Add bpffs mount capability to bpfman-agent for init container use #490
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
frobware
force-pushed
the
agent-mount-bpffs-v2
branch
from
f00d8ba to
0076d94
Compare
dave-tucker
previously approved these changes
Jan 9, 2026
Contributor
|
@frobware, this pull request is now in conflict and requires a rebase. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #490 +/- ##
===========================
===========================
☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
The BpffsInitImage field in DaemonSpec allowed overriding the init container image that mounts bpffs. This configurability is no longer required as the init container will use the agent image directly in subsequent changes. Remove the field from the API, the corresponding override logic from the controller, and update the tests to only cover CSI registrar image overrides. Signed-off-by: Andrew McDermott <amcdermo@redhat.com>
Regenerate the Config CRD and OLM bundle manifests following the removal of the BpffsInitImage field from the DaemonSpec API. Signed-off-by: Andrew McDermott <amcdermo@redhat.com>
The init container that ensures bpffs is mounted before the main containers start previously used a fedora-minimal image with findmnt and mount utilities. This had two drawbacks: pulling an additional container image on startup, and incompatibility with minimal base images like ubi9-minimal that lack these utilities. By moving this functionality into the agent, downstream bpfman distributions no longer need a custom init container image, and the operator does not need to parameterise the init container image reference. Extend bpfman-agent with --mount-bpffs flag to handle this directly. The agent now parses /proc/self/mountinfo to check for existing bpf mounts (matching libmount's parsing approach from util-linux) and uses syscall.Mount when needed. This eliminates the external image dependency since the agent image is already pulled for the main container. Add internal/bpffs package with: - IsMounted: parse mountinfo to detect bpf mounts at a given path - Mount: create bpffs mount, creating the directory if needed - Unmount: remove a bpffs mount - EnsureMounted: idempotent helper for the common check-then-mount pattern The --mount-bpffs-remount flag forces a fresh mount by unmounting first if already mounted, useful for testing the mount code path. Both modes handle the race where another process might mount between check and mount by treating mount failures as success if the filesystem is now mounted. Signed-off-by: Andrew McDermott <amcdermo@redhat.com>
The configureBpfmanDs function was only updating images for the main containers, leaving the mount-bpffs init container with a hardcoded image reference. This caused CI failures because the init container would use quay.io/bpfman/bpfman-agent:latest instead of the freshly built test image, meaning the --mount-bpffs functionality was not available. Add logic to update the init container image from config.Spec.Agent.Image, consistent with how the bpfman-agent container image is configured. Signed-off-by: Andrew McDermott <amcdermo@redhat.com>
frobware
force-pushed
the
agent-mount-bpffs-v2
branch
from
0076d94 to
e8515ec
Compare
Contributor
Author
The lifecycle test was failing because it used hardcoded :latest image tags when creating a new Config, but CI only loads :int-test images into the kind cluster. The init container now uses the agent image from the Config, so when the test created a Config with :latest images, the pods would fail to start. Read image tags from environment variables (BPFMAN_IMG, BPFMAN_AGENT_IMG) with fallback to :latest defaults for local testing. This aligns with how the integration tests handle images. Also fix the error formatting in waitUntilCondition which was using ctx.Err() instead of timeoutCTX.Err(), producing malformed error messages like "%!w(<nil>)" when the timeout fired. Signed-off-by: Andrew McDermott <amcdermo@redhat.com>
frobware
force-pushed
the
agent-mount-bpffs-v2
branch
from
e8515ec to
093ba4b
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This replaces the current init container approach that uses a fedora-minimal image with
findmntandmountutilities.The
findmntsolution introduced in #477 correctly fixed the overlay mount problem by checking the filesystem type rather than grepping for a specific source name. This PR preserves that fix while eliminating the external image dependency.Why change?
The current approach has two drawbacks:
findmntandmount, even though the agent image is already being pulledBy moving this functionality into bpfman-agent itself, downstream distributions no longer need a custom init container image, and we don't need to parameterise the init container image reference.
How it works
The agent gains a
--mount-bpffsflag that:/proc/self/mountinfoto check for existing bpf mounts (using the same approach as libmount from util-linux)syscall.Mountif neededThis is functionally equivalent to:
The init container now just runs:
Testing
A
--mount-bpffs-remountflag is also available for testing - it unmounts first if mounted, then mounts, ensuring the mount code path is exercised.Tested on kind with the daemon pod running successfully.