Feat: remove /sys/kernel/debug mount

[BGrasnick]

Feat: remove /sys/kernel/debug mount

fixes #177

Signed-off-by: Bastien Grasnick [email protected]

[BGrasnick]

Any new information on this? @vimalk78 @sthaha? Would be awesome to move this forward to improve security even more :)

[sthaha]

@BGrasnick I agree, but the lack of automated validation against OpenShift is hurting us here. I am happy to merge this patch as soon as we make a dev-preview release to community operators.
See: redhat-openshift-ecosystem/community-operators-prod#3239

[BGrasnick]

Yes I totally understand that! Unfortunately, my knowledge about the kepler internals regarding eBPF, bcc and libbpf is not that deep (yet) but maybe somebody who knows more about it can enlighten us and tell us if this is still needed :)

When testing by running the operator locally and installing kepler + the Grafana dashboard without the /sys/kernel/debug mount I could still see metrics in Grafana with both latest and latest-libbpf images if I recall correctly so it should work from my understanding.
If you know how we can test this more and better please tell me!

[sthaha]

Lets wait for sustainable-computing-io/kepler#926 to be merged before merging this PR. I suspect looking at libbpf that we may need it

• https://github.com/libbpf/libbpf/blob/master/src/libbpf.c#L10375

[BGrasnick]

Since sustainable-computing-io/kepler#926 is merged now, do you think we can move forward with this?

[sthaha]

closing this since #322 adds this change.

[BGrasnick]

perfect, thank you @sthaha