cilium / tetragon

eBPF-based Security Observability and Runtime Enforcement
https://tetragon.io
Apache License 2.0
3.66k stars 369 forks source link

Cleanup unnecessary cilium/cilium dependencies #2651

Open lambdanis opened 4 months ago

lambdanis commented 4 months ago

I used gomod to check how Tetragon depends on cilium/cilium Go packages. Here we go:

gomod graph --style cluster=full -p 'deps(github.com/cilium/tetragon/**, 1) inter rdeps(github.com/cilium/cilium/**, 1)' > tetragon-cilium.dot && dot -Tpng -o tetragon-cilium.png tetragon-cilium.dot

tetragon-cilium (To make it clear - these are dependencies in Go code only. Tetragon doesn't have runtime dependencies on Cilium).

Many of these are just small helpers imported from cilium/cilium for historical reasons. We should review them and remove unnecessary dependencies. If Tetragon is importing a package from cilium/cilium just to use a small helper, it might make sense to write such helper inside Tetragon codebase.

Some cilium/cilium dependencies were removed already in #794/#2580, but there are several remaining. What's particularly problematic are transitive dependencies of k8s libraries via cilium/cilium. Because not all interfaces are stable, this means version of k8s libraries is tied to cilium/cilium version. Here's a graph of such dependencies:

gomod graph --style cluster=full -p 'deps(github.com/cilium/tetragon/**, 1) inter rdeps(github.com/cilium/cilium/**, 1) inter (rdeps(k8s.io/**) + rdeps(sigs.k8s.io/**))' > tetragon-cilium-k8s.dot && dot -Tpng -o tetragon-cilium-k8s.png tetragon-cilium-k8s.dot

tetragon-cilium-k8s

mtardy commented 4 months ago

Another dependency that is not great is within the bpf package https://github.com/cilium/tetragon/pull/2717#issuecomment-2244670751.

yashathwani commented 3 months ago

Would like to work on this issue could you please assign it to me !!

mtardy commented 3 months ago

Would like to work on this issue could you please assign it to me !!

sure go ahead, please feel free to ask questions. :)