feat(packetparser): add configurable BPF Ring Buffer support

[SRodi]

Description

This PR introduces support for BPF_MAP_TYPE_RINGBUF in the packetparser plugin as a configurable alternative to BPF_MAP_TYPE_PERF_EVENT_ARRAY. Ring Buffers offer better performance and memory efficiency, especially on high-core systems, by using a shared buffer across CPUs rather than per-CPU buffers.

Changes

• Configuration: Added enablePacketParserRingBuffer (bool) and packetParserRingBufferSize (uint32) to the Retina configuration and Helm charts.
• BPF: Updated packetparser.c to conditionally compile with BPF_MAP_TYPE_RINGBUF when enabled.
• Userspace: Updated packetparser_linux.go to:
  • Pass -DUSE_RING_BUFFER and -DRING_BUFFER_SIZE flags during BPF compilation.
  • Implement a ringBufReaderWrapper to adapt the cilium/ebpf/ringbuf reader to the existing reader interface.
  • Add logging to indicate which buffer type is active.
• Testing: Updated unit tests to mock metrics correctly and added a new test case to verify compilation with Ring Buffer enabled.

Verification

• Verified unit tests pass: go test -v ./pkg/plugin/packetparser/...
• Manual verification on Kind:
  • Built image with enablePacketParserRingBuffer: true.
  • Deployed to Kind cluster.
  • Verified logs show "Initializing Ring Buffer reader".
  • Verified BPF map type is ringbuf using bpftool.

Related Issues/PRs

• Degraded node network throughput when retin is installed #655
• fixes offer configurable BPF ring buffers (BPF_MAP_TYPE_RINGBUF) impl in packetparser #1966
• docs(perf): Considerations for packetparser on high-core-count systems #1965

Checklist

• I have read the contributing documentation.
• I signed and signed-off the commits (git commit -S -s ...). See this documentation on signing commits.
• I have correctly attributed the author(s) of the code.
• I have tested the changes locally.
• I have followed the project's style guidelines.
• I have updated the documentation, if necessary.
• I have added tests, if applicable.

Screenshots (if applicable) or Testing Completed

Additional Notes

Once this PR gets reviewed and merged, I will update the docs accordingly.

---

Please refer to the CONTRIBUTING.md file for more information on how to contribute to this project.

[nddq]

Can you get a bpf map dump for each scenario into the PR as well?

[SRodi]

Can you get a bpf map dump for each scenario into the PR as well?

The retina_packetparser_events map is used for streaming events to userspace, not for state storage.

• For the Perf Event scenario, the map is BPF_MAP_TYPE_PERF_EVENT_ARRAY. Dumping it only shows the file descriptors for the perf buffers, not the event data itself.
• For the Ring Buffer scenario, the map is BPF_MAP_TYPE_RINGBUF. This is a memory-mapped ring buffer stream, so it doesn't have static entries that can be dumped like a Hash or Array map.

--

Instead of a data dump, I can provide the bpftool map show output for each scenario to verify the correct map type is being created, along with agent logs showing that the userspace reader (PerfReader vs RingBufReader) is successfully initializing and receiving events."

• with Perf Reader:

• with Ring Buffer:

[anubhabMajumdar]

What are the cons for switching over to ring buffer as default? IMO, either make this default or make this decision during runtime (packetparser makes the decision based on node specifications). This seems like a node specific decision and maybe too complex for user to determine.

[rbtr]

i like it being configurable at runtime. can you update the docs to explain when this should be changed?

[anubhabMajumdar]

I think this should have two options - auto and false (default auto).
Packetparser should make runtime decision on whether to use ring buffer or not .