From 41c2ef3c0214df9bb0bb63be3d0c9ea08af29796 Mon Sep 17 00:00:00 2001 From: Mayank Pande Date: Wed, 2 Jul 2025 12:35:56 +0530 Subject: [PATCH 1/3] fix: fix for external domain resolution (#148) * fix: fix for external domain resolution * chore: fix for test * chore: added logger for domain resolution * chore: removed arm build * chore: fix for domain discovery * chore: fix for test * fix: fix for test --- .github/workflows/dev-ci.yaml | 2 +- common/net.go | 27 ++++++++++++++------------- common/net_test.go | 4 ++-- containers/container.go | 15 ++------------- containers/l7.go | 14 +++++++------- containers/registry.go | 2 +- 6 files changed, 27 insertions(+), 37 deletions(-) diff --git a/.github/workflows/dev-ci.yaml b/.github/workflows/dev-ci.yaml index 756f2bcf..00a35834 100644 --- a/.github/workflows/dev-ci.yaml +++ b/.github/workflows/dev-ci.yaml @@ -35,7 +35,7 @@ jobs: - name: Build and Push Agent Image uses: docker/build-push-action@v3 with: - platforms: linux/amd64,linux/arm64 + platforms: linux/amd64 context: . file: 'Dockerfile' push: true diff --git a/common/net.go b/common/net.go index 1ace7d65..778f4e33 100644 --- a/common/net.go +++ b/common/net.go @@ -218,26 +218,27 @@ func (d *Domain) String() string { func NewDomain(fqdn string, ips []netaddr.IP) *Domain { d := &Domain{FQDN: fqdn, SpecifyIP: true} - if len(ips) > 1 { - containsPrivateIPs := false - for _, ip := range ips { - if !IsIpExternal(ip) { - containsPrivateIPs = true - break - } - } - if !containsPrivateIPs { - d.SpecifyIP = false - } - } return d } func NewDestinationKey(dst, actualDst netaddr.IPPort, domain *Domain, dstWorkload Workload, actualDestWorkload Workload) DestinationKey { if IsIpExternal(actualDst.IP()) && domain != nil && !domain.SpecifyIP { return DestinationKey{ - destination: HostPortWithEmptyIP(domain.FQDN, dst.Port()), + destination: HostPortWithEmptyIP(domain.FQDN, dst.Port()), + actualDestination: HostPortFromIPPort(actualDst), + destinationWorkload: Workload{ + Kind: "external", + Name: domain.FQDN, + Namespace: "external", + }, + actualDestinationWorkload: Workload{ + Kind: "external", + Name: actualDst.IP().String(), + Namespace: "external", + }, } + } else if IsIpExternal(actualDst.IP()) && domain != nil && domain.SpecifyIP { + klog.Infof("ip %q is external, but domain %q specifies IP, using IP as destination", actualDst.IP(), domain.FQDN) } return DestinationKey{ destination: HostPortFromIPPort(dst), diff --git a/common/net_test.go b/common/net_test.go index 64b57a78..b96e81db 100644 --- a/common/net_test.go +++ b/common/net_test.go @@ -33,7 +33,7 @@ func TestDestinationKey(t *testing.T) { assert.Equal(t, "1.1.1.1:443 (2.2.2.2:443)", NewDestinationKey(d, ad, nil, Workload{}, Workload{}).String()) assert.Equal(t, - "aa.bb.s3.amazonaws.com:443 ()", + "aa.bb.s3.amazonaws.com:443 (2.2.2.2:443)", NewDestinationKey(d, ad, &Domain{FQDN: "aa.bb.s3.amazonaws.com", SpecifyIP: false}, Workload{}, Workload{}).String(), ) assert.Equal(t, @@ -51,7 +51,7 @@ func TestDomain(t *testing.T) { assert.Equal(t, "Domain(fqdn,true)", NewDomain("fqdn", []netaddr.IP{ netaddr.MustParseIP("1.1.1.1"), }).String()) - assert.Equal(t, "Domain(fqdn,false)", NewDomain("fqdn", []netaddr.IP{ + assert.Equal(t, "Domain(fqdn,true)", NewDomain("fqdn", []netaddr.IP{ netaddr.MustParseIP("1.1.1.1"), netaddr.MustParseIP("1.1.1.2"), }).String()) diff --git a/containers/container.go b/containers/container.go index ac1c074c..de96d2f5 100644 --- a/containers/container.go +++ b/containers/container.go @@ -763,7 +763,7 @@ func (c *Container) onDNSRequest(r *l7.RequestData) map[netaddr.IP]*common.Domai return ip2fqdn } -func (c *Container) onL7Request(pid uint32, fd uint64, timestamp uint64, r *l7.RequestData, iqfqdn map[netaddr.IP]*common.Domain) map[netaddr.IP]*common.Domain { +func (c *Container) onL7Request(pid uint32, fd uint64, timestamp uint64, r *l7.RequestData) map[netaddr.IP]*common.Domain { c.lock.Lock() defer c.lock.Unlock() @@ -778,17 +778,6 @@ func (c *Container) onL7Request(pid uint32, fd uint64, timestamp uint64, r *l7.R if timestamp != 0 && conn.Timestamp != timestamp { return nil } - if conn.dstWorkload.Namespace == "external" && (r.Protocol == l7.ProtocolHTTP || r.Protocol == l7.ProtocolHTTP2) { - if host, ok := iqfqdn[conn.DestinationKey.ActualDestination().IP()]; ok { - log.Printf("Setting external host %s", host) - conn.dstWorkload.Name = host.FQDN - } else { - host, error := l7.ParseHostFromHttpRequest(string(r.Payload)) - if error == nil { - conn.dstWorkload.Name = host - } - } - } // Parse HTTP request once if needed var req *http.Request @@ -806,7 +795,7 @@ func (c *Container) onL7Request(pid uint32, fd uint64, timestamp uint64, r *l7.R if headers != nil { traceId = trace.ExtractTraceId(headers) } - stats := c.l7Stats.get(r.Protocol, conn.DestinationKey, r, conn.srcWorkload, conn.DestinationKey.GetDestinationWorkload(), conn.DestinationKey.GetActualDestinationWorkload(), traceId) + stats := c.l7Stats.get(r.Protocol, conn.DestinationKey, r, conn.srcWorkload, traceId) switch r.Protocol { case l7.ProtocolHTTP: stats.observe(r.Status.Http(), "", r.Duration) diff --git a/containers/l7.go b/containers/l7.go index 56e02807..da36fafb 100644 --- a/containers/l7.go +++ b/containers/l7.go @@ -38,7 +38,7 @@ func (m *L7Metrics) observe(status, method string, duration time.Duration) { type L7Stats map[l7.Protocol]map[common.DestinationKey]*L7Metrics // protocol -> dst:actual_dst -> metrics -func (s L7Stats) get(protocol l7.Protocol, key common.DestinationKey, r *l7.RequestData, srcWorkload common.Workload, dstWorkload common.Workload, actualDstWorkload common.Workload, traceId string) *L7Metrics { +func (s L7Stats) get(protocol l7.Protocol, key common.DestinationKey, r *l7.RequestData, srcWorkload common.Workload, traceId string) *L7Metrics { if protocol == l7.ProtocolHTTP2 { protocol = l7.ProtocolHTTP } @@ -53,15 +53,15 @@ func (s L7Stats) get(protocol l7.Protocol, key common.DestinationKey, r *l7.Requ protoStats[key] = m constLabels := map[string]string{"destination": key.DestinationLabelValue(), "actual_destination": key.ActualDestinationLabelValue(), - "destination_workload_kind": dstWorkload.Kind, - "destination_workload_name": dstWorkload.Name, - "destination_workload_namespace": dstWorkload.Namespace, + "destination_workload_kind": key.GetDestinationWorkload().Kind, + "destination_workload_name": key.GetDestinationWorkload().Name, + "destination_workload_namespace": key.GetDestinationWorkload().Namespace, "src_workload_kind": srcWorkload.Kind, "src_workload_name": srcWorkload.Name, "src_workload_namespace": srcWorkload.Namespace, - "actual_destination_workload_kind": actualDstWorkload.Kind, - "actual_destination_workload_name": actualDstWorkload.Name, - "actual_destination_workload_namespace": actualDstWorkload.Namespace, + "actual_destination_workload_kind": key.GetActualDestinationWorkload().Kind, + "actual_destination_workload_name": key.GetActualDestinationWorkload().Name, + "actual_destination_workload_namespace": key.GetActualDestinationWorkload().Namespace, } if traceId != "" { constLabels["trace_id"] = traceId diff --git a/containers/registry.go b/containers/registry.go index 15be6902..8d83c90e 100644 --- a/containers/registry.go +++ b/containers/registry.go @@ -294,7 +294,7 @@ func (r *Registry) handleEvents(ch <-chan ebpftracer.Event) { continue } if c := r.containersByPid[e.Pid]; c != nil { - ip2fqdn := c.onL7Request(e.Pid, e.Fd, e.Timestamp, e.L7Request, r.ip2fqdn) + ip2fqdn := c.onL7Request(e.Pid, e.Fd, e.Timestamp, e.L7Request) r.ip2fqdnLock.Lock() for ip, domain := range ip2fqdn { r.ip2fqdn[ip] = domain From 6a27da6bacc2711a3555d635f91619714c078163 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 4 Sep 2025 14:25:32 +0530 Subject: [PATCH 2/3] build(deps): bump github.com/ulikunitz/xz from 0.5.12 to 0.5.14 (#152) Bumps [github.com/ulikunitz/xz](https://github.com/ulikunitz/xz) from 0.5.12 to 0.5.14. - [Commits](https://github.com/ulikunitz/xz/compare/v0.5.12...v0.5.14) --- updated-dependencies: - dependency-name: github.com/ulikunitz/xz dependency-version: 0.5.14 dependency-type: indirect ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 3 +-- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/go.mod b/go.mod index cf46bd6f..507db2b8 100644 --- a/go.mod +++ b/go.mod @@ -161,7 +161,7 @@ require ( github.com/spf13/pflag v1.0.6-0.20210604193023-d5e0c0615ace // indirect github.com/spf13/viper v1.19.0 // indirect github.com/subosito/gotenv v1.6.0 // indirect - github.com/ulikunitz/xz v0.5.12 // indirect + github.com/ulikunitz/xz v0.5.14 // indirect github.com/x448/float16 v0.8.4 // indirect go.etcd.io/etcd/api/v3 v3.5.17 // indirect go.etcd.io/etcd/client/pkg/v3 v3.5.17 // indirect @@ -190,7 +190,6 @@ require ( gopkg.in/inf.v0 v0.9.1 // indirect gopkg.in/ini.v1 v1.67.0 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect - gotest.tools v2.2.0+incompatible k8s.io/apiextensions-apiserver v0.32.0 // indirect k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f // indirect k8s.io/utils v0.0.0-20241210054802-24370beab758 // indirect diff --git a/go.sum b/go.sum index 0dc77c27..0cffae0e 100644 --- a/go.sum +++ b/go.sum @@ -911,8 +911,8 @@ github.com/tchap/go-patricia v2.2.6+incompatible/go.mod h1:bmLyhP68RS6kStMGxByiQ github.com/tmc/grpc-websocket-proxy v0.0.0-20170815181823-89b8d40f7ca8/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U= github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U= github.com/ugorji/go v1.1.4/go.mod h1:uQMGLiO92mf5W77hV/PUCpI3pbzQx3CRekS0kk+RGrc= -github.com/ulikunitz/xz v0.5.12 h1:37Nm15o69RwBkXM0J6A5OlE67RZTfzUxTj8fB3dfcsc= -github.com/ulikunitz/xz v0.5.12/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14= +github.com/ulikunitz/xz v0.5.14 h1:uv/0Bq533iFdnMHZdRBTOlaNMdb1+ZxXIlHDZHIHcvg= +github.com/ulikunitz/xz v0.5.14/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14= github.com/urfave/cli v0.0.0-20171014202726-7bc6a0acffa5/go.mod h1:70zkFmudgCuE/ngEzBv17Jvp/497gISqfk5gWijbERA= github.com/urfave/cli v1.20.0/go.mod h1:70zkFmudgCuE/ngEzBv17Jvp/497gISqfk5gWijbERA= github.com/urfave/cli v1.22.1/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0= From 29da74f2b28fafdbcec45e6f8a9f684d77f34650 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 4 Sep 2025 14:25:57 +0530 Subject: [PATCH 3/3] build(deps): bump github.com/docker/docker (#151) Bumps [github.com/docker/docker](https://github.com/docker/docker) from 27.4.0+incompatible to 28.0.0+incompatible. - [Release notes](https://github.com/docker/docker/releases) - [Commits](https://github.com/docker/docker/compare/v27.4.0...v28.0.0) --- updated-dependencies: - dependency-name: github.com/docker/docker dependency-version: 28.0.0+incompatible dependency-type: direct:production ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 507db2b8..54ae755e 100644 --- a/go.mod +++ b/go.mod @@ -12,7 +12,7 @@ require ( github.com/containerd/cgroups v1.0.4 github.com/containerd/containerd v1.6.38 github.com/coreos/go-systemd/v22 v22.5.0 - github.com/docker/docker v27.4.0+incompatible + github.com/docker/docker v28.0.0+incompatible github.com/florianl/go-conntrack v0.3.0 github.com/go-kit/log v0.2.1 github.com/godbus/dbus/v5 v5.1.0 diff --git a/go.sum b/go.sum index 0cffae0e..b95253b9 100644 --- a/go.sum +++ b/go.sum @@ -306,8 +306,8 @@ github.com/docker/distribution v0.0.0-20190905152932-14b96e55d84c/go.mod h1:0+TT github.com/docker/distribution v2.7.1-0.20190205005809-0d3efadf0154+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w= github.com/docker/distribution v2.7.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w= github.com/docker/docker v1.4.2-0.20190924003213-a8608b5b67c7/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk= -github.com/docker/docker v27.4.0+incompatible h1:I9z7sQ5qyzO0BfAb9IMOawRkAGxhYsidKiTMcm0DU+A= -github.com/docker/docker v27.4.0+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk= +github.com/docker/docker v28.0.0+incompatible h1:Olh0KS820sJ7nPsBKChVhk5pzqcwDR15fumfAd/p9hM= +github.com/docker/docker v28.0.0+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk= github.com/docker/docker-credential-helpers v0.6.3/go.mod h1:WRaJzqw3CTB9bk10avuGsjVBZsD05qeibJ1/TYlvc0Y= github.com/docker/go-connections v0.4.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec= github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=