Repository: kumahq/kuma
Pull request #5046 (2022-09-22 12:44:08)

feat(ebpf): add more ebpf annotations
We are able to specify manually cgroup2 and bpf fs paths using annotations, which is necessary for different cloud providers

Blocked by: https://github.com/kumahq/kuma-net/pull/97 (after this PR is merged, we have to bump kuma-net version in go.mod file to 0.7.1)

### Checklist prior to review

<!--
Each of these sections need to be filled by the author when opening the PR.

If something doesn't apply please check the box and add a justification after the `--`
-->

- [ ] Link to docs PR or issue --
- [x] Link to UI issue or PR -- no UI changes
- [ ] Is the [issue worked on linked][1]? --
- [x] The PR does not hardcode values that might break projects that depend on kuma (e.g. "kumahq" as a image registry) -- no
- [x] The PR will work for both Linux and Windows, system specific functions like `syscall.Mkfifo` have equivalent implementation on the other OS -- only linux
- [ ] Unit Tests --
- [ ] E2E Tests --
- [ ] Manual Universal Tests --
- [x] Manual Kubernetes Tests --
- [x] Do you need to update [`UPGRADE.md`](../blob/master/UPGRADE.md)? -- no
- [x] Does it need to be backported according to the [backporting policy](../blob/master/CONTRIBUTING.md#backporting)?  -- no
- [x] Do you need to explicitly set a [`> Changelog:` entry here](../blob/master/CONTRIBUTING.md#submitting-a-patch) or add a `ci/` label to run fewer/more tests?

> Changelog: feat(ebpf): add annotations to configure cgroup2 and bpf fs paths using annotations

[1]: https://docs.github.com/en/issues/tracking-your-work-with-issues/linking-a-pull-request-to-an-issue#linking-a-pull-request-to-an-issue-using-a-keyword


bartsmykla: > /format

it's failing because of the versions of kuma-net, which are not released yet (waiting for the PR in the description to be merged, then I'm gonna release new version of kuma-net)

Patch:
diff --git a/app/kumactl/cmd/install/install_transparent_proxy.go b/app/kumactl/cmd/install/install_transparent_proxy.go
index e07f390de..c559979d0 100644
--- a/app/kumactl/cmd/install/install_transparent_proxy.go
+++ b/app/kumactl/cmd/install/install_transparent_proxy.go
@@ -41,6 +41,8 @@ type transparentProxyArgs struct {
 	EbpfProgramsSourcePath             string
 	EbpfInstanceIP                     string
 	EbpfBPFFSPath                      string
+	EbpfCgroupPath                     string
+	EbpfTCAttachIface                  string
 }
 
 func newInstallTransparentProxy() *cobra.Command {
@@ -66,7 +68,9 @@ func newInstallTransparentProxy() *cobra.Command {
 		ExperimentalTransparentProxyEngine: false,
 		EbpfEnabled:                        false,
 		EbpfProgramsSourcePath:             "/kuma/ebpf",
-		EbpfBPFFSPath:                      "/run/kuma/bpf",
+		EbpfBPFFSPath:                      "/sys/fs/bpf",
+		EbpfCgroupPath:                     "/sys/fs/cgroup",
+		EbpfTCAttachIface:                  "",
 	}
 	cmd := &cobra.Command{
 		Use:   "transparent-proxy",
@@ -196,6 +200,8 @@ runuser -u kuma-dp -- \
 	cmd.Flags().StringVar(&args.EbpfProgramsSourcePath, "ebpf-programs-source-path", args.EbpfProgramsSourcePath, "path where compiled ebpf programs and other necessary for ebpf mode files can be found")
 	cmd.Flags().StringVar(&args.EbpfInstanceIP, "ebpf-instance-ip", args.EbpfInstanceIP, "IP address of the instance (pod/vm) where transparent proxy will be installed")
 	cmd.Flags().StringVar(&args.EbpfBPFFSPath, "ebpf-bpffs-path", args.EbpfBPFFSPath, "the path of the BPF filesystem")
+	cmd.Flags().StringVar(&args.EbpfCgroupPath, "ebpf-cgroup-path", args.EbpfCgroupPath, "the path of cgroup2")
+	cmd.Flags().StringVar(&args.EbpfTCAttachIface, "ebpf-tc-attach-iface", args.EbpfTCAttachIface, "name of the interface which TC eBPF programs should be attached to")
 
