release: v0.2.1 — graceful probe degradation + k8s deployment

- Per-probe attach is non-fatal: a tracepoint missing on the running kernel warns and the
  collector continues with whatever attaches (bails only if zero). One kernel-version
  difference no longer crashes the whole collector. Validated on KVM: all 12 core probes
  attach (attached=12 total=12), events flow.
- deploy/Dockerfile (multi-stage, eBPF toolchain) + deploy/daemonset.yaml (privileged
  DaemonSet, NDJSON to stdout, no k8s API/RBAC) make it deployable; README deploy pointer.

Author: RoyLin

CHANGELOG.md

@@ -2,6 +2,21 @@
 
 All notable changes to a3s-observer will be documented in this file.
 
+## [0.2.1] — robustness + deployability
+
+### Changed
+
+- **Graceful probe degradation:** per-probe attach is now non-fatal — a tracepoint missing
+  on the running kernel logs a warning and the collector continues with whatever attaches
+  (bails only if zero attach). One kernel-version difference no longer takes down the whole
+  collector. Validated: all 12 core probes attach, events flow.
+
+### Added
+
+- **Kubernetes deployment:** `deploy/Dockerfile` (multi-stage build with the eBPF
+  toolchain) + `deploy/daemonset.yaml` (privileged DaemonSet, NDJSON to stdout, no k8s
+  API/RBAC — pod identity from `/proc/<pid>/cgroup`). Pairs with `deploy/otel-collector.yaml`.
+
 ## [0.2.0] — production-ready
 
 Closes the gap between the design and the implementation: every capability the docs

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "a3s-observer"
-version = "0.2.0"
+version = "0.2.1"
 edition = "2021"
 license = "MIT"
 description = "General-purpose, language-agnostic eBPF observability for AI agents (LLM calls, tools, files, network egress)."

