Ask or search…
K
Comment on page

eBPF sensor

Intro

groundcover’s eBPF sensor, Flora, uses state-of-the-art kernel features to provide full coverage at low overhead. In order to do so it requires certain kernel features which are listed below.
groundcover may work on many other linux kernels, but we might just didn't get a chance to test it yet. Can't find yours in the list? let us know over Slack.

Kernel Version

Version v5.3 or higher (anything since 2020)
Your kernel version is older? Check out Legacy Mode!

Linux Distributions

Name
Supported Versions
Debian
11+
RedHat Enterprise Linux
8.2+
Ubuntu
20.10+
CentOS
7.3+
Fedora
31+
BottlerocketOS
1.10+
Amazon Linux
All off the shelf AMIs
Google COS
All off the shelf AMIs
Azure Linux
All off the shelf AMIs

Permissions

Loading eBPF code requires running privileged containers. While this might seem unusual, there's nothing to worry about - eBPF is safe by design!

CO:RE support

Flora uses eBPF’s CO:RE feature in order to support the vast variety of linux kernels and distributions detailed above. This feature requires the kernel to be compiled with BTF information (enabled using the CONFIG_BTF_ENABLE=Y kernel compilation flag). This is the case for most common distributions nowadays.
You can check if your kernel has CO:RE support by manually looking for the BTF file:
$ ls -la /sys/kernel/btf/vmlinux
- r--r--r--. 1 root root 3541561 Jun 2 18:16 /sys/kernel/btf/vmlinux
If the file exists, congratulations! Your kernel supported CO:RE.

Legacy Mode

If your kernel is too old or you don’t have CO:RE support - groundcover still has your back. Our legacy eBPF agent is not as optimized and efficient as Flora, but it supports older systems as well - anything with linux kernel 4.14+.
To install using legacy mode follow the instructions here.

What happens if my kernel is not supported?

If your system does not fit into any of the above - unfortunately, our eBPF sensor will not be able to run on your environment. However, this does not mean groundcover won’t collect any data. You will still be able to inspect your k8s environment, see all collected logs and use integrations with outer data sources.