 	cmd.Flags().StringArrayVar(&args.ExcludeOutboundTCPPortsForUIDs, "exclude-outbound-tcp-ports-for-uids", []string{}, "tcp outbound ports to exclude for specific UIDs in a format of ports:uids where both ports and uids can be a single value, a list, a range or a combination of all, e.g. 3000-5000:103,104,106-108 would mean exclude ports from 3000 to 5000 for UIDs 103, 104, 106, 107, 108")
 	cmd.Flags().StringArrayVar(&args.ExcludeOutboundUDPPortsForUIDs, "exclude-outbound-udp-ports-for-uids", []string{}, "udp outbound ports to exclude for specific UIDs in a format of ports:uids where both ports and uids can be a single value, a list, a range or a combination of all, e.g. 3000-5000:103,104,106-108 would mean exclude ports from 3000 to 5000 for UIDs 103, 104, 106, 107, 108")
@@ -263,6 +269,8 @@ func configureTransparentProxy(cmd *cobra.Command, args *transparentProxyArgs) e
 		EbpfEnabled:                    args.EbpfEnabled,
 		EbpfInstanceIP:                 args.EbpfInstanceIP,
 		EbpfBPFFSPath:                  args.EbpfBPFFSPath,
+		EbpfCgroupPath:                 args.EbpfCgroupPath,
+		EbpfTCAttachIface:              args.EbpfTCAttachIface,
 		EbpfProgramsSourcePath:         args.EbpfProgramsSourcePath,
 		Stdout:                         cmd.OutOrStdout(),
 		Stderr:                         cmd.OutOrStderr(),
diff --git a/deployments/charts/kuma/README.md b/deployments/charts/kuma/README.md
index 73513847b..0c1ad6e24 100644
--- a/deployments/charts/kuma/README.md
+++ b/deployments/charts/kuma/README.md
@@ -168,7 +168,9 @@ A Helm chart for the Kuma Control Plane
 | experimental.transparentProxy | bool | `false` | If true, use the new transparent proxy engine |
 | experimental.ebpf.enabled | bool | `false` | If true, ebpf will be used instead of using iptables to install/configure transparent proxy |
 | experimental.ebpf.instanceIPEnvVarName | string | `"INSTANCE_IP"` | Name of the environmental variable which will contain the IP address of a pod |
-| experimental.ebpf.bpffsPath | string | `"/run/kuma/bpf"` | Path where BPF file system should be mounted |
+| experimental.ebpf.bpffsPath | string | `"/sys/fs/bpf"` | Path where BPF file system should be mounted |
+| experimental.ebpf.cgroupPath | string | `"/sys/fs/cgroup"` | Host's cgroup2 path |
+| experimental.ebpf.tcAttachIface | string | `""` | Name of the network interface which TC programs should be attached to, we'll try to automatically determine it if empty |
 | experimental.ebpf.programsSourcePath | string | `"/kuma/ebpf"` | Path where compiled eBPF programs which will be installed can be found |
 
 ## Custom Resource Definitions
diff --git a/deployments/charts/kuma/templates/_helpers.tpl b/deployments/charts/kuma/templates/_helpers.tpl
index b41b7d971..2e47ec350 100644
--- a/deployments/charts/kuma/templates/_helpers.tpl
+++ b/deployments/charts/kuma/templates/_helpers.tpl
@@ -281,6 +281,10 @@ env:
   value: {{ .Values.experimental.ebpf.instanceIPEnvVarName }}
 - name: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_BPFFS_PATH
   value: {{ .Values.experimental.ebpf.bpffsPath }}
+- name: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_CGROUP_PATH
+  value: {{ .Values.experimental.ebpf.cgroupPath }}
+- name: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_TC_ATTACH_IFACE
+  value: {{ .Values.experimental.ebpf.tcAttachIface }}
 - name: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_PROGRAMS_SOURCE_PATH
   value: {{ .Values.experimental.ebpf.programsSourcePath }}
 {{- end }}
diff --git a/deployments/charts/kuma/values.yaml b/deployments/charts/kuma/values.yaml
index 52a816a05..7bc9f0d49 100644
--- a/deployments/charts/kuma/values.yaml
+++ b/deployments/charts/kuma/values.yaml
@@ -683,7 +683,11 @@ experimental:
     # -- Name of the environmental variable which will contain the IP address of a pod
     instanceIPEnvVarName: INSTANCE_IP
     # -- Path where BPF file system should be mounted
-    bpffsPath: /run/kuma/bpf
+    bpffsPath: /sys/fs/bpf
+    # -- Host's cgroup2 path
+    cgroupPath: /sys/fs/cgroup
+    # -- Name of the network interface which TC programs should be attached to, we'll try to automatically determine it if empty
+    tcAttachIface: ""
     # -- Path where compiled eBPF programs which will be installed can be found
     programsSourcePath: /kuma/ebpf
 
