Function runBpftrace

cli/cmd/bpftrace.go:169–289

(_ *cobra.Command, args []string)

}

func runBpftrace(_ *cobra.Command, args []string) error {
	// Validate image version
	if traceRetinaShellImageVersion == "" {
		return errMissingRequiredRetinaShellImageVersionArg
	}

	// === SECURITY: Validate all user inputs BEFORE any use ===

	// Validate IP filter (strict parsing)
	filterIP, err := ValidateFilterIP(traceFilterIP)
	if err != nil {
		return fmt.Errorf("invalid --ip: %w", err)
	}

	// Validate CIDR filter (strict parsing)
	filterCIDR, err := ValidateFilterCIDR(traceFilterCIDR)
	if err != nil {
		return fmt.Errorf("invalid --cidr: %w", err)
	}

	// Validate output format (whitelist)
	outputFormat, err := ValidateOutputFormat(traceOutputFormat)
	if err != nil {
		return err
	}

	// Get namespace
	namespace, explicitNamespace, err := traceMatchVersionFlags.ToRawKubeConfigLoader().Namespace()
	if err != nil {
		return fmt.Errorf("error retrieving namespace arg: %w", err)
	}

	// Parse node argument (only nodes supported, not pods)
	r := resource.NewBuilder(traceConfigFlags).
		WithScheme(scheme.Scheme, scheme.Scheme.PrioritizedVersionsAllGroups()...).
		FilenameParam(explicitNamespace, &resource.FilenameOptions{}).
		NamespaceParam(namespace).DefaultNamespace().ResourceNames("nodes", args[0]).
		Do()
	if rerr := r.Err(); rerr != nil {
		return fmt.Errorf("error constructing resource builder: %w", rerr)
	}

	// Get REST config
	restConfig, err := traceMatchVersionFlags.ToRESTConfig()
	if err != nil {
		return fmt.Errorf("error constructing REST config: %w", err)
	}

	// Visit the resource (should be a node)
	return r.Visit(func(info *resource.Info, err error) error { //nolint:wrapcheck // visitor pattern returns errors as-is
		if err != nil {
			return err
		}

		switch obj := info.Object.(type) {
		case *v1.Node:
			nodeName := obj.Name
			podNamespace := namespace