Skip to content

optimize CEL rule evaluation performance #716

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
YakirOren wants to merge 12 commits into
base: main
Choose a base branch
from
Open

optimize CEL rule evaluation performance #716

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
03898bd
optimize CreateEventFromRequest and MakeHttpEvent performance
YakirOren Feb 10, 2026
6f5da29
add parse.basename CEL function and enable cel.bind macro
YakirOren Feb 12, 2026
8129fc1
pre-index rules by event type to eliminate per-event scanning
YakirOren Feb 12, 2026
4d9a142
revert MakeHttpEvent and CreateEventFromRequest optimization
YakirOren Feb 12, 2026
bc5ae26
remove cel.bind test for external library
YakirOren Feb 12, 2026
ab07a93
removed old functions and replace EnrichedEvent with utils.K8sEvent i…
YakirOren Feb 12, 2026
6e4278b
implement activation interface
YakirOren Feb 24, 2026
43ff3a8
optimize CEL field boxing and minor allocations
YakirOren Mar 2, 2026
116f43e
add CEL static optimizer for AST-level constant folding
YakirOren Mar 2, 2026
475d86d
add sync pool for bufio reader
YakirOren Mar 3, 2026
9eac12a
add MetricsNoop for zero-cost disabled metrics path
YakirOren Mar 9, 2026
94494ec
add ExpressionsByEventType field and Init method to Rule struct
YakirOren Mar 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion cmd/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,9 +17,9 @@
"github.com/goradd/maps"
"github.com/grafana/pyroscope-go"

igconfig "github.com/inspektor-gadget/inspektor-gadget/pkg/config"

Check failure on line 20 in cmd/main.go

View workflow job for this annotation

GitHub Actions / pr-created / test / Create cross-platform build 

missing go.sum entry for module providing package github.com/inspektor-gadget/inspektor-gadget/pkg/config (imported by github.com/kubescape/node-agent/cmd); to add:
containercollection "github.com/inspektor-gadget/inspektor-gadget/pkg/container-collection"

Check failure on line 21 in cmd/main.go

View workflow job for this annotation

GitHub Actions / pr-created / test / Create cross-platform build 

missing go.sum entry for module providing package github.com/inspektor-gadget/inspektor-gadget/pkg/container-collection (imported by github.com/kubescape/node-agent/cmd); to add:
iglogger "github.com/inspektor-gadget/inspektor-gadget/pkg/logger"

Check failure on line 22 in cmd/main.go

View workflow job for this annotation

GitHub Actions / pr-created / test / Create cross-platform build 

missing go.sum entry for module providing package github.com/inspektor-gadget/inspektor-gadget/pkg/logger (imported by github.com/kubescape/node-agent/cmd); to add:
beUtils "github.com/kubescape/backend/pkg/utils"
"github.com/kubescape/go-logger"
"github.com/kubescape/go-logger/helpers"
Expand Down Expand Up @@ -177,7 +177,7 @@
if cfg.EnablePrometheusExporter {
prometheusExporter = metricprometheus.NewPrometheusMetric()
} else {
prometheusExporter = metricsmanager.NewMetricsMock()
prometheusExporter = metricsmanager.NewMetricsNoop()
}

// Create watchers
Expand Down
11 changes: 5 additions & 6 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ require (
github.com/dutchcoders/go-clamd v0.0.0-20170520113014-b970184f4d9e
github.com/facette/natsort v0.0.0-20181210072756-2cd4dd1e2dcb
github.com/go-openapi/strfmt v0.23.0
github.com/google/cel-go v0.26.1
github.com/google/cel-go v0.27.0
github.com/google/go-containerregistry v0.20.7
github.com/google/uuid v1.6.0
github.com/goradd/maps v1.3.0
Expand All @@ -42,7 +42,7 @@ require (
github.com/opencontainers/go-digest v1.0.0
github.com/opencontainers/image-spec v1.1.1
github.com/panjf2000/ants/v2 v2.11.3
github.com/picatz/xcel v0.0.0-20250816143731-885b5f678a12
github.com/picatz/xcel v0.0.0-20260226001349-6958ffac5706
github.com/prometheus/alertmanager v0.27.0
github.com/prometheus/client_golang v1.23.2
github.com/prometheus/procfs v0.19.2
Expand Down Expand Up @@ -70,7 +70,7 @@ require (
)

