bpf: make BPF unit tests reproducible

.github/workflows/lint-bpf-checks.yaml

@@ -45,7 +45,7 @@ jobs:
             coccinelle:
               - 'contrib/coccinelle/**'
             bpf-tests-runner:
-              - 'test/bpf_tests/**'
+              - 'bpf/tests/bpftest/**'
               - 'pkg/bpf/**'
             workflow-description:
               - '.github/workflows/lint-bpf-checks.yaml'
@@ -140,32 +140,11 @@ jobs:
     name: BPF unit/integration Tests
     runs-on: ubuntu-22.04
     steps:
-      - name: Install Go
-        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
-        with:
-          # renovate: datasource=golang-version depName=go
-          go-version: 1.22.1
-      - name: Cache LLVM and Clang
-        id: cache-llvm
-        uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319 # v4.0.1
-        with:
-          path: ${{ needs.set_clang_dir.outputs.clang_dir }}
-          key: llvm-10.0
-      - name: Install LLVM and Clang prerequisites
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends libtinfo5
-      - name: Install LLVM and Clang
-        uses: KyleMayes/install-llvm-action@be40c5af3a4adc3e4a03199995ab73aa37536712 # v1.9.0
-        with:
-          version: "10.0"
-          directory: ${{ needs.set_clang_dir.outputs.clang_dir }}
-          cached: ${{ steps.cache-llvm.outputs.cache-hit }}
       - name: Checkout code
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           persist-credentials: false
           fetch-depth: 0
       - name: Run BPF tests
         run: |
-          make -C test run_bpf_tests || (echo "Run 'make -C test run_bpf_tests' locally to investigate failures"; exit 1)
+          make run_bpf_tests || (echo "Run 'make run_bpf_tests' locally to investigate failures"; exit 1)

CODEOWNERS

@@ -544,7 +544,7 @@ Makefile* @cilium/build
 /test/k8s/services.go @cilium/sig-lb @cilium/ci-structure
 # Datapath tests
 /test/bpf/ @cilium/sig-datapath
-/test/bpf_tests/ @cilium/sig-datapath
+/bpf/tests/bpftest/ @cilium/sig-datapath
 /test/k8s/bandwidth.go @cilium/sig-datapath @cilium/ci-structure
 /test/k8s/chaos.go @cilium/sig-datapath @cilium/ci-structure
 /test/k8s/datapath_configuration.go @cilium/sig-datapath @cilium/ci-structure

Documentation/contributing/testing/bpf.rst

@@ -27,18 +27,11 @@ To run the tests in your local environment, execute the following command from t
 
 .. code-block:: shell-session
 
-    $ make -C test run_bpf_tests
-
-The output is verbose by default. Verbose mode can be disabled by setting the ``V`` option to ``0``:
-
-.. code-block:: shell-session
-
-    $ make -C test run_bpf_tests V=0
+    $ make run_bpf_tests
 
 .. note:: 
 
-    Running BPF tests only works on Linux machines and requires admin privileges.
-    The makefile uses sudo implicitly and may prompt you for credentials.
+    Running BPF tests requires Docker and is only expected to work on Linux.
 
 Writing tests
 =============

Makefile

@@ -573,7 +573,10 @@ force :;
 # it exists here so the entire source code repo can be mounted into the container.
 CILIUM_BUILDER_IMAGE=$(shell cat images/cilium/Dockerfile | grep "ARG CILIUM_BUILDER_IMAGE=" | cut -d"=" -f2)
 run_bpf_tests:
-	docker run -v $$(pwd):/src --privileged -w /src -e RUN_WITH_SUDO=false $(CILIUM_BUILDER_IMAGE) "make" "-C" "test/" "run_bpf_tests"
+	docker run --rm --privileged \
+		-v $$(pwd):/src -w /src \
+		$(CILIUM_BUILDER_IMAGE) \
+		"make" "-j$(shell nproc)" "-C" "bpf/tests/" "all" "run"
 
 run-builder:
 	docker run -it --rm -v $$(pwd):/go/src/github.com/cilium/cilium $(CILIUM_BUILDER_IMAGE) bash

bpf/tests/Makefile

@@ -27,22 +27,22 @@ else
 CLANG_FLAGS += -mcpu=v2
 endif
 
-.PHONY: all clean
+.PHONY: all clean run
 
 TEST_OBJECTS = $(patsubst %.c, %.o, $(wildcard *.c))
 
