Document PR #1981 (packetparser ring buffer support)

[SRodi]

Summary

Document the changes from PR #1981, which adds configurable BPF ring buffer support for the packetparser plugin as an alternative to perf event arrays.

Changes to Capture

• Configuration: added enablePacketParserRingBuffer (bool) and packetParserRingBufferSize (uint32) in config and Helm values.
• BPF: packetparser BPF program can compile with BPF_MAP_TYPE_RINGBUF when enabled.
• Userspace: packetparser uses a ring buffer reader via a wrapper to conform to the existing reader interface and logs which buffer type is active.
• Build flags: BPF compilation adds -DUSE_RING_BUFFER and -DRING_BUFFER_SIZE when enabled.
• Tests: updated unit tests and added coverage for ring buffer compilation.

Verification Notes

• Unit tests: go test -v ./pkg/plugin/packetparser/...
• Manual: Kind deployment with ring buffer enabled, logs show ring buffer reader, bpftool shows map type ringbuf.
• Verify metrics are generated as expected.

Related

• Issue: offer configurable BPF ring buffers (BPF_MAP_TYPE_RINGBUF) impl in packetparser #1966
• Issue: Degraded node network throughput when retin is installed #655
• PR: docs(perf): Considerations for packetparser on high-core-count systems #1965

Open Questions / Follow-ups

• Consider a tri-state config (auto/enabled/disabled) once runtime decision logic exists.
• Implement auto mode so Retina decides the map type at runtime.
• Document pros/cons and guidance for choosing ring buffer vs perf array.