require (
cel.dev/expr v0.24.0 // indirect
cel.dev/expr v0.25.1 // indirect
cloud.google.com/go v0.121.3 // indirect
cloud.google.com/go/auth v0.16.2 // indirect
cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
Expand Down Expand Up @@ -118,7 +118,7 @@ require (
github.com/anchore/packageurl-go v0.1.1-0.20250220190351-d62adb6e1115 // indirect
github.com/anchore/stereoscope v0.1.9 // indirect
github.com/andybalholm/brotli v1.2.0 // indirect
github.com/antlr4-go/antlr/v4 v4.13.0 // indirect
github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
github.com/aquasecurity/go-pep440-version v0.0.1 // indirect
github.com/aquasecurity/go-version v0.0.1 // indirect
Expand Down Expand Up @@ -367,7 +367,6 @@ require (
github.com/spf13/cobra v1.10.2 // indirect
github.com/spf13/pflag v1.0.10 // indirect
github.com/spiffe/go-spiffe/v2 v2.6.0 // indirect
github.com/stoewer/go-strcase v1.3.0 // indirect
github.com/stretchr/objx v0.5.2 // indirect
github.com/stripe/stripe-go/v74 v74.30.0 // indirect
github.com/subosito/gotenv v1.6.0 // indirect
Expand Down Expand Up @@ -458,4 +457,4 @@ require (
zombiezen.com/go/sqlite v1.4.0 // indirect
)

replace github.com/inspektor-gadget/inspektor-gadget => github.com/matthyx/inspektor-gadget v0.0.0-20260226175242-c524fbad47d9
replace github.com/inspektor-gadget/inspektor-gadget => github.com/matthyx/inspektor-gadget v0.0.0-20260228200201-44f8fa846146
19 changes: 9 additions & 10 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
cel.dev/expr v0.24.0 h1:56OvJKSH3hDGL0ml5uSxZmz3/3Pq4tJ+fb1unVLAFcY=
cel.dev/expr v0.24.0/go.mod h1:hLPLo1W4QUmuYdA72RBX06QTs6MXw941piREPl3Yfiw=
cel.dev/expr v0.25.1 h1:1KrZg61W6TWSxuNZ37Xy49ps13NUovb66QLprthtwi4=
cel.dev/expr v0.25.1/go.mod h1:hrXvqGP6G6gyx8UAHSHJ5RGk//1Oj5nXQ2NI02Nrsg4=
cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
cloud.google.com/go v0.31.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
Expand Down Expand Up @@ -741,8 +741,8 @@ github.com/anmitsu/go-shlex v0.0.0-20161002113705-648efa622239/go.mod h1:2FmKhYU
github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8=
github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4=
github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
github.com/antlr4-go/antlr/v4 v4.13.0 h1:lxCg3LAv+EUK6t1i0y1V6/SLeUi0eKEKdhQAlS8TVTI=
github.com/antlr4-go/antlr/v4 v4.13.0/go.mod h1:pfChB/xh/Unjila75QW7+VU4TSnWnnk9UTnmpPaOR2g=
github.com/antlr4-go/antlr/v4 v4.13.1 h1:SqQKkuVZ+zWkMMNkjy5FZe5mr5WURWnlpmOuzYWrPrQ=
github.com/antlr4-go/antlr/v4 v4.13.1/go.mod h1:GKmUxMtwp6ZgGwZSva4eWPC5mS6vUAmOABFgjdkM7Nw=
github.com/apache/arrow/go/v10 v10.0.1/go.mod h1:YvhnlEePVnBS4+0z3fhPfUy7W1Ikj0Ih0vcRo/gZ1M0=
github.com/apache/arrow/go/v11 v11.0.0/go.mod h1:Eg5OsL5H+e299f7u5ssuXsuHQVEGC4xei5aX110hRiI=
github.com/apache/thrift v0.16.0/go.mod h1:PHK3hniurgQaNMZYaCLEqXKsYK8upmhPbmdP2FXSqgU=
Expand Down Expand Up @@ -1233,8 +1233,8 @@ github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Z
github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
github.com/google/cel-go v0.26.1 h1:iPbVVEdkhTX++hpe3lzSk7D3G3QSYqLGoHOcEio+UXQ=
github.com/google/cel-go v0.26.1/go.mod h1:A9O8OU9rdvrK5MQyrqfIxo1a0u4g3sF8KB6PUIaryMM=
github.com/google/cel-go v0.27.0 h1:e7ih85+4qVrBuqQWTW4FKSqZYokVuc3HnhH5keboFTo=
github.com/google/cel-go v0.27.0/go.mod h1:tTJ11FWqnhw5KKpnWpvW9CJC3Y9GK4EIS0WXnBbebzw=
github.com/google/flatbuffers v2.0.8+incompatible/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8=
github.com/google/gnostic-models v0.7.0 h1:qwTtogB15McXDaNqTZdzPJRHvaVJlAl+HVQnLmJEJxo=
github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
Expand Down Expand Up @@ -1532,6 +1532,7 @@ github.com/mailru/easyjson v0.9.0 h1:PrnmzHw7262yW8sTBwxi1PdJA3Iw/EKBa8psRf7d9a4
github.com/mailru/easyjson v0.9.0/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
github.com/matthyx/inspektor-gadget v0.0.0-20260226175242-c524fbad47d9 h1:5SElOPiaA2SKDGnLiWqocww+YagkLL9FPBBeMzKNTIg=
github.com/matthyx/inspektor-gadget v0.0.0-20260226175242-c524fbad47d9/go.mod h1:V4TgEmWo37K72pQvC7XuRQssysrxIIkrNX4TtEkgiE0=
github.com/matthyx/inspektor-gadget v0.0.0-20260228200201-44f8fa846146/go.mod h1:V4TgEmWo37K72pQvC7XuRQssysrxIIkrNX4TtEkgiE0=
github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
github.com/mattn/go-colorable v0.1.6/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
Expand Down Expand Up @@ -1729,8 +1730,8 @@ github.com/petermattis/goid v0.0.0-20241211131331-93ee7e083c43/go.mod h1:pxMtw7c
github.com/phpdave11/gofpdf v1.4.2/go.mod h1:zpO6xFn9yxo3YLyMvW8HcKWVdbNqgIfOOp2dXMnm1mY=
github.com/phpdave11/gofpdi v1.0.12/go.mod h1:vBmVV0Do6hSBHC8uKUQ71JGW+ZGQq74llk/7bXwjDoI=
github.com/phpdave11/gofpdi v1.0.13/go.mod h1:vBmVV0Do6hSBHC8uKUQ71JGW+ZGQq74llk/7bXwjDoI=
github.com/picatz/xcel v0.0.0-20250816143731-885b5f678a12 h1:RS7RxrC+OtnYpgI0li0NwvpE0cqYewsZGXUb6wAe0oQ=
github.com/picatz/xcel v0.0.0-20250816143731-885b5f678a12/go.mod h1:jxNaYyVlWe+WPV3G45KzlMLvplS3PQdHLUsFePIcaEg=
github.com/picatz/xcel v0.0.0-20260226001349-6958ffac5706 h1:xfPEUCHSHcjpu4WxgtC1lwBkP4Xa7R/pl8sXVF103Yg=
github.com/picatz/xcel v0.0.0-20260226001349-6958ffac5706/go.mod h1:bFTXcuU+280rICoGMpVTk/06XNfgvfeplhjWWoLKPys=
github.com/pierrec/lz4/v4 v4.1.15/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
github.com/pierrec/lz4/v4 v4.1.22 h1:cKFw6uJDK+/gfw5BcDL0JL5aBsAFdsIT18eRtLj7VIU=
github.com/pierrec/lz4/v4 v4.1.22/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
Expand Down Expand Up @@ -1901,8 +1902,6 @@ github.com/spf13/viper v1.21.0 h1:x5S+0EU27Lbphp4UKm1C+1oQO+rKx36vfCoaVebLFSU=
github.com/spf13/viper v1.21.0/go.mod h1:P0lhsswPGWD/1lZJ9ny3fYnVqxiegrlNrEmgLjbTCAY=
github.com/spiffe/go-spiffe/v2 v2.6.0 h1:l+DolpxNWYgruGQVV0xsfeya3CsC7m8iBzDnMpsbLuo=
github.com/spiffe/go-spiffe/v2 v2.6.0/go.mod h1:gm2SeUoMZEtpnzPNs2Csc0D/gX33k1xIx7lEzqblHEs=
github.com/stoewer/go-strcase v1.3.0 h1:g0eASXYtp+yvN9fK8sH94oCIk0fau9uV1/ZdJ0AVEzs=
github.com/stoewer/go-strcase v1.3.0/go.mod h1:fAH5hQ5pehh+j3nZfvwdk2RgEgQjAoM8wodgtPmh1xo=
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
Expand Down
19 changes: 15 additions & 4 deletions pkg/containerwatcher/v2/tracers/httpparse.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ import (
"net/http"
"net/http/httputil"
"strconv"
"sync"
"time"

eventtypes "github.com/inspektor-gadget/inspektor-gadget/pkg/types"
Expand All @@ -29,6 +30,12 @@ var readSyscalls = map[string]bool{
"recvmsg": true,
}

var bufReaderPool = sync.Pool{
New: func() any {
return bufio.NewReaderSize(nil, 4096)
},
}

var ConsistentHeaders = []string{
"Accept-Encoding",
"Accept-Language",
Expand Down Expand Up @@ -92,8 +99,10 @@ func ParseHttpRequest(data []byte) (*http.Request, error) {
}

// Parse headers only
bufReader := bufio.NewReader(bytes.NewReader(data[:headerEnd]))
req, err := http.ReadRequest(bufReader)
br := bufReaderPool.Get().(*bufio.Reader)
br.Reset(bytes.NewReader(data[:headerEnd]))
req, err := http.ReadRequest(br)
bufReaderPool.Put(br)
if err != nil {
return fallbackReadRequest(data)
}
Expand Down Expand Up @@ -136,8 +145,10 @@ func ParseHttpResponse(data []byte, req *http.Request) (*http.Response, error) {
}

// Parse headers only
bufReader := bufio.NewReader(bytes.NewReader(data[:headerEnd]))
resp, err := http.ReadResponse(bufReader, req)
br := bufReaderPool.Get().(*bufio.Reader)
br.Reset(bytes.NewReader(data[:headerEnd]))
resp, err := http.ReadResponse(br, req)
bufReaderPool.Put(br)
if err != nil {
return fallbackReadResponse(data, req)
}
Expand Down
22 changes: 22 additions & 0 deletions pkg/metricsmanager/metrics_manager_noop.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
package metricsmanager

import (
"time"

"github.com/kubescape/node-agent/pkg/utils"
)

var _ MetricsManager = (*MetricsNoop)(nil)

type MetricsNoop struct{}

func NewMetricsNoop() *MetricsNoop { return &MetricsNoop{} }
func (m *MetricsNoop) Start() {}
func (m *MetricsNoop) Destroy() {}
func (m *MetricsNoop) ReportEvent(_ utils.EventType) {}
func (m *MetricsNoop) ReportFailedEvent() {}
func (m *MetricsNoop) ReportRuleProcessed(_ string) {}
func (m *MetricsNoop) ReportRuleAlert(_ string) {}
func (m *MetricsNoop) ReportRuleEvaluationTime(_ string, _ utils.EventType, _ time.Duration) {}
func (m *MetricsNoop) ReportContainerStart() {}
func (m *MetricsNoop) ReportContainerStop() {}
Loading
Loading