 %.o: %.c $(LIB)
-	$(ECHO_CC)
-	# Remove the .o file to force recompilation, only rely on make's caching, not clangs
+	@$(ECHO_CC)
+	@# Remove the .o file to force recompilation, only rely on make's caching, not clangs
 	rm -f $@
 	$(QUIET) ${CLANG} ${CLANG_FLAGS} -c $< -o $@
 
 %.ll: %.c $(LIB)
-	$(ECHO_CC)
+	@$(ECHO_CC)
 	$(QUIET) ${CLANG} ${CLANG_FLAGS} -c -emit-llvm $< -o $@
 
 %.i: %.c $(LIB)
-	$(ECHO_CC)
+	@$(ECHO_CC)
 	$(QUIET) ${CLANG} ${CLANG_FLAGS} -E -c $< -o $@
 
 all: $(TEST_OBJECTS)
@@ -53,4 +53,33 @@ clean:
 	rm -f $(wildcard *.i)
 	rm -f $(wildcard *.d)
 
+BPF_TEST_FLAGS:=
+ifneq ($(shell id -u), 0)
+		BPF_TEST_FLAGS += -exec "sudo -E"
+endif
+ifeq ($(V),1)
+    BPF_TEST_FLAGS += -test.v
+endif
+ifeq ($(COVER),1)
+	ifndef COVERFORMAT
+		COVERFORMAT:=html
+	endif
+    BPF_TEST_FLAGS += -coverage-report $(ROOT_DIR)/bpf-coverage.$(COVERFORMAT) -coverage-format $(COVERFORMAT)
+ifdef NOCOVER
+    BPF_TEST_FLAGS += -no-test-coverage "$(NOCOVER)"
+endif
+endif
+ifeq ($(INSTRLOG),1)
+    BPF_TEST_FLAGS += -instrumentation-log $(ROOT_DIR)/test/bpf-instrumentation.log
+endif
+ifdef RUN
+    BPF_TEST_FLAGS += -run $(RUN)
+endif
+ifdef DUMPCTX
+    BPF_TEST_FLAGS += -dump-ctx
+endif
+
+run:
+	$(QUIET)$(GO) test ./bpftest -bpf-test-path $(ROOT_DIR)/bpf/tests $(BPF_TEST_FLAGS)
+
 -include $(TEST_OBJECTS:.o=.d)

bpf/tests/common.h

@@ -58,7 +58,7 @@
 	___bpf_apply(__bpf_log_arg, ___bpf_narg(args))(ptr, args)
 
 /* These values have to stay in sync with the enum */
-/* values in test/bpf_tests/trf.proto */
+/* values in bpf/tests/bpftest/trf.proto */
 #define TEST_ERROR 0
 #define TEST_PASS 1
 #define TEST_FAIL 2

test/Makefile

@@ -28,7 +28,7 @@ GINKGO = $(QUIET) ginkgo
 
 REGISTRY_CREDENTIALS ?= "${DOCKER_LOGIN}:${DOCKER_PASSWORD}"
 
-.PHONY = all build test run k8s-test k8s-kind clean run_bpf_tests
+.PHONY = all build test run k8s-test k8s-kind clean
 
 all: build
 
@@ -78,29 +78,3 @@ clean:
 	-$(QUIET) rm -f .vagrant/*.box
 	-$(QUIET)$(MAKE) -C bpf/ clean
 
-BPF_TEST_FLAGS:=
-ifeq ($(V),1)
-    BPF_TEST_FLAGS += -test.v
-endif
-ifeq ($(COVER),1)
-	ifndef COVERFORMAT
-		COVERFORMAT:=html
-	endif
-    BPF_TEST_FLAGS += -coverage-report $(ROOT_DIR)/bpf-coverage.$(COVERFORMAT) -coverage-format $(COVERFORMAT)
-ifdef NOCOVER
-    BPF_TEST_FLAGS += -no-test-coverage "$(NOCOVER)"
-endif
-endif
-ifeq ($(INSTRLOG),1)
-    BPF_TEST_FLAGS += -instrumentation-log $(ROOT_DIR)/test/bpf-instrumentation.log
-endif
-ifdef RUN
-    BPF_TEST_FLAGS += -run $(RUN)
-endif
-ifdef DUMPCTX
-    BPF_TEST_FLAGS += -dump-ctx
-endif
-
-run_bpf_tests:
-	$(QUIET)$(MAKE) -C ../bpf/tests all
-	$(QUIET)$(GO) test ./bpf_tests $(RUN_WITH_SUDO) -bpf-test-path $(ROOT_DIR)/bpf/tests $(BPF_TEST_FLAGS)