fix(dnsmanager): scope IP-to-domain resolution cache per container

pkg/containerprofilemanager/v1/container_data.go

@@ -159,15 +159,15 @@ func (cd *containerData) getCallStacks() []v1beta1.IdentifiedCallStack {
 }
 
 // getIngressNetworkNeighbors returns ingress network neighbors for this container
-func (cd *containerData) getIngressNetworkNeighbors(namespace string, k8sClient k8sclient.K8sClientInterface, dnsResolverClient dnsmanager.DNSResolver) []v1beta1.NetworkNeighbor {
+func (cd *containerData) getIngressNetworkNeighbors(containerID string, namespace string, k8sClient k8sclient.K8sClientInterface, dnsResolverClient dnsmanager.DNSResolver) []v1beta1.NetworkNeighbor {
 	var ingress []v1beta1.NetworkNeighbor
 	if cd.networks == nil {
 		return ingress
 	}
 
 	for _, event := range cd.networks.ToSlice() {
 		if event.PktType == utils.HostPktType {
-			neighbor := cd.createNetworkNeighbor(event, namespace, k8sClient, dnsResolverClient)
+			neighbor := cd.createNetworkNeighbor(containerID, event, namespace, k8sClient, dnsResolverClient)
 			if neighbor == nil {
 				continue
 			}
@@ -179,15 +179,15 @@ func (cd *containerData) getIngressNetworkNeighbors(namespace string, k8sClient
 }
 
 // getEgressNetworkNeighbors returns egress network neighbors for this container
-func (cd *containerData) getEgressNetworkNeighbors(namespace string, k8sClient k8sclient.K8sClientInterface, dnsResolverClient dnsmanager.DNSResolver) []v1beta1.NetworkNeighbor {
+func (cd *containerData) getEgressNetworkNeighbors(containerID string, namespace string, k8sClient k8sclient.K8sClientInterface, dnsResolverClient dnsmanager.DNSResolver) []v1beta1.NetworkNeighbor {
 	var egress []v1beta1.NetworkNeighbor
 	if cd.networks == nil {
 		return egress
 	}
 
 	for _, event := range cd.networks.ToSlice() {
 		if event.PktType != utils.HostPktType {
-			neighbor := cd.createNetworkNeighbor(event, namespace, k8sClient, dnsResolverClient)
+			neighbor := cd.createNetworkNeighbor(containerID, event, namespace, k8sClient, dnsResolverClient)
 			if neighbor == nil {
 				continue
 			}
@@ -199,7 +199,7 @@ func (cd *containerData) getEgressNetworkNeighbors(namespace string, k8sClient k
 }
 
 // createNetworkNeighbor creates a network neighbor from a network event
-func (cd *containerData) createNetworkNeighbor(networkEvent NetworkEvent, namespace string, k8sClient k8sclient.K8sClientInterface, dnsResolverClient dnsmanager.DNSResolver) *v1beta1.NetworkNeighbor {
+func (cd *containerData) createNetworkNeighbor(containerID string, networkEvent NetworkEvent, namespace string, k8sClient k8sclient.K8sClientInterface, dnsResolverClient dnsmanager.DNSResolver) *v1beta1.NetworkNeighbor {
 	var neighborEntry v1beta1.NetworkNeighbor
 
 	portIdentifier := generatePortIdentifierFromEvent(networkEvent)
@@ -262,7 +262,7 @@ func (cd *containerData) createNetworkNeighbor(networkEvent NetworkEvent, namesp
 		neighborEntry.IPAddress = networkEvent.Destination.IPAddress
 
 		if dnsResolverClient != nil {
-			domain, ok := dnsResolverClient.ResolveIPAddress(networkEvent.Destination.IPAddress)
+			domain, ok := dnsResolverClient.ResolveIPAddress(containerID, networkEvent.Destination.IPAddress)
 			if ok {
 				neighborEntry.DNS = domain
 				neighborEntry.DNSNames = []string{domain}

pkg/containerprofilemanager/v1/containerprofile_manager_test.go

@@ -562,11 +562,11 @@ func TestContainerDataMethods(t *testing.T) {
 	assert.Empty(t, callStacks)
 
 	// Test getIngressNetworkNeighbors with nil networks
-	ingress := cd.getIngressNetworkNeighbors("default", nil, nil)
+	ingress := cd.getIngressNetworkNeighbors("", "default", nil, nil)
 	assert.Empty(t, ingress)
 
 	// Test getEgressNetworkNeighbors with nil networks
-	egress := cd.getEgressNetworkNeighbors("default", nil, nil)
+	egress := cd.getEgressNetworkNeighbors("", "default", nil, nil)
 	assert.Empty(t, egress)
 }
 

pkg/containerprofilemanager/v1/event_reporting_test.go

@@ -17,7 +17,7 @@ import (
 // createNetworkNeighbor's DNS branch without a real dnsmanager.
 type fakeDNSResolver struct{ domain string }
 