diff --git a/docs/generated/cmd/kumactl/kumactl_install_transparent-proxy.md b/docs/generated/cmd/kumactl/kumactl_install_transparent-proxy.md
index 9182eb611..e9ea30c85 100644
--- a/docs/generated/cmd/kumactl/kumactl_install_transparent-proxy.md
+++ b/docs/generated/cmd/kumactl/kumactl_install_transparent-proxy.md
@@ -61,10 +61,12 @@ kumactl install transparent-proxy [flags]
 
 ```
       --dry-run                                                                         dry run
-      --ebpf-bpffs-path string                                                          the path of the BPF filesystem (default "/run/kuma/bpf")
+      --ebpf-bpffs-path string                                                          the path of the BPF filesystem (default "/sys/fs/bpf")
+      --ebpf-cgroup-path string                                                         the path of cgroup2 (default "/sys/fs/cgroup")
       --ebpf-enabled                                                                    use ebpf instead of iptables to install transparent proxy
       --ebpf-instance-ip string                                                         IP address of the instance (pod/vm) where transparent proxy will be installed
       --ebpf-programs-source-path string                                                path where compiled ebpf programs and other necessary for ebpf mode files can be found (default "/kuma/ebpf")
+      --ebpf-tc-attach-iface string                                                     name of the interface which TC eBPF programs should be attached to
       --exclude-inbound-ports string                                                    a comma separated list of inbound ports to exclude from redirect to Envoy
       --exclude-outbound-ports string                                                   a comma separated list of outbound ports to exclude from redirect to Envoy
       --exclude-outbound-tcp-ports-for-uids stringArray                                 tcp outbound ports to exclude for specific UIDs in a format of ports:uids where both ports and uids can be a single value, a list, a range or a combination of all, e.g. 3000-5000:103,104,106-108 would mean exclude ports from 3000 to 5000 for UIDs 103, 104, 106, 107, 108
diff --git a/go.mod b/go.mod
index 6ba7357d9..c4d960bb8 100644
--- a/go.mod
+++ b/go.mod
@@ -28,7 +28,7 @@ require (
 	github.com/gruntwork-io/terratest v0.40.22
 	github.com/hoisie/mustache v0.0.0-20160804235033-6375acf62c69
 	github.com/kelseyhightower/envconfig v1.4.0
-	github.com/kumahq/kuma-net v0.7.0
+	github.com/kumahq/kuma-net v0.7.1
 	github.com/kumahq/protoc-gen-kumadoc v0.3.1
 	github.com/lib/pq v1.10.7
 	github.com/miekg/dns v1.1.50
diff --git a/go.sum b/go.sum
index 75d180a2b..0a7687cb5 100644
--- a/go.sum
+++ b/go.sum
@@ -1027,8 +1027,8 @@ github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/ktrysmt/go-bitbucket v0.6.4/go.mod h1:9u0v3hsd2rqCHRIpbir1oP7F58uo5dq19sBYvuMoyQ4=
 github.com/kumahq/gateway-api v0.0.0-20220822185518-e8a3f0be778b h1:bOI+l61dTIF2vXrB/SUlRKCzJhFgGlBTVDKxKSCGrv8=
 github.com/kumahq/gateway-api v0.0.0-20220822185518-e8a3f0be778b/go.mod h1:x0AP6gugkFV8fC/oTlnOMU0pnmuzIR8LfIPRVUjxSqA=
-github.com/kumahq/kuma-net v0.7.0 h1:JA37D670iLQVdhOohRTW7oO6PIwiVoGWFsCz7/kK1+k=
-github.com/kumahq/kuma-net v0.7.0/go.mod h1:e/w4Ni39YHP2qw544Js+AC22xVsWeUXgfs1rSIj6uzs=
+github.com/kumahq/kuma-net v0.7.1 h1:nadBAfGmJyiFXE/o3LJA/3gQFFjE+iIQioLrkihiLAs=
+github.com/kumahq/kuma-net v0.7.1/go.mod h1:aqhBHsY3LQCTvBOr7oU1r2hwjTn9vhXUKDJXJokkSCM=
