Getting "Failed to compile BPF text" on "Running eBPF Tools in Minikube" demo

[Dentrax]

Steps to reproduce the issue:

0. Follow the Running eBPF Tools in Minikube demo step by step

$ minikube start --iso-url https://storage.googleapis.com/minikube-performance/minikube.iso

2. Download and extract necessary kernel headers

$ minikube ssh -- curl -Lo /tmp/kernel-headers-linux-4.19.94.tar.lz4 https://storage.googleapis.com/minikube-kernel-headers/kernel-headers-linux-4.19.94.tar.lz4
$ minikube ssh -- sudo mkdir -p /lib/modules/4.19.94/build
$ minikube ssh -- sudo tar -I lz4 -C /lib/modules/4.19.94/build -xvf /tmp/kernel-headers-linux-4.19.94.tar.lz4
$ minikube ssh -- rm /tmp/kernel-headers-linux-4.19.94.tar.lz4

3. Run BCC tools as a Docker container

$ minikube ssh -- docker run --rm   --privileged   -v /lib/modules:/lib/modules:ro   -v /usr/src:/usr/src:ro   -v /etc/localtime:/etc/localtime:ro   --workdir /usr/share/bcc/tools   zlim/bcc ./execsnoop

Full output of failed command:

Unable to find image 'zlim/bcc:latest' locally
latest: Pulling from zlim/bcc
6cf436f81810: Pull complete
987088a85b96: Pull complete
b4624b3efe06: Pull complete
d42beb8ded59: Pull complete
90970d1ebfd9: Pull complete
29c3815350eb: Pull complete
e21dfbd8fcfc: Pull complete
Digest: sha256:914bea8970535cd6b0d5dee13f99569c5f0d597942c8333c0aa92443473aff27
Status: Downloaded newer image for zlim/bcc:latest
chdir(/lib/modules/4.19.114/build): No such file or directory
Traceback (most recent call last):
  File "/usr/share/bcc/tools/execsnoop", line 165, in <module>
    b = BPF(text=bpf_text)
  File "/usr/lib/python2.7/dist-packages/bcc/__init__.py", line 325, in __init__
    raise Exception("Failed to compile BPF text")
Exception: Failed to compile BPF text
ssh: Process exited with status 1

[priyawadhwa]

Hey @Dentrax thank you for opening this issue. I just tried the tutorial on mac OS with the hyperkit driver, with minikube @ HEAD, and it seems to be working as expected.

What operating system and driver did you run on?

[Dentrax]

I forgot to add some version information. 🙈 (Maybe we should add a part of this in the issue template?)

macOS 11.0.1

minikube version: v1.15.1
commit: 23f40a012abb52eff365ff99a709501a61ac5876

Darwin XXX 20.1.0 Darwin Kernel Version 20.1.0: Sat Oct 31 00:07:11 PDT 2020; root:xnu-7195.50.7~2/RELEASE_X86_64 x86_64

[priyawadhwa]

It looks like the kernel headers version isn't correct, seems like BPF is looking for 4.19.114 while the kernel headers we extract are 4.19.94

What driver are you using? On macOS, this will only currently work with the hyperkit driver, which you can specify by running minikube start --driver hyperkit

[mauriciovasquezbernal]

Having CONFIG_IKHEADERS will solve this: #8556.

[spowelljr]

Hi @Dentrax, we haven't heard back from you, do you still have this issue?
There isn't enough information in this issue to make it actionable, and a long enough duration has passed, so this issue is likely difficult to replicate.

I will close this issue for now but feel free to reopen when you feel ready to provide more information.

[xinmans]

root@unraid:/mnt/disk1/minikube# minikube ssh
_ _
_ _ ( ) ( )
___ ___ () ___ ()| |/') _ _ | |_ __
/' _ _| |/' _ \| || , < ( ) ( )| '_\ /'\ | ( ) ( ) || || ( ) || || |\\ | () || |) )( /
() () ()()() ()()() ()\___/'(_,__/'__)

$ uname -a
Linux minikube 5.10.57 #1 SMP Fri Oct 28 21:02:11 UTC 2022 x86_64 GNU/Linux

my kernel is 5.10.57, encour same issue

root@unraid:/mnt/disk1/minikube# minikube ssh -- docker run --rm --privileged -v /lib/modules:/lib/modules:ro -v /usr/src:/usr/src:ro -v /etc/localtime:/etc/localtime:ro --workdir /usr/share/bcc/tools zlim/bcc ./execsnoop
Unable to find image 'zlim/bcc:latest' locally
latest: Pulling from zlim/bcc
6cf436f81810: Pull complete
987088a85b96: Pull complete
b4624b3efe06: Pull complete
d42beb8ded59: Pull complete
90970d1ebfd9: Pull complete
29c3815350eb: Pull complete
e21dfbd8fcfc: Pull complete
Digest: sha256:914bea8970535cd6b0d5dee13f99569c5f0d597942c8333c0aa92443473aff27
Status: Downloaded newer image for zlim/bcc:latest
chdir(/lib/modules/5.10.57/build): No such file or directory
Traceback (most recent call last):
File "/usr/share/bcc/tools/execsnoop", line 165, in
b = BPF(text=bpf_text)
File "/usr/lib/python2.7/dist-packages/bcc/init.py", line 325, in init
raise Exception("Failed to compile BPF text")
Exception: Failed to compile BPF text
ssh: Process exited with status 1

how to fix?