`retina-agent` panics when initialize `dropreason` on EKS 1.33

[skurtzemann]

Describe the bug
When deploying retina in standard mode I got the following error on retina-agent on dropreason plugin

level=error caller=dropreason/dropreason_linux.go:156 msg="Error loading eBPF programs" error="field InetCskAcceptFexit: program inet_csk_accept_fexit: load program: permission denied: func 'inet_csk_accept' doesn't have 4-th argument: invalid bpf_context access off=24 size=8 (5 line(s) omitted)"

To Reproduce
Steps to reproduce the behavior:

1. Use the retina helm chart oci://ghcr.io/microsoft/retina/charts/retina, version v1.0.2
2. Use the below chart values file

os:
  linux: true
  windows: false

image:
  tag: v1.0.2

operator:
  tag: v1.0.2
  enabled: true
  enableRetinaEndpoint: true

logLevel: info
enabledPlugin_linux: '["packetforward", "dropreason"]'
enablePodLevel: false
enableAnnotations: true
remoteContext: false

Platform

• OS: `Amazon Linux 2023
  • Kernel version: 6.12.63-84.121.amzn2023.x86_64
• Kubernetes Version: 1.33
• Host: EKS
• Retina Version: 1.0.2

More details
Here the complete log

retina Starting Retina Agent
retina starting Retina daemon with legacy control plane v1.0.2
retina init client-go
retina api server:  https://172.20.0.1:443
retina init logger
retina ts=2026-01-22T13:26:48.660Z level=info caller=metrics/metrics.go:198 msg="Metrics initialized"
retina ts=2026-01-22T13:26:48.660Z level=info caller=standard/daemon.go:142 msg="{data aggregation level 15 0 low <nil>}"
retina ts=2026-01-22T13:26:48.660Z level=info caller=standard/daemon.go:160 msg="telemetry disabled"
retina ts=2026-01-22T13:26:48.669Z level=info caller=standard/daemon.go:231 msg="Kubernetes server version: v1.33.7-eks-ac2d5a0"
retina ts=2026-01-22T13:26:48.670Z level=info caller=pluginmanager/pluginmanager.go:58 msg="plugin manager has pod level disabled"
retina ts=2026-01-22T13:26:48.670Z level=info caller=controllermanager/controllermanager.go:72 msg="Initializing controller manager ..."
retina ts=2026-01-22T13:26:48.670Z level=info caller=servermanager/servermanager.go:33 msg="Initializing HTTP server ..."
retina ts=2026-01-22T13:26:48.670Z level=info caller=server/server.go:42 msg="Setting up handlers"
retina ts=2026-01-22T13:26:48.670Z level=info caller=server/server.go:57 msg="Completed handler setup"
retina ts=2026-01-22T13:26:48.670Z level=info caller=servermanager/servermanager.go:37 msg="HTTP server initialized..."
retina ts=2026-01-22T13:26:48.670Z level=info caller=standard/daemon.go:314 msg="Started controller manager"
retina ts=2026-01-22T13:26:48.670Z level=info caller=server/server.go:208 msg="Starting metrics server"
retina ts=2026-01-22T13:26:48.670Z level=info caller=server/server.go:247 msg="Serving metrics server" bindAddress=:18080 secure=false
retina ts=2026-01-22T13:26:48.670Z level=info caller=manager/server.go:83 msg="starting server" name="health probe" addr=[::]:18081
retina ts=2026-01-22T13:26:48.670Z level=info caller=pluginmanager/pluginmanager.go:118 msg="Starting plugin manager ..."
retina ts=2026-01-22T13:26:48.670Z level=info caller=servermanager/servermanager.go:42 msg="Starting HTTP server ..." host=0.0.0.0 port=10093
retina ts=2026-01-22T13:26:48.670Z level=info caller=server/server.go:69 msg="starting HTTP server... on " addr=0.0.0.0:10093
retina ts=2026-01-22T13:26:48.670Z level=info caller=pluginmanager/pluginmanager.go:150 msg="Skipping Conntrack GC loop as packetparser plugin is not enabled"
retina ts=2026-01-22T13:26:48.670Z level=info caller=packetforward/packetforward_linux.go:104 msg="Packet forwarding metric header generated"
retina ts=2026-01-22T13:26:50.280Z level=info caller=packetforward/packetforward_linux.go:132 msg="Packet forwarding metric compiled"
retina ts=2026-01-22T13:26:50.688Z level=info caller=packetforward/packetforward_linux.go:173 msg="Packet forwarding metric initialized"
retina ts=2026-01-22T13:26:50.689Z level=info caller=pluginmanager/pluginmanager.go:110 msg="Reconciled plugin" name=packetforward
retina ts=2026-01-22T13:26:50.689Z level=info caller=pluginmanager/pluginmanager.go:167 msg="starting plugin packetforward"