgr).
		For(&telemetryv1alpha1.EbpfTracer{}).
		Owns(&appsv1.DaemonSet{}).
		WithEventFilter(predicate.GenerationChangedPredicate{}).
		Complete(r)
}

securityContext:
  capabilities:
    add:
      - BPF
      - PERFMON
      - SYS_RESOURCE

apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: ebpftracers.telemetry.example.com
spec:
  group: telemetry.example.com
  names:
    kind: EbpfTracer
    listKind: EbpfTracerList
    plural: ebpftracers
    singular: ebpftracer
  scope: Namespaced
  versions:
    - name: v1alpha1
      served: true
      storage: true
      subresources:
        status: {}
      schema:
        openAPIV3Schema:
          type: object
          properties:
            apiVersion:
              type: string
            kind:
              type: string
            metadata:
              type: object
            spec:
              type: object
              properties:
                targetNamespaces:
                  type: array
                  items:
                    type: string
                processFilters:
                  type: array
                  items:
                    type: string
                ringBufferSizeMB:
                  type: integer
                  minimum: 2
                  maximum: 128
                  default: 16
                image:
                  type: string
                  default: "quay.io/observability/ebpf-agent:v1.0.0"
            status:
              type: object
              properties:
                activeNodes:
                  type: integer
                desiredNodes:
                  type: integer
                phase:
                  type: string
                observedGeneration:
                  type: integer
      additionalPrinterColumns:
        - name: Phase
          type: string
          jsonPath: .status.phase
        - name: Active Nodes
          type: integer
          jsonPath: .status.activeNodes
        - name: Desired Nodes
          type: integer
          jsonPath: .status.desiredNodes
        - name: Age
          type: date
          jsonPath: .metadata.creationTimestamp

apiVersion: v1
kind: ServiceAccount
metadata:
  name: ebpf-operator-controller-manager
  namespace: ebpf-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: ebpf-operator-manager-role
rules:
  - apiGroups: ["telemetry.example.com"]
    resources: ["ebpftracers"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  - apiGroups: ["telemetry.example.com"]
    resources: ["ebpftracers/status"]
    verbs: ["get", "update", "patch"]
  - apiGroups: ["telemetry.example.com"]
    resources: ["ebpftracers/finalizers"]
    verbs: ["update"]
  - apiGroups: ["apps"]
    resources: ["daemonsets"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  - apiGroups: ["coordination.k8s.io"]
    resources: ["leases"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: ebpf-operator-manager-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: ebpf-operator-manager-role
subjects:
  - kind: ServiceAccount
    name: ebpf-operator-controller-manager
    namespace: ebpf-system
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: ebpf-operator-controller-manager
  namespace: ebpf-system
  labels:
    control-plane: controller-manager
spec:
  replicas: 2
  selector:
    matchLabels:
      control-plane: controller-manager
  template:
    metadata:
      labels:
        control-plane: controller-manager
    spec:
      serviceAccountName: ebpf-operator-controller-manager
      containers:
        - name: manager
          image: quay.io/observability/ebpf-operator:v1.0.0
          command:
            - /manager
          args:
            - --leader-elect
          resources:
            limits:
              cpu: 500m
              memory: 128Mi
            requests:
              cpu: 100m
              memory: 64Mi

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: ebpf-tracer-agent
  namespace: ebpf-system
  labels:
    app: ebpf-telemetry-agent
spec:
  selector:
    matchLabels:
      app: ebpf-telemetry-agent
  template:
    metadata:
      labels:
        app: ebpf-telemetry-agent
    spec:
      hostPID: true
      hostNetwork: true
      serviceAccountName: ebpf-operator-controller-manager
      containers:
        - name: ebpf-agent
          image: quay.io/observability/ebpf-agent:v1.0.0
          imagePullPolicy: IfNotPresent
          securityContext:
            capabilities:
              add:
                - BPF
                - PERFMON
                - SYS_RESOURCE
                - SYS_ADMIN
          volumeMounts:
            - name: sys-kernel-debug
              mountPath: /sys/kernel/debug
              readOnly: true
            - name: sys-fs-bpf
              mountPath: /sys/fs/bpf
          resources:
            limits:
              cpu: 200m
              memory: 64Mi
            requests:
              cpu: 50m
              memory: 32Mi
      volumes:
        - name: sys-kernel-debug
          hostPath:
            path: /sys/kernel/debug
            type: DirectoryOrCreate
        - name: sys-fs-bpf
          hostPath:
            path: /sys/fs/bpf
            type: DirectoryOrCreate

apiVersion: v1
kind: Service
metadata:
  name: ebpf-agent-metrics
  namespace: ebpf-system
  labels:
    app: ebpf-telemetry-agent
spec:
  ports:
    - name: metrics
      port: 9090
      targetPort: 9090
  selector:
    app: ebpf-telemetry-agent
---
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: ebpf-agent-servicemonitor
  namespace: ebpf-system
spec:
  selector:
    matchLabels:
      app: ebpf-telemetry-agent
  endpoints:
    - port: metrics
      interval: 15s
      path: /metrics