new(userspace/falco): [EXPERIMENTAL] allow modern bpf probe to assign more than one CPU to a single ring buffer #2363
Conversation
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
|
Tentatively |
|
LGTM label has been added. Git tree hash: 58e62a52f8827b8eb024fea15b68939434b60166
|
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: Andreagit97, FedeDP, jasondellaluce, leogr The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
1 similar comment
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: Andreagit97, FedeDP, jasondellaluce, leogr The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Signed-off-by: Andrea Terzolo andrea.terzolo@polito.it
What type of PR is this?
/kind feature
Any specific area of the project related to this PR?
/area engine
What this PR does / why we need it:
This PR allows Falco to take advantage of a new modern BPF feature: to assign more than one CPU to a single ring buffer.
This feature is EXPERIMENTAL, and you can use it only with the modern BPF probe. With EXPERIMENTAL, we mean that this config could be changed or removed across releases.
You can find more info about the feature datil here: falcosecurity/libs#820
To learn how to use this new config see
falco.yamlfile in the PRWhich issue(s) this PR fixes:
Special notes for your reviewer:
Does this PR introduce a user-facing change?: