Could not found a container for a registered process

[mjura]

After migration to Aya we can observe new issue.

How to reproduce it:

1. Install lockcd using normal procedure
2. Launch some example pods
3. Try to connect to pods
4. Upgrade helm lockcd release
5. After trying to connect to pods we can see following errors:

mjura@gecko:~/git/lockc> kubectl logs -n lockc lockcd-dn7kf -f
2022-02-09T14:08:17.937616Z ERROR lockcd: could not send eBPF command result although the operation was succeessful command="add_proceess

bpftool prog trace
...
runc-30504   [001] d..21 624920.732342: bpf_trace_printk: error: get_policy_level: could not found a container for a registered process

mjura@gecko:~/lockc> kubectl exec -ti myapp-7bb5f9b56b-vqjxc -- bash
error: Internal error occurred: error executing command in container: failed to exec in container: failed to start exec "da94fe7fa19be99a826d1f93776b389112b7925bc13bdd45d97436431cb86db7": OCI runtime exec failed: exec failed: container_linux.go:380: starting container process caused: process_linux.go:99: starting setns process caused: fork/exec /proc/self/exe: operation not permitted: unknown

[mjura]

This issue looks like similar issue for #145

[vadorovsky]

Potentially a bug in Aya, which should reuse the maps simply by the map_pin_path param here

https://github.com/rancher-sandbox/lockc/blob/main/lockc/src/load.rs#L14

[vadorovsky]

Places to debug:

https://github.com/aya-rs/aya/blob/2a1823934671ced3c910a2e6f287ba569bea9c60/aya/src/bpf.rs#L217-L220
https://github.com/aya-rs/aya/blob/2a1823934671ced3c910a2e6f287ba569bea9c60/aya/src/bpf.rs#L346-L361
and the most important:
https://github.com/aya-rs/aya/blob/2a1823934671ced3c910a2e6f287ba569bea9c60/aya/src/maps/mod.rs#L241-L267

[vadorovsky]

Disregard my comments above ^^

All is good in Aya. The issue is that it just pins map differently than libbpf.

So basically, there are two ways:

• setting pinned attribute in map definitions, in code - then pinning happens as soon as the BPF object is loaded - that's what Aya and Cilium are using
• libbpf doesn't honor that attribute and they expect people to use .pinned function/method explicitly, after the BPF object is loaded

I just had to adjust our C code to the 1st way.