mrproliu opened a new pull request, #215: URL: https://github.com/apache/skywalking-rover/pull/215
## Motivation In Istio Ambient mode, the ztunnel proxy carries the real workload identities (SPIFFE source/destination principals) and the mTLS security policy of every proxied connection. Until now rover recovered these by tailing ztunnel's access-log file, which is lossy (log rotation, sampling, formatting drift) and only exposes what ztunnel chooses to print. This PR reads the identities directly from ztunnel memory via an eBPF uprobe, making the access-log tailer a fallback rather than the primary source. ## What this does This adds an eBPF uprobe on the ztunnel Rust symbol `ConnectionResult::record_internal` (the point where a proxied connection's result is finalized), decodes the connection's source/destination identities and mTLS state straight from the Rust structures, and correlates them onto the access-log connections in the access log module. Decoding the Rust types (`Identity::Spiffe`, `ArcStr`) requires the field offsets of the running ztunnel binary. Because ztunnel ships stripped release binaries, offsets are resolved through a fallback ladder, in order: 1. **DWARF** — if the binary carries debug info, offsets are read directly. 2. **Pre-generated offset table** — a table keyed by the binary's GNU build-id, covering all released ztunnel versions; many istio patch releases share an identical binary (same build-id), so one entry serves many versions. 3. **Runtime calibration** — offsets are inferred at runtime from observed events, anchored against the ztunnel admin `config_dump` as ground truth. 4. **Access-log tailer** — if none of the above yields usable offsets, the path degrades to the original access-log tailing behaviour. ## Safety and controls - **Self-healing downgrade**: if the uprobe is attached but decoding repeatedly fails (e.g. wrong offsets on an unknown binary), the source downgrades to the access-log tailer instead of silently dropping identities. All-null identity pointers (ordinary non-mTLS traffic) are treated as a normal miss and never trip the downgrade. - **Kill switch**: the environment variable `ROVER_ZTUNNEL_IDENTITY_UPROBE_ENABLED` (default on) disables the uprobe entirely and forces the access-log tailer; `false`/`0`/`no`/`off` are accepted as falsey. - **Offset table tooling**: a generator produces and merges offset-table entries from debug builds of ztunnel, keyed by build-id, so new releases can be added without code changes. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