-func (f fakeDNSResolver) ResolveIPAddress(string) (string, bool) { return f.domain, true }
+func (f fakeDNSResolver) ResolveIPAddress(string, string) (string, bool) { return f.domain, true }
 func (f fakeDNSResolver) ResolveContainerProcessToCloudServices(string, uint32) mapset.Set[string] {
 	return nil
 }
@@ -111,7 +111,7 @@ func TestNetworkNeighborIncrementCoversMaxDNSName(t *testing.T) {
 	}
 
 	cd := &containerData{}
-	neighbor := cd.createNetworkNeighbor(networkEvent, "default", nil, fakeDNSResolver{domain: maxDNSName})
+	neighbor := cd.createNetworkNeighbor("", networkEvent, "default", nil, fakeDNSResolver{domain: maxDNSName})
 	if !assert.NotNil(t, neighbor) {
 		return
 	}
@@ -151,7 +151,7 @@ func TestNetworkNeighborIncrementCoversSelectorPayload(t *testing.T) {
 	// neighbor. watchedContainerData.Namespace is what networkNeighborIncrement reads to make
 	// the same "different namespace" call createNetworkNeighbor's own namespace arg does below.
 	cd := &containerData{watchedContainerData: &objectcache.WatchedContainerData{Namespace: "default"}}
-	neighbor := cd.createNetworkNeighbor(networkEvent, "default", nil, nil)
+	neighbor := cd.createNetworkNeighbor("", networkEvent, "default", nil, nil)
 	if !assert.NotNil(t, neighbor) {
 		return
 	}
@@ -214,3 +214,41 @@ func TestResolveExecPath(t *testing.T) {
 		})
 	}
 }
+
+type trackingDNSResolver struct {
+	lastContainerID string
+	lastIPAddress   string
+}
+
+func (r *trackingDNSResolver) ResolveIPAddress(containerID string, ipAddr string) (string, bool) {
+	r.lastContainerID = containerID
+	r.lastIPAddress = ipAddr
+	return "resolved.domain", true
+}
+
+func (r *trackingDNSResolver) ResolveContainerProcessToCloudServices(string, uint32) mapset.Set[string] {
+	return nil
+}
+
+func TestCreateNetworkNeighbor_EmptyContainerIDWithWatchedContainerData(t *testing.T) {
+	cd := &containerData{
+		watchedContainerData: &objectcache.WatchedContainerData{
+			ContainerID: "watched-container-456",
+		},
+	}
+
+	networkEvent := NetworkEvent{
+		Port:    80,
+		PktType: utils.OutgoingPktType,
+		Destination: Destination{
+			IPAddress: "93.184.216.34",
+		},
+	}
+
+	resolver := &trackingDNSResolver{}
+	neighbor := cd.createNetworkNeighbor("", networkEvent, "default", nil, resolver)
+	assert.NotNil(t, neighbor)
+	assert.Equal(t, "", resolver.lastContainerID, "empty containerID must be preserved without falling back to watchedContainerData")
+	assert.Equal(t, "93.184.216.34", resolver.lastIPAddress)
+	assert.Equal(t, "resolved.domain", neighbor.DNS)
+}

pkg/containerprofilemanager/v1/monitoring.go

@@ -207,8 +207,8 @@ func (cpm *ContainerProfileManager) saveContainerProfile(watchedContainer *objec
 			Endpoints:            containerData.getEndpoints(),
 			PolicyByRuleId:       containerData.getRulePolicies(),
 			IdentifiedCallStacks: containerData.getCallStacks(),
-			Egress:               containerData.getEgressNetworkNeighbors(container.K8s.Namespace, cpm.k8sClient, cpm.dnsResolverClient),
-			Ingress:              containerData.getIngressNetworkNeighbors(container.K8s.Namespace, cpm.k8sClient, cpm.dnsResolverClient),
+			Egress:               containerData.getEgressNetworkNeighbors(watchedContainer.ContainerID, container.K8s.Namespace, cpm.k8sClient, cpm.dnsResolverClient),
+			Ingress:              containerData.getIngressNetworkNeighbors(watchedContainer.ContainerID, container.K8s.Namespace, cpm.k8sClient, cpm.dnsResolverClient),
 			LabelSelector: metav1.LabelSelector{
 				MatchLabels:      watchedContainer.ParentWorkloadSelector.MatchLabels,
 				MatchExpressions: watchedContainer.ParentWorkloadSelector.MatchExpressions,