 github.com/kumahq/protoc-gen-kumadoc v0.3.1 h1:tY2dGQJTYVGkhxAHN154fddcWDRy55Pl4+oLT+FhsHo=
 github.com/kumahq/protoc-gen-kumadoc v0.3.1/go.mod h1:F+c9RjgKlv1Q3UEoPJCtMJw8Fd+X5PfG5jlkTSfZOMA=
 github.com/lann/builder v0.0.0-20180802200727-47ae307949d0/go.mod h1:dXGbAdH5GtBTC4WfIxhKZfyBF/HBFgRZSWwZ9g/He9o=
diff --git a/pkg/config/app/kuma-cp/kuma-cp.defaults.yaml b/pkg/config/app/kuma-cp/kuma-cp.defaults.yaml
index 7f6100a5c..f31ce62c0 100644
--- a/pkg/config/app/kuma-cp/kuma-cp.defaults.yaml
+++ b/pkg/config/app/kuma-cp/kuma-cp.defaults.yaml
@@ -281,7 +281,12 @@ runtime:
         # Name of the environmental variable which will include IP address of the pod
         instanceIPEnvVarName: INSTANCE_IP # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_INSTANCE_IP_ENV_VAR_NAME
         # Path where BPF file system will be mounted for pinning ebpf programs and maps
-        bpffsPath: /run/kuma/bpf # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_BPFFS_PATH
+        bpffsPath: /sys/fs/bpf # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_BPFFS_PATH
+        # Path of mounted cgroup2
+        cgroupPath: /sys/fs/cgroup # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_CGROUP_PATH
+        # Name of the network interface which should be used to attach to it TC programs
+        # when not specified, we will try to automatically determine it
+        tcAttachIface: "" # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_TC_ATTACH_IFACE
         # Path where compiled eBPF programs are placed
         programsSourcePath: /kuma/ebpf # ENV: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_PROGRAMS_SOURCE_PATH
     marshalingCacheExpirationTime: 5m # ENV: KUMA_RUNTIME_KUBERNETES_MARSHALING_CACHE_EXPIRATION_TIME
diff --git a/pkg/config/plugins/runtime/k8s/config.go b/pkg/config/plugins/runtime/k8s/config.go
index 9baa9e928..84639d573 100644
--- a/pkg/config/plugins/runtime/k8s/config.go
+++ b/pkg/config/plugins/runtime/k8s/config.go
@@ -80,7 +80,8 @@ func DefaultKubernetesRuntimeConfig() *KubernetesRuntimeConfig {
 			EBPF: EBPF{
 				Enabled:              false,
 				InstanceIPEnvVarName: "INSTANCE_IP",
-				BPFFSPath:            "/run/kuma/bpf",
+				BPFFSPath:            "/sys/fs/bpf",
+				CgroupPath:           "/sys/fs/cgroup",
 				ProgramsSourcePath:   "/kuma/ebpf",
 			},
 		},
@@ -273,6 +274,11 @@ type EBPF struct {
 	InstanceIPEnvVarName string `yaml:"instanceIPEnvVarName,omitempty" envconfig:"kuma_runtime_kubernetes_injector_ebpf_instance_ip_env_var_name"`
 	// Path where BPF file system will be mounted for pinning ebpf programs and maps
 	BPFFSPath string `yaml:"bpffsPath,omitempty" envconfig:"kuma_runtime_kubernetes_injector_ebpf_bpffs_path"`
+	// Path of mounted cgroup2
+	CgroupPath string `yaml:"cgroupPath,omitempty" envconfig:"kuma_runtime_kubernetes_injector_ebpf_cgroup_path"`
+	// Name of the network interface which should be used to attach to it TC programs
+	// when not specified, we will try to automatically determine it
+	TCAttachIface string `yaml:"tcAttachIface,omitempty" envconfig:"kuma_runtime_kubernetes_injector_ebpf_tc_attach_iface"`
 	// Path where compiled eBPF programs are placed
 	ProgramsSourcePath string `yaml:"programsSourcePath,omitempty" envconfig:"kuma_runtime_kubernetes_injector_ebpf_programs_source_path"`
 }
diff --git a/pkg/plugins/runtime/k8s/metadata/annotations.go b/pkg/plugins/runtime/k8s/metadata/annotations.go
index aeda58e9e..df6342fc4 100644
--- a/pkg/plugins/runtime/k8s/metadata/annotations.go
+++ b/pkg/plugins/runtime/k8s/metadata/annotations.go
@@ -145,6 +145,8 @@ const (
 	KumaCNI                                            = "kuma-cni"
 	KumaTransparentProxyingEbpf                        = "kuma.io/transparent-proxying-ebpf"
 	KumaTransparentProxyingEbpfBPFFSPath               = "kuma.io/transparent-proxying-ebpf-bpf-fs-path"
+	KumaTransparentProxyingEbpfCgroupPath              = "kuma.io/transparent-proxying-ebpf-cgroup-path"
+	KumaTransparentProxyingEbpfTCAttachIface           = "kuma.io/transparent-proxying-ebpf-tc-attach-iface"
 	KumaTransparentProxyingEbpfInstanceIPEnvVarName    = "kuma.io/transparent-proxying-ebpf-instance-ip-env-var-name"
 	KumaTransparentProxyingEbpfProgramsSourcePath      = "kuma.io/transparent-proxying-ebpf-programs-source-path"
 )
diff --git a/pkg/plugins/runtime/k8s/webhooks/injector/injector.go b/pkg/plugins/runtime/k8s/webhooks/injector/injector.go
index 74c501d62..710d9e13e 100644
--- a/pkg/plugins/runtime/k8s/webhooks/injector/injector.go
+++ b/pkg/plugins/runtime/k8s/webhooks/injector/injector.go
@@ -129,7 +129,7 @@ func (i *KumaInjector) InjectKuma(ctx context.Context, pod *kube_core.Pod) error
 			Name: "sys-fs-cgroup",
 			VolumeSource: kube_core.VolumeSource{
 				HostPath: &kube_core.HostPathVolumeSource{
-					Path: "/sys/fs/cgroup",
+					Path: i.cfg.EBPF.CgroupPath,
 				},
 			},
 		}, kube_core.Volume{
@@ -455,7 +455,7 @@ func (i *KumaInjector) NewInitContainer(pod *kube_core.Pod) (kube_core.Container
 		}
 
 		container.VolumeMounts = []kube_core.VolumeMount{
-			{Name: "sys-fs-cgroup", MountPath: "/sys/fs/cgroup"},
+			{Name: "sys-fs-cgroup", MountPath: i.cfg.EBPF.CgroupPath},
 			{Name: "bpf-fs", MountPath: i.cfg.EBPF.BPFFSPath, MountPropagation: &bidirectional},
 		}
 	}
@@ -486,7 +486,23 @@ func (i *KumaInjector) NewAnnotations(pod *kube_core.Pod, mesh string, logger lo
 	annotations[metadata.KumaTransparentProxyingEbpf] = metadata.BoolToEnabled(ebpfEnabled)
 
 	if ebpfEnabled {
-		annotations[metadata.KumaTransparentProxyingEbpfBPFFSPath], _ = podAnnotations.GetStringWithDefault(i.cfg.EBPF.BPFFSPath, metadata.KumaTransparentProxyingEbpfBPFFSPath)
+		podAnnotations.GetString()
+
+		bpffsPath, _ := podAnnotations.GetStringWithDefault(i.cfg.EBPF.BPFFSPath, metadata.KumaTransparentProxyingEbpfBPFFSPath)
+		if bpffsPath != "" {
+			annotations[metadata.KumaTransparentProxyingEbpfBPFFSPath] = bpffsPath
+		}
+
+		cgroupPath, _ := podAnnotations.GetStringWithDefault(i.cfg.EBPF.CgroupPath, metadata.KumaTransparentProxyingEbpfCgroupPath)
+		if cgroupPath != "" {
+			annotations[metadata.KumaTransparentProxyingEbpfCgroupPath] = cgroupPath
+		}
+
+		tcAttachIface, _ := podAnnotations.GetStringWithDefault(i.cfg.EBPF.TCAttachIface, metadata.KumaTransparentProxyingEbpfTCAttachIface)
+		if tcAttachIface != "" {
+			annotations[metadata.KumaTransparentProxyingEbpfTCAttachIface] = tcAttachIface
+		}
+
 		annotations[metadata.KumaTransparentProxyingEbpfProgramsSourcePath], _ = podAnnotations.GetStringWithDefault(i.cfg.EBPF.ProgramsSourcePath, metadata.KumaTransparentProxyingEbpfProgramsSourcePath)
 		if value, exists := podAnnotations.GetString(i.cfg.EBPF.InstanceIPEnvVarName, metadata.KumaTransparentProxyingEbpfInstanceIPEnvVarName); exists {
 			annotations[metadata.KumaTransparentProxyingEbpfInstanceIPEnvVarName] = value
diff --git a/pkg/transparentproxy/config/config.go b/pkg/transparentproxy/config/config.go
index f5cd12793..7ad1a7ce2 100644
--- a/pkg/transparentproxy/config/config.go
+++ b/pkg/transparentproxy/config/config.go
@@ -26,6 +26,8 @@ type TransparentProxyConfig struct {
