From 6e587313d1fc5c1022adbbfd09503bd2f35ece24 Mon Sep 17 00:00:00 2001
From: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Date: Wed, 4 Feb 2026 16:31:49 +0100
Subject: [PATCH] feat!: drop support for legacy eBPF probe

Falco 0.43.0 deprecated the legacy eBPF probe, and the support will
be removed soon in the next libs release. Drop support for testing it.

BREAKING CHANGE: legacy eBPF probe tests cannot be run anymore

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
---
 .../roles/scap_open/tasks/main.yml            | 63 -------------------
 .../roles/scap_open/vars/main.yml             |  4 --
 ansible-playbooks/scap-open.yml               |  1 -
 3 files changed, 68 deletions(-)

diff --git a/ansible-playbooks/roles/scap_open/tasks/main.yml b/ansible-playbooks/roles/scap_open/tasks/main.yml
index a118320..912479a 100644
--- a/ansible-playbooks/roles/scap_open/tasks/main.yml
+++ b/ansible-playbooks/roles/scap_open/tasks/main.yml
@@ -27,24 +27,6 @@
         scap_open_modern_bpf_supported: false
       when: scap_open_result.rc == 95
 
-- name: Check Old Bpf Support
-  block:
-    - name: Enable old Bpf support
-      ansible.builtin.set_fact:
-        scap_open_bpf_supported: true
-      # Enable legacy BPF support if the minimum kernel version requirement is met and the user didn't explicitly decide
-      # to skip legacy BPF tests.
-      when:
-        - ansible_kernel is version(scap_open_bpf_minimum_kver[ansible_architecture],'>=')
-        - machines
-          | selectattr('name', 'equalto', inventory_hostname)
-          | selectattr('arch', 'equalto', ansible_architecture)
-          | map(attribute='skip_legacy_bpf_tests')
-          | map('default', false)
-          | select('equalto', true)
-          | list
-          | length == 0
-
 - name: Prepare the build directory
   block:
     - name: Create cmake output dir
@@ -61,7 +43,6 @@
              -DUSE_BUNDLED_DEPS=ON
              -DBUILD_LIBSCAP_MODERN_BPF=OFF
              -DBUILD_LIBSCAP_GVISOR=OFF
-             -DBUILD_BPF={{ scap_open_bpf_supported }}
              -DCREATE_TEST_TARGETS=OFF
              ..
         chdir: "{{ remote_repos_folder }}/repos/{{ repos['libs'].name }}/build"
@@ -143,50 +124,6 @@
       delegate_to: localhost
       become: false
 
-- name: Build bpf probe
-  block:
-    - name: Build bpf probe
-      ansible.builtin.command:
-        cmd: cmake --build . --target bpf --parallel {{ cpus }}
-        chdir: "{{ remote_repos_folder }}/repos/{{ repos['libs'].name }}/build"
-      register: scap_open_bpf_probe_result
-      when: scap_open_bpf_supported
-      changed_when: false
-  rescue:
-    - name: Print error message to stdout --- build bpf probe
-      ansible.builtin.debug:
-        var: scap_open_bpf_probe_result
-  always:
-    - name: Dump error message to file
-      ansible.builtin.copy:
-        content: "{{ scap_open_bpf_probe_result | to_nice_json }}"
-        dest: "{{ scap_open_output_dest_dir }}/bpf-probe_build.json"
-        mode: '0755'
-      delegate_to: localhost
-      become: false
-
-- name: Scap-open + bpf probe
-  block:
-    - name: Run scap-open with bpf probe
-      ansible.builtin.command:
-        cmd: /tmp/scap-open --num_events 50 --bpf driver/bpf/probe.o
-        chdir: "{{ remote_repos_folder }}/repos/{{ repos['libs'].name }}/build"
-      register: scap_open_result
-      when: scap_open_bpf_supported
-      changed_when: false
-  rescue:
-    - name: Print error message to stdout --- scap-open + bpf probe
-      ansible.builtin.debug:
-        var: scap_open_result
-  always:
-    - name: Dump error message to file
-      ansible.builtin.copy:
-        content: "{{ scap_open_result | to_nice_json }}"
-        dest: "{{ scap_open_output_dest_dir }}/bpf-probe_scap-open.json"
-        mode: '0755'
-      delegate_to: localhost
-      become: false
-
 - name: Scap-open + modern probe
   block:
     - name: Run scap-open with modern-probe
diff --git a/ansible-playbooks/roles/scap_open/vars/main.yml b/ansible-playbooks/roles/scap_open/vars/main.yml
index 6ff5681..6e44a19 100644
--- a/ansible-playbooks/roles/scap_open/vars/main.yml
+++ b/ansible-playbooks/roles/scap_open/vars/main.yml
@@ -1,6 +1,2 @@
 ---
 scap_open_modern_bpf_supported: true
-scap_open_bpf_supported: false
-scap_open_bpf_minimum_kver:
-  aarch64: '4.17'
-  x86_64: '4.14'
diff --git a/ansible-playbooks/scap-open.yml b/ansible-playbooks/scap-open.yml
index 8d12783..2efc8ac 100644
--- a/ansible-playbooks/scap-open.yml
+++ b/ansible-playbooks/scap-open.yml
@@ -66,7 +66,6 @@
              -DBUILD_LIBSCAP_MODERN_BPF=ON \
              -DMODERN_BPF_SKEL_DIR=/tmp \
              -DBUILD_DRIVER=Off \
-             -DBUILD_BPF=Off \
              -DBUILD_LIBSCAP_GVISOR=OFF \
              -DCREATE_TEST_TARGETS=Off \
              ..