Document PR #1981 (packetparser ring buffer support)
- Dominant language
- Go
- Stars
- 3.2k
- Forks
- 304
- Avg merge
- 1d 16h
- Merged PRs (30d)
- 79
Description
## Summary
Document the changes from PR microsoft/retina#1981, which adds configurable BPF ring buffer support for the packetparser plugin as an alternative to perf event arrays.
## Changes to Capture
- Configuration: added `enablePacketParserRingBuffer` (bool) and `packetParserRingBufferSize` (uint32) in config and Helm values.
- BPF: packetparser BPF program can compile with `BPF_MAP_TYPE_RINGBUF` when enabled.
- Userspace: packetparser uses a ring buffer reader via a wrapper to conform to the existing reader interface and logs which buffer type is active.
- Build flags: BPF compilation adds `-DUSE_RING_BUFFER` and `-DRING_BUFFER_SIZE` when enabled.
- Tests: updated unit tests and added coverage for ring buffer compilation.
## Verification Notes
- Unit tests: `go test -v ./pkg/plugin/packetparser/...`
- Manual: Kind deployment with ring buffer enabled, logs show ring buffer reader, `bpftool` shows map type `ringbuf`.
- Verify metrics are generated as expected.
## Related
- Issue: https://github.com/microsoft/retina/issues/1966
- Issue: https://github.com/microsoft/retina/issues/655
- PR: https://github.com/microsoft/retina/pull/1965
## Open Questions / Follow-ups
- Consider a tri-state config (auto/enabled/disabled) once runtime decision logic exists.
- Implement auto mode so Retina decides the map type at runtime.
- Document pros/cons and guidance for choosing ring buffer vs perf array.
Contributor guide
Assessment
This issue has not been assessed yet.