 	EbpfEnabled                    bool
 	EbpfInstanceIP                 string
 	EbpfBPFFSPath                  string
+	EbpfCgroupPath                 string
+	EbpfTCAttachIface              string
 	EbpfProgramsSourcePath         string
 	Stdout                         io.Writer
 	Stderr                         io.Writer
diff --git a/pkg/transparentproxy/kubernetes/kubernetes.go b/pkg/transparentproxy/kubernetes/kubernetes.go
index c61f342f9..af290c8df 100644
--- a/pkg/transparentproxy/kubernetes/kubernetes.go
+++ b/pkg/transparentproxy/kubernetes/kubernetes.go
@@ -39,6 +39,8 @@ type PodRedirect struct {
 	ExperimentalTransparentProxyEngine       bool
 	TransparentProxyEnableEbpf               bool
 	TransparentProxyEbpfBPFFSPath            string
+	TransparentProxyEbpfCgroupPath           string
+	TransparentProxyEbpfTCAttachIface        string
 	TransparentProxyEbpfInstanceIPEnvVarName string
 	TransparentProxyEbpfProgramsSourcePath   string
 	ExcludeOutboundTCPPortsForUIDs           []string
@@ -117,6 +119,14 @@ func NewPodRedirectForPod(transparentProxyV2 bool, pod *kube_core.Pod) (*PodRedi
 		podRedirect.TransparentProxyEbpfBPFFSPath = value
 	}
 
+	if value, exists := metadata.Annotations(pod.Annotations).GetString(metadata.KumaTransparentProxyingEbpfCgroupPath); exists {
+		podRedirect.TransparentProxyEbpfCgroupPath = value
+	}
+
+	if value, exists := metadata.Annotations(pod.Annotations).GetString(metadata.KumaTransparentProxyingEbpfTCAttachIface); exists {
+		podRedirect.TransparentProxyEbpfTCAttachIface = value
+	}
+
 	if value, exists := metadata.Annotations(pod.Annotations).GetString(metadata.KumaTransparentProxyingEbpfInstanceIPEnvVarName); exists {
 		podRedirect.TransparentProxyEbpfInstanceIPEnvVarName = value
 	}
@@ -186,6 +196,14 @@ func (pr *PodRedirect) AsKumactlCommandLine() []string {
 			result = append(result, "--ebpf-bpffs-path", pr.TransparentProxyEbpfBPFFSPath)
 		}
 
+		if pr.TransparentProxyEbpfCgroupPath != "" {
+			result = append(result, "--ebpf-cgroup-path", pr.TransparentProxyEbpfCgroupPath)
+		}
+
+		if pr.TransparentProxyEbpfTCAttachIface != "" {
+			result = append(result, "--ebpf-tc-attach-iface", pr.TransparentProxyEbpfTCAttachIface)
+		}
+
 		if pr.TransparentProxyEbpfProgramsSourcePath != "" {
 			result = append(result, "--ebpf-programs-source-path", pr.TransparentProxyEbpfProgramsSourcePath)
 		}
diff --git a/pkg/transparentproxy/transparentproxy_experimental.go b/pkg/transparentproxy/transparentproxy_experimental.go
index fdd58a468..93092f23a 100644
--- a/pkg/transparentproxy/transparentproxy_experimental.go
+++ b/pkg/transparentproxy/transparentproxy_experimental.go
@@ -173,6 +173,8 @@ func (tp *ExperimentalTransparentProxy) Setup(tpConfig *config.TransparentProxyC
 			Enabled:            tpConfig.EbpfEnabled,
 			InstanceIP:         tpConfig.EbpfInstanceIP,
 			BPFFSPath:          tpConfig.EbpfBPFFSPath,
+			CgroupPath:         tpConfig.EbpfCgroupPath,
+			TCAttachIface:      tpConfig.EbpfTCAttachIface,
 			ProgramsSourcePath: tpConfig.EbpfProgramsSourcePath,
 		},
 		RuntimeStdout: tpConfig.Stdout,
diff --git a/tools/releases/dockerfiles/Dockerfile.kuma-init b/tools/releases/dockerfiles/Dockerfile.kuma-init
index 20e3ca7eb..cad23fb77 100644
--- a/tools/releases/dockerfiles/Dockerfile.kuma-init
+++ b/tools/releases/dockerfiles/Dockerfile.kuma-init
@@ -1,5 +1,5 @@
 ARG BASE_IMAGE_ARCH=amd64
-ARG EBPF_IMAGE=kumahq/kuma-net-ebpf:0.7.0
+ARG EBPF_IMAGE=kumahq/kuma-net-ebpf:0.7.1
 
 FROM --platform=linux/$BASE_IMAGE_ARCH $EBPF_IMAGE as ebpf
 FROM --platform=linux/$BASE_IMAGE_ARCH ubuntu:jammy


