eBPF sensor
Intro
groundcover’s eBPF sensor, Flora, uses state-of-the-art kernel features to provide full coverage at low overhead. In order to do so it requires certain kernel features which are listed below.
groundcover may work on many other linux kernels, but we might just didn't get a chance to test it yet. Can't find yours in the list? let us know over Slack.
Kernel Version
Version v5.3 or higher (anything since 2020)
Your kernel version is older? Check out Legacy Mode!
Linux Distributions
Permissions
Loading eBPF code requires running privileged containers. While this might seem unusual, there's nothing to worry about - eBPF is safe by design!
CO:RE support
Flora uses eBPF’s CO:RE feature in order to support the vast variety of linux kernels and distributions detailed above. This feature requires the kernel to be compiled with BTF information (enabled using the CONFIG_BTF_ENABLE=Y kernel compilation flag). This is the case for most common distributions nowadays.
You can check if your kernel has CO:RE support by manually looking for the BTF file:
If the file exists, congratulations! Your kernel supported CO:RE.
Legacy Mode
If your kernel is too old or you don’t have CO:RE support - groundcover still has your back. Our legacy eBPF agent is not as optimized and efficient as Flora, but it supports older systems as well - anything with linux kernel 4.14+.
To install using legacy mode follow the instructions here.
What happens if my kernel is not supported?
If your system does not fit into any of the above - unfortunately, our eBPF sensor will not be able to run on your environment. However, this does not mean groundcover won’t collect any data. You will still be able to inspect your k8s environment, see all collected logs and use integrations with outer data sources.
Last updated
