bpf recorder: load bpf program on startup to win race with container …

…startup

This commit makes it so that the BPF program is loaded (and relocated)
on profile recorder startup. When we then want to start the recording,
we only need to attach the programs. This fixes the flakiness in kubernetes-sigs#2667
and kubernetes-sigs#2668 where program loading is taking so long that we miss container
startup.

internal/pkg/cli/recorder/impl.go

@@ -43,7 +43,8 @@ type defaultImpl struct{}
 //counterfeiter:generate . impl
 type impl interface {
 	LoadBpfRecorder(*bpfrecorder.BpfRecorder) error
-	UnloadBpfRecorder(*bpfrecorder.BpfRecorder)
+	StartBpfRecording(*bpfrecorder.BpfRecorder) error
+	StopBpfRecording(*bpfrecorder.BpfRecorder) error
 	BPFLSMEnabled() bool
 	CommandRun(*command.Command) (uint32, error)
 	CommandWait(*command.Command) error
@@ -62,11 +63,15 @@ type impl interface {
 }
 
 func (*defaultImpl) LoadBpfRecorder(b *bpfrecorder.BpfRecorder) error {
-	return b.Load(true)
+	return b.Load()
 }
 
-func (*defaultImpl) UnloadBpfRecorder(b *bpfrecorder.BpfRecorder) {
-	b.Unload()
+func (*defaultImpl) StartBpfRecording(b *bpfrecorder.BpfRecorder) error {
+	return b.StartRecording()
+}
+
+func (*defaultImpl) StopBpfRecording(b *bpfrecorder.BpfRecorder) error {
+	return b.StopRecording()
 }
 
 func (*defaultImpl) BPFLSMEnabled() bool {

internal/pkg/cli/recorder/recorder.go

@@ -96,7 +96,10 @@ func (r *Recorder) Run() error {
 	if err := r.LoadBpfRecorder(r.bpfRecorder); err != nil {
 		return fmt.Errorf("load: %w", err)
 	}
-	defer r.UnloadBpfRecorder(r.bpfRecorder)
+	if err := r.StartBpfRecording(r.bpfRecorder); err != nil {
+		return fmt.Errorf("record: %w", err)
+	}
+	defer r.StopBpfRecording(r.bpfRecorder)
 
 	var mntns uint32
 	if r.options.noProcStart {

internal/pkg/daemon/bpfrecorder/bpf_program_collection.go

@@ -0,0 +1,80 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package bpfrecorder
+
+import (
+	"fmt"
+	bpf "github.com/aquasecurity/libbpfgo"
+)
+
+type bpfProgram struct {
+	name string
+	prog *bpf.BPFProg
+	link *bpf.BPFLink
+}
+
+// This struct holds a set of bpf programs so that they be quickly attached and detached.
+// We want to minimize the time that takes because it races with container startup,
+// and we want to make sure that we catch the entire container lifecycle.
+type bpfProgramCollection struct {
+	programs []bpfProgram
+}
+
+func newProgramCollection(module *bpf.Module, programNames []string) (*bpfProgramCollection, error) {
+	programs := make([]bpfProgram, len(programNames))
+	for i, name := range programNames {
+		prog, err := module.GetProgram(name)
+		if err != nil {
+			return nil, fmt.Errorf("get bpf program %s: %w", name, err)
+		}
+		programs[i] = bpfProgram{
+			name: name,
+			prog: prog,
+			link: nil,
+		}
+	}
+	return &bpfProgramCollection{
+		programs: programs,
+	}, nil
+}
+
+func (b *bpfProgramCollection) attachAll() error {
+	var err error
+	for _, prog := range b.programs {
+		if prog.link != nil {
+			continue
+		}
+		prog.link, err = prog.prog.AttachGeneric()
+		if err != nil {
+			return fmt.Errorf("attach bpf program %s: %w", prog.name, err)
+		}
+	}
+	return err
+}
+
+func (b *bpfProgramCollection) detachAll() error {
+	for _, prog := range b.programs {
+		if prog.link == nil {
+			continue
+		}
+		if err := prog.link.Destroy(); err != nil {
+			return fmt.Errorf("detach bpf program %s: %w", prog.name, err)
+		}
+		prog.link = nil
+	}
+	return nil
+}