Test patch:
diff --git a/app/kumactl/cmd/completion/testdata/bash.golden b/app/kumactl/cmd/completion/testdata/bash.golden
index cc1da274d..7adb818f9 100644
--- a/app/kumactl/cmd/completion/testdata/bash.golden
+++ b/app/kumactl/cmd/completion/testdata/bash.golden
@@ -4179,6 +4179,10 @@ _kumactl_install_transparent-proxy()
     two_word_flags+=("--ebpf-bpffs-path")
     local_nonpersistent_flags+=("--ebpf-bpffs-path")
     local_nonpersistent_flags+=("--ebpf-bpffs-path=")
+    flags+=("--ebpf-cgroup-path=")
+    two_word_flags+=("--ebpf-cgroup-path")
+    local_nonpersistent_flags+=("--ebpf-cgroup-path")
+    local_nonpersistent_flags+=("--ebpf-cgroup-path=")
     flags+=("--ebpf-enabled")
     local_nonpersistent_flags+=("--ebpf-enabled")
     flags+=("--ebpf-instance-ip=")
@@ -4189,6 +4193,10 @@ _kumactl_install_transparent-proxy()
     two_word_flags+=("--ebpf-programs-source-path")
     local_nonpersistent_flags+=("--ebpf-programs-source-path")
     local_nonpersistent_flags+=("--ebpf-programs-source-path=")
+    flags+=("--ebpf-tc-attach-iface=")
+    two_word_flags+=("--ebpf-tc-attach-iface")
+    local_nonpersistent_flags+=("--ebpf-tc-attach-iface")
+    local_nonpersistent_flags+=("--ebpf-tc-attach-iface=")
     flags+=("--exclude-inbound-ports=")
     two_word_flags+=("--exclude-inbound-ports")
     local_nonpersistent_flags+=("--exclude-inbound-ports")
diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.dump-values.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.dump-values.yaml
index 52a816a05..7bc9f0d49 100644
--- a/app/kumactl/cmd/install/testdata/install-control-plane.dump-values.yaml
+++ b/app/kumactl/cmd/install/testdata/install-control-plane.dump-values.yaml
@@ -683,7 +683,11 @@ experimental:
     # -- Name of the environmental variable which will contain the IP address of a pod
     instanceIPEnvVarName: INSTANCE_IP
     # -- Path where BPF file system should be mounted
-    bpffsPath: /run/kuma/bpf
+    bpffsPath: /sys/fs/bpf
+    # -- Host's cgroup2 path
+    cgroupPath: /sys/fs/cgroup
+    # -- Name of the network interface which TC programs should be attached to, we'll try to automatically determine it if empty
+    tcAttachIface: ""
     # -- Path where compiled eBPF programs which will be installed can be found
     programsSourcePath: /kuma/ebpf
 
diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.tproxy-ebpf-experimental-enabled.golden.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.tproxy-ebpf-experimental-enabled.golden.yaml
index d4876fdc3..fb6d57097 100644
--- a/app/kumactl/cmd/install/testdata/install-control-plane.tproxy-ebpf-experimental-enabled.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-control-plane.tproxy-ebpf-experimental-enabled.golden.yaml
@@ -2316,7 +2316,9 @@ spec:
             - name: KUMA_RUNTIME_KUBERNETES_INJECTOR_CNI_ENABLED
               value: "false"
             - name: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_BPFFS_PATH
-              value: "/run/kuma/bpf"
+              value: "/sys/fs/bpf"
+            - name: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_CGROUP_PATH
+              value: "/sys/fs/cgroup"
             - name: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_ENABLED
               value: "true"
             - name: KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_INSTANCE_IP_ENV_VAR_NAME
diff --git a/pkg/config/loader_test.go b/pkg/config/loader_test.go
index bc2ac094f..b3a885ad5 100644
--- a/pkg/config/loader_test.go
+++ b/pkg/config/loader_test.go
@@ -186,6 +186,8 @@ var _ = Describe("Config loader", func() {
 			Expect(cfg.Runtime.Kubernetes.Injector.EBPF.Enabled).To(Equal(true))
 			Expect(cfg.Runtime.Kubernetes.Injector.EBPF.InstanceIPEnvVarName).To(Equal("FOO"))
 			Expect(cfg.Runtime.Kubernetes.Injector.EBPF.BPFFSPath).To(Equal("/run/kuma/bar"))
+			Expect(cfg.Runtime.Kubernetes.Injector.EBPF.CgroupPath).To(Equal("/faz/daz/zaz"))
+			Expect(cfg.Runtime.Kubernetes.Injector.EBPF.TCAttachIface).To(Equal("veth1"))
 			Expect(cfg.Runtime.Kubernetes.Injector.EBPF.ProgramsSourcePath).To(Equal("/kuma/baz"))
 
 			Expect(cfg.Runtime.Universal.DataplaneCleanupAge).To(Equal(1 * time.Hour))
@@ -406,6 +408,8 @@ runtime:
         enabled: true
         instanceIPEnvVarName: FOO
         bpffsPath: /run/kuma/bar
+        cgroupPath: /faz/daz/zaz
+        tcAttachIface: veth1
         programsSourcePath: /kuma/baz
 reports:
   enabled: false
@@ -596,6 +600,8 @@ proxy:
 				"KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_ENABLED":                                            "true",
 				"KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_INSTANCE_IP_ENV_VAR_NAME":                           "FOO",
 				"KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_BPFFS_PATH":                                         "/run/kuma/bar",
+				"KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_CGROUP_PATH":                                        "/faz/daz/zaz",
+				"KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_TC_ATTACH_IFACE":                                    "veth1",
 				"KUMA_RUNTIME_KUBERNETES_INJECTOR_EBPF_PROGRAMS_SOURCE_PATH":                               "/kuma/baz",
 				"KUMA_RUNTIME_KUBERNETES_VIRTUAL_PROBES_ENABLED":                                           "false",
 				"KUMA_RUNTIME_KUBERNETES_VIRTUAL_PROBES_PORT":                                              "1111",
diff --git a/pkg/config/plugins/runtime/k8s/testdata/default-config.golden.yaml b/pkg/config/plugins/runtime/k8s/testdata/default-config.golden.yaml
index d676f9399..6dea2312d 100644
--- a/pkg/config/plugins/runtime/k8s/testdata/default-config.golden.yaml
+++ b/pkg/config/plugins/runtime/k8s/testdata/default-config.golden.yaml
@@ -51,7 +51,8 @@ injector:
   ebpf:
     enabled: false
     instanceIPEnvVarName: INSTANCE_IP
-    bpffsPath: /run/kuma/bpf
+    bpffsPath: /sys/fs/bpf
+    cgroupPath: /sys/fs/cgroup
     programsSourcePath: /kuma/ebpf
 marshalingCacheExpirationTime: 5m0s
 serviceAccountName: system:serviceaccount:kuma-system:kuma-control-plane
diff --git a/pkg/transparentproxy/kubernetes/kubernetes_test.go b/pkg/transparentproxy/kubernetes/kubernetes_test.go
index c9c9afaa3..fafab75de 100644
--- a/pkg/transparentproxy/kubernetes/kubernetes_test.go
+++ b/pkg/transparentproxy/kubernetes/kubernetes_test.go
@@ -229,6 +229,7 @@ var _ = Describe("kubernetes", func() {
 						metadata.KumaTransparentProxyingEbpf:                     metadata.AnnotationEnabled,
 						metadata.KumaTransparentProxyingEbpfInstanceIPEnvVarName: "FOO_BAR",
 						metadata.KumaTransparentProxyingEbpfBPFFSPath:            "/baz/bar/foo",
+						metadata.KumaTransparentProxyingEbpfCgroupPath:           "/foo/bar/baz",
 						metadata.KumaTransparentProxyingEbpfProgramsSourcePath:   "/foo",
 					},
 				},
@@ -248,6 +249,7 @@ var _ = Describe("kubernetes", func() {
 				"--ebpf-enabled",
 				"--ebpf-instance-ip", "$(FOO_BAR)",
 				"--ebpf-bpffs-path", "/baz/bar/foo",
+				"--ebpf-cgroup-path", "/foo/bar/baz",
 				"--ebpf-programs-source-path", "/foo",
 			},
 		}),