tetragon

1
// SPDX-License-Identifier: Apache-2.0
2
// Copyright Authors of Tetragon
3

4
package metrics_test
5

6
import (
7
	"testing"
8

9
	"github.com/prometheus/client_golang/prometheus"
10
	io_prometheus_client "github.com/prometheus/client_model/go"
11
	"github.com/stretchr/testify/assert"
12
	"github.com/stretchr/testify/require"
13
	corev1 "k8s.io/api/core/v1"
14
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
15

16
	"github.com/cilium/tetragon/api/v1/tetragon"
17
	"github.com/cilium/tetragon/pkg/grpc/tracing"
18
	"github.com/cilium/tetragon/pkg/metrics"
19
	"github.com/cilium/tetragon/pkg/metrics/eventmetrics"
20
	"github.com/cilium/tetragon/pkg/metricsconfig"
21
)
22

23
var sampleMsgGenericTracepointUnix = tracing.MsgGenericTracepointUnix{
24
	PolicyName: "fake-policy",
25
}
26

27
func TestPodDelete(t *testing.T) {
28
	reg := metricsconfig.GetRegistry()
29
	metricsconfig.InitAllMetrics(reg)
30

31
	// Process four events, each one with different combination of pod/namespace.
32
	// These events should be counted by multiple metrics with a "pod" label:
33
	// * tetragon_events_total
34
	// * tetragon_policy_events_total
35
	// * tetragon_syscalls_total
36
	for _, namespace := range []string{"fake-namespace", "other-namespace"} {
37
		for _, pod := range []string{"fake-pod", "other-pod"} {
38
			event := tetragon.GetEventsResponse{
39
				Event: &tetragon.GetEventsResponse_ProcessTracepoint{
40
					ProcessTracepoint: &tetragon.ProcessTracepoint{
41
						Subsys: "raw_syscalls",
42
						Event:  "sys_enter",
43
						Process: &tetragon.Process{
44
							Pod: &tetragon.Pod{
45
								Namespace: namespace,
46
								Name:      pod,
47
							},
48
						},
49
						Args: []*tetragon.KprobeArgument{
50
							{
51
								Arg: &tetragon.KprobeArgument_LongArg{
52
									LongArg: 0,
53
								},
54
							},
55
						},
56
					},
57
				},
58
			}
59
			eventmetrics.ProcessEvent(&sampleMsgGenericTracepointUnix, &event)
60
		}
61
	}
62
	checkMetricSeriesCount(t, reg, 4)
63

64
	// Exactly one timeseries should be deleted for each metric (matching both
65
	// pod name and namespace).
66
	metrics.DeleteMetricsForPod(&corev1.Pod{
67
		ObjectMeta: metav1.ObjectMeta{
68
			Name:      "fake-pod",
69
			Namespace: "fake-namespace",
70
		},
71
	})
72
	checkMetricSeriesCount(t, reg, 3)
73
}
74

75
func checkMetricSeriesCount(t *testing.T, registry *prometheus.Registry, seriesCount int) {
76
	metricFamilies, err := registry.Gather()
77
	require.NoError(t, err)
78

79
	metricNameToSeries := map[string]*io_prometheus_client.MetricFamily{}
80
	for _, metricFamily := range metricFamilies {
81
		metricNameToSeries[*metricFamily.Name] = metricFamily
82
	}
83
	for _, metric := range []string{"tetragon_events_total", "tetragon_policy_events_total", "tetragon_syscalls_total"} {
84
		metricFamily := metricNameToSeries[metric]
85
		require.NotNil(t, metricFamily)
86
		assert.Len(t, metricFamily.Metric, seriesCount)
87
	}
88
}
89