Cargo.toml

@@ -134,11 +134,14 @@ OTEL_EXPORTER_OTLP_ENDPOINT=http://otlp-backend:4317 \
 ```
 
 Every event is one valid-JSON line (verified: the `filelog` receiver's `json_parser`
-ingests them directly), so a3s-observer also drops straight into vector / Loki / `jq`. In
-Kubernetes, run a3s-observer as a DaemonSet writing to stdout and let a Collector DaemonSet
-tail the node logs. This keeps the always-on probe binary minimal and decoupled from
-backend availability; in-process OTLP push is intentionally **not** built — that's the
-Collector's job.
+ingests them directly), so a3s-observer also drops straight into vector / Loki / `jq`.
+
+**Kubernetes:** build the image with [`deploy/Dockerfile`](deploy/Dockerfile) and deploy
+[`deploy/daemonset.yaml`](deploy/daemonset.yaml) (writes NDJSON to stdout); a node-level
+OTel Collector DaemonSet tails the container log. No k8s API/RBAC needed — pod identity
+comes from `/proc/<pid>/cgroup`. This keeps the always-on probe binary minimal and
+decoupled from backend availability; in-process OTLP push is intentionally **not** built —
+that's the Collector's job.
 
 ## License
 

README.md

@@ -1,6 +1,6 @@
 [package]
 name = "a3s-observer-collector"
-version = "0.2.0"
+version = "0.2.1"
 edition = "2021"
 license = "MIT"
 description = "a3s-observer collector: loads the eBPF probes and exports enriched events."

a3s-observer-collector/Cargo.toml

@@ -27,24 +27,40 @@ async fn main() -> anyhow::Result<()> {
     )))
     .context("load eBPF object")?;
 
-    attach(&mut ebpf, "exec", "syscalls", "sys_enter_execve")?;
-    attach(&mut ebpf, "tls_write", "syscalls", "sys_enter_write")?;
-    attach(&mut ebpf, "tls_sendto", "syscalls", "sys_enter_sendto")?;
-    attach(&mut ebpf, "connect", "syscalls", "sys_enter_connect")?;
-    attach(&mut ebpf, "dns_query", "syscalls", "sys_enter_sendto")?;
-    attach(&mut ebpf, "dns_sendmsg", "syscalls", "sys_enter_sendmsg")?;
-    attach(&mut ebpf, "dns_sendmmsg", "syscalls", "sys_enter_sendmmsg")?;
     // File-write capture is opt-in: openat is a firehose on a busy node (e.g. containerd
     // unpacking images), and the agent's own writes need downstream identity filtering.
     let files = std::env::var_os("A3S_OBSERVER_FILES").is_some();
+    let mut probes = vec![
+        ("exec", "sys_enter_execve"),
+        ("tls_write", "sys_enter_write"),
+        ("tls_sendto", "sys_enter_sendto"),
+        ("connect", "sys_enter_connect"),
+        ("dns_query", "sys_enter_sendto"),
+        ("dns_sendmsg", "sys_enter_sendmsg"),
+        ("dns_sendmmsg", "sys_enter_sendmmsg"),
+        ("read_enter", "sys_enter_read"),
+        ("recv_enter", "sys_enter_recvfrom"),
+        ("read_exit", "sys_exit_read"),
+        ("recv_exit", "sys_exit_recvfrom"),
+        ("sock_close", "sys_enter_close"),
+    ];
     if files {
-        attach(&mut ebpf, "file_open", "syscalls", "sys_enter_openat")?;
+        probes.push(("file_open", "sys_enter_openat"));
+    }
+    // Per-probe attach is non-fatal: kernels vary, and one missing tracepoint shouldn't take
+    // down the whole collector — degrade to whatever attaches, fail only if nothing does.
+    let mut attached = 0usize;
+    for (prog, tp) in &probes {
+        match attach(&mut ebpf, prog, "syscalls", tp) {
+            Ok(()) => attached += 1,
+            Err(e) => {
+                tracing::warn!(probe = prog, error = %e, "probe failed to attach — continuing")
+            }
+        }
+    }
+    if attached == 0 {
+        anyhow::bail!("no eBPF probes could be attached");
     }
-    attach(&mut ebpf, "read_enter", "syscalls", "sys_enter_read")?;
-    attach(&mut ebpf, "recv_enter", "syscalls", "sys_enter_recvfrom")?;
-    attach(&mut ebpf, "read_exit", "syscalls", "sys_exit_read")?;
-    attach(&mut ebpf, "recv_exit", "syscalls", "sys_exit_recvfrom")?;
-    attach(&mut ebpf, "sock_close", "syscalls", "sys_enter_close")?;
 
     // A3S_OBSERVER_JSON=1 → NDJSON (pipe to vector/Loki/jq); otherwise human-readable log.
     let exporter: Box<dyn Exporter> = if std::env::var_os("A3S_OBSERVER_JSON").is_some() {
@@ -82,9 +98,11 @@ async fn main() -> anyhow::Result<()> {
     )?;
 
     tracing::info!(
+        attached,
+        total = probes.len(),
         files,
-        "a3s-observer-collector: exec + TLS-SNI + connect + dns + LLM-metrics probes attached \
-         (file-write capture: set A3S_OBSERVER_FILES=1); streaming (Ctrl-C to stop)"
+        "a3s-observer-collector: probes attached (file-write capture: set A3S_OBSERVER_FILES=1); \
+         streaming (Ctrl-C to stop)"
     );
 
     let mut sigint = tokio::signal::unix::signal(tokio::signal::unix::SignalKind::interrupt())?;

a3s-observer-collector/src/main.rs

@@ -1,6 +1,6 @@
 [package]
 name = "a3s-observer-common"
-version = "0.2.0"
+version = "0.2.1"
 edition = "2021"
 license = "MIT"
 description = "Shared no_std types crossing the eBPF <-> userspace boundary for a3s-observer."

a3s-observer-common/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "a3s-observer-ebpf"
-version = "0.2.0"
+version = "0.2.1"
 edition = "2021"
 license = "MIT"
 publish = false

a3s-observer-ebpf/Cargo.toml

@@ -0,0 +1,17 @@
+# Build the collector (with the eBPF toolchain) then ship just the binary.
+# Build from the crate root:  docker build -f deploy/Dockerfile -t a3s-observer:0.2.0 .
+#
+# bpf-linker borrows rustc's bundled LLVM (aya-rustc-llvm-proxy), so no system LLVM is
+# needed; build.rs compiles the eBPF crate with the nightly toolchain + rust-src.
+
+FROM rust:1-bookworm AS build
+RUN rustup toolchain install nightly --component rust-src \
+ && cargo install bpf-linker
+WORKDIR /src
+COPY . .
+RUN cargo build --release -p a3s-observer-collector
+
+FROM debian:bookworm-slim
+COPY --from=build /src/target/release/a3s-observer-collector /usr/local/bin/a3s-observer-collector
+ENV A3S_OBSERVER_JSON=1
+ENTRYPOINT ["/usr/local/bin/a3s-observer-collector"]

deploy/Dockerfile

@@ -0,0 +1,40 @@
+# Run a3s-observer on every node. It writes NDJSON to stdout; a node-level OpenTelemetry
+# Collector then tails the container log and ships OTLP (see deploy/otel-collector.yaml).
+#
+#   docker build -f deploy/Dockerfile -t <registry>/a3s-observer:0.2.0 . && docker push ...
+#   kubectl apply -f deploy/daemonset.yaml
+#
+# No k8s API access / RBAC is needed: pod-UID + container-id come from /proc/<pid>/cgroup.
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: a3s-observer
+  namespace: observability
+  labels: { app: a3s-observer }
+spec:
+  selector:
+    matchLabels: { app: a3s-observer }
+  template:
+    metadata:
+      labels: { app: a3s-observer }
+    spec:
+      hostPID: true # resolve /proc/<pid> for host processes (identity)
+      containers:
+        - name: a3s-observer
+          image: <registry>/a3s-observer:0.2.0 # built from deploy/Dockerfile
+          securityContext:
+            # eBPF load + tracepoint attach. On kernels ≥5.8 you can drop `privileged` and
+            # use capabilities: [BPF, PERFMON, SYS_RESOURCE] instead.
+            privileged: true
+          env:
+            - { name: A3S_OBSERVER_JSON, value: "1" }
+            # - { name: A3S_OBSERVER_FILES, value: "1" }   # opt in to file-write capture
+          volumeMounts:
+            - { name: sys, mountPath: /sys, readOnly: true } # tracepoint ids under /sys
+          resources:
+            requests: { cpu: 50m, memory: 64Mi }
+            limits: { memory: 256Mi }
+      volumes:
+        - { name: sys, hostPath: { path: /sys } }
+      tolerations:
+        - operator: Exists # run on every node, including control-plane