Add large buffer support for Kafka

[pinoOgni]

This PR continues the work done #512

Now OBI parses kafka data in kernel space and it sends a large buffer event to the userspace. In this way we can parse big MetadataResponse. This is really useful when the packet is too big, for example when there are multiple brokers and unfortunately the needed topic is after that.

A dedicated integration test has also been added to test only Kafka large buffer with 3 Kafka brokers, allowing for a list of brokers and increasing the size of the MetadataResponse.
Since we need the MetadataResponse to create the spans, in the testServer the Consumer has been configured to trigger the Metadata refresh so that OBI can capture it.

Finally, to increase the size of the packet, an ad hoc topic name was used, it is a poem on OBI (written by Gemini not by me).

[codecov]

Codecov Report

❌ Patch coverage is 27.77778% with 13 lines in your changes missing coverage. Please review.
✅ Project coverage is 47.20%. Comparing base (43f4349) to head (dbb3ba9).
⚠️ Report is 2 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/ebpf/common/tcp_detect_transform.go	0.00%	12 Missing ⚠️
pkg/ebpf/common/tcp_large_buffer.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1034      +/-   ##
==========================================
- Coverage   47.24%   47.20%   -0.05%     
==========================================
  Files         260      260              
  Lines       27370    27382      +12     
==========================================
- Hits        12932    12926       -6     
- Misses      13576    13594      +18     
  Partials      862      862              

Flag	Coverage Δ
integration-test	22.85% <6.66%> (-0.02%)	⬇️
integration-test-arm	0.00% <0.00%> (ø)
integration-test-vm-${ARCH}-${KERNEL_VERSION}	0.00% <0.00%> (ø)
k8s-integration-test	2.64% <0.00%> (-0.01%)	⬇️
oats-test	0.00% <0.00%> (ø)
unittests	48.41% <26.66%> (-0.05%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[mariomac]

LGTM! Before approving/merging, I'll wait for the final approval from Stephen, as he had some comments.

[grcevski]

This looks great @pinoOgni !

Since the Kafka protocol has many edge cases in the parsing logic, do you think it would be possible to add C based unit test? We used to have some in the past, but we've removed them, since the code that was tested was removed too.

I'll find a commit and show you what we had.

[grcevski]

Here's an example:

https://github.com/grafana/beyla/pull/1800/changes#diff-8a7373a55531253d2dab60ba70e30090a9a184c4a2155c43b76a6ff427489e4c

and another one:
https://github.com/grafana/beyla/pull/1572/changes#diff-e4a29d4dfb6df1937df3675d72ec49aa36159e9a9942d800debc6288149325cf

[pinoOgni]

Hi @grcevski, thanks so much for the advice!

I followed your example and created a unit test for Kafka. I tested the two main functions is_kafka and kafka_send_large_buffer, as well as all the internally called functions. I added various tests, but I'm open to other uses cases.

P.s. Thanks to the unit test, I found a bug in the ebpf code that the integration tests hadn't detected!

[grcevski]

LGTM! Thanks for doing this.