pkg/operators/ebpf: Avoid adding netns field to snapshot process

[blanquicet]

Avoid adding netns field to snapshot process

Add netns field only if the snapshotter will run an iterator attached to a network hook.

Testing done

Before this PR

The netns field is present and zero:

$ IG_EXPERIMENTAL=true go run --exec "sudo -E" ./cmd/ig/... run snapshot_process -o jsonpretty
INFO[0000] Experimental features enabled
{
  "comm": "registry",
  "gid": 0,
  "k8s": {
    "container": "",
    "hostnetwork": false,
    "namespace": "",
    "node": "",
    "pod": ""
  },
  "mntns_id": 4026533095,
  "netns": 0,
  "pid": 2499,
  "ppid": 2479,
  "runtime": {
    "containerId": "4493ff561972b767e8ea2e1ab3147799559de9d518392fb8791ad73583f8bb1f",
    "containerImageDigest": "",
    "containerImageName": "registry:2",
    "containerName": "local-registry",
    "runtimeName": "docker"
  },
  "tid": 2499,
  "uid": 0
}

After this PR

The netns field is not present anymore:

$ IG_EXPERIMENTAL=true go run --exec "sudo -E" ./cmd/ig/... run snapshot_process -o jsonpretty
INFO[0000] Experimental features enabled
{
  "comm": "registry",
  "gid": 0,
  "k8s": {
    "container": "",
    "hostnetwork": false,
    "namespace": "",
    "node": "",
    "pod": ""
  },
  "mntns_id": 4026533095,
  "pid": 2499,
  "ppid": 2479,
  "runtime": {
    "containerId": "4493ff561972b767e8ea2e1ab3147799559de9d518392fb8791ad73583f8bb1f",
    "containerImageDigest": "",
    "containerImageName": "registry:2",
    "containerName": "local-registry",
    "runtimeName": "docker"
  },
  "tid": 2499,
  "uid": 0
}

[alban]

I wonder if ig should really add the netns field automatically... Why not doing it in the ebpf code, so leaving the choice to the gadget author whether the netns field makes sense? For snapshot-socket listing tcp/udp sockets, it makes sense since those sockets belong to the netns. But gadget authors could decide to use a bpf iterator on sockets, and dereference struct sock to find other kind of objects that are not netns related, and output them? I don't have examples in mind, I am just wondering if making things too automatic can prevent new use cases. Wdyt?

[blanquicet]

Wdyt?

Actually, that's what I also suggested initially but somehow, I lost the path 😅. Thanks for the review. Applied.

[alban]

LGTM!