Skip to content

BTF type information is missing since recent kernel update 6.6.95, making eBPF tools such as Tetragon crash on start-up #21788

@blu3r4y

Description

@blu3r4y

What Happened?

Symptom

I was installing CNCF Tetragon, a very popular eBPF-based security and observability tool in Minikube v1.37.0 on Windows and it failed with the following message:

level=error msg="Failed to execute tetragon" error="tetragon, aborting kernel autodiscovery failed: kernel version \"6.6.95\" BTF search failed kernel is not included in supported list. Please check Tetragon requirements documentation, then use --btf option to specify BTF path and/or '--kernel' to specify kernel version"
level=info msg="BTF discovery: default kernel btf file does not exist" btf-file=/sys/kernel/btf/vmlinux
level=info msg="BTF discovery: candidate btf file does not exist" btf-file=/var/lib/tetragon/metadata/vmlinux-6.6.95
level=info msg="BTF discovery: candidate btf file does not exist" btf-file=/var/lib/tetragon/btf

This worked with Minikube v1.36.0 on Windows.

Potential root cause

I did some digging in #20995 and found that flags CONFIG_DEBUG_INFO=y and CONFIG_DEBUG_INFO_BTF=y were removed: https://github.com/kubernetes/minikube/pull/20995/files#diff-fa5e1b16477a9509c25c6d3c289baac93c8456b6a58afb7f087d732842a7a542L519-L520

Was this on purpose? It would be very valuable to have BTF type information, especially in Kubernetes, where many operators use eBPF technology (and BTF type information).

Footnote

I also came across #19886 and #8556 which mention the tutorial (https://minikube.sigs.k8s.io/docs/tutorials/ebpf_tools_in_minikube/) that seems very outdated; e.g., minikube ssh -- docker ps cannot connect to the Docker domain.

Attach the log file

log.txt

Operating System

Windows

Driver

Hyper-V

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions