TCX ebpf hook support

.github/workflows/image-build.yaml

@@ -19,7 +19,7 @@ jobs:
       packages: write
       id-token: write # needed for signing the images with GitHub OIDC Token
 
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     strategy:
       fail-fast: false
       matrix:
@@ -114,7 +114,7 @@ jobs:
       packages: write
       id-token: write # needed for signing the images with GitHub OIDC Token
 
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     strategy:
       fail-fast: false
       matrix:

.github/workflows/integration_test.yml

@@ -11,7 +11,7 @@ jobs:
 
   kubernetes-integration-tests:
     name: Kubernetes Integration Tests (Go ${{ matrix.go }} - amd64 - ${{ matrix.oci_bin }})
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     strategy:
       matrix:
         go: ['1.22']

.github/workflows/pull_request.yml

@@ -7,7 +7,7 @@ on:
 jobs:
 
   check-license:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 3
 
     steps:
@@ -17,7 +17,7 @@ jobs:
 
   build-lint-test:
     name: Build (Go ${{ matrix.go }} - ${{ matrix.arch.arch }})
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     strategy:
       fail-fast: false
       matrix:
@@ -79,7 +79,7 @@ jobs:
 
   coverage:
     needs: [build-lint-test]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Download golang coverage artifacts
         uses: actions/download-artifact@v4
@@ -103,7 +103,7 @@ jobs:
         build-lint-test,
         coverage,
       ]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Build Complete
         run: echo "Build Complete"

.github/workflows/release.yml

@@ -9,7 +9,7 @@ jobs:
   # Creates Release with just the changelog
   release:
     if: startsWith(github.ref, 'refs/tags/v')
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout bpfman
         uses: actions/checkout@v4

PROJECT

@@ -33,6 +33,13 @@ resources:
     kind: TcProgram
     path: github.com/bpfman/bpfman-operator/apis/v1alpha1
     version: v1alpha1
+  - api:
+      crdVersion: v1
+    controller: true
+    domain: bpfman.io
+    kind: TcxProgram
+    path: github.com/bpfman/bpfman-operator/apis/v1alpha1
+    version: v1alpha1
   - api:
       crdVersion: v1
     controller: true

apis/v1alpha1/bpfapplication_types.go

@@ -84,10 +84,10 @@ type BpfApplicationProgram struct {
 	// +optional
 	TC *TcProgramInfo `json:"tc,omitempty"`
 
-	// tcx defines the desired state of the application's TcPrograms.
+	// tcx defines the desired state of the application's TcxPrograms.
 	// +unionMember
 	// +optional
-	TCX *TcProgramInfo `json:"tcx,omitempty"`
+	TCX *TcxProgramInfo `json:"tcx,omitempty"`
 
 	// fentry defines the desired state of the application's FentryPrograms.
 	// +unionMember

apis/v1alpha1/tcxProgram_types.go

@@ -0,0 +1,85 @@
+/*
+Copyright 2024.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// All fields are required unless explicitly marked optional
+// +kubebuilder:validation:Required
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// +genclient
+// +genclient:nonNamespaced
+//+kubebuilder:object:root=true
+//+kubebuilder:subresource:status
+//+kubebuilder:resource:scope=Cluster
+
+// TcxProgram is the Schema for the TcxProgram API
+// +kubebuilder:printcolumn:name="BpfFunctionName",type=string,JSONPath=`.spec.bpffunctionname`
+// +kubebuilder:printcolumn:name="NodeSelector",type=string,JSONPath=`.spec.nodeselector`
+// +kubebuilder:printcolumn:name="Status",type=string,JSONPath=`.status.conditions[0].reason`
+// +kubebuilder:printcolumn:name="Direction",type=string,JSONPath=`.spec.direction`,priority=1
+// +kubebuilder:printcolumn:name="InterfaceSelector",type=string,JSONPath=`.spec.interfaceselector`,priority=1
+// +kubebuilder:printcolumn:name="Position",type=string,JSONPath=`.spec.position`,priority=1
+// +kubebuilder:printcolumn:name="Priority",type=string,JSONPath=`.spec.priority`,priority=1
+type TcxProgram struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec TcxProgramSpec `json:"spec"`
+	// +optional
+	Status TcxProgramStatus `json:"status,omitempty"`
+}
+
+// TcxProgramSpec defines the desired state of TcxProgram
+type TcxProgramSpec struct {
+	TcxProgramInfo `json:",inline"`
+	BpfAppCommon   `json:",inline"`
+}
+
+// TcxProgramInfo defines the tc program details
+type TcxProgramInfo struct {
+	BpfProgramCommon `json:",inline"`
+
+	// Selector to determine the network interface (or interfaces)
+	InterfaceSelector InterfaceSelector `json:"interfaceselector"`
+
+	// Direction specifies the direction of traffic the tcx program should
+	// attach to for a given network device.
+	// +kubebuilder:validation:Enum=ingress;egress
+	Direction string `json:"direction"`
+
+	// Priority specifies the priority of the tc program in relation to
+	// other programs of the same type with the same attach point. It is a value
+	// from 0 to 1000 where lower values have higher precedence.
+	// +kubebuilder:validation:Minimum=0
+	// +kubebuilder:validation:Maximum=1000
+	Priority int32 `json:"priority"`
+}
+
+// TcxProgramStatus defines the observed state of TcProgram
+type TcxProgramStatus struct {
+	BpfProgramStatusCommon `json:",inline"`
+}
+
+// +kubebuilder:object:root=true
+// TcxProgramList contains a list of TcxPrograms
+type TcxProgramList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []TcxProgram `json:"items"`
+}

bundle/manifests/bpfman-agent-role_rbac.authorization.k8s.io_v1_clusterrole.yaml

@@ -100,6 +100,20 @@ rules:
   - tcprograms/finalizers
   verbs:
   - update
+- apiGroups:
+  - bpfman.io
+  resources:
+  - tcxprograms
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - bpfman.io
+  resources:
+  - tcxprograms/finalizers
+  verbs:
+  - update
 - apiGroups:
   - bpfman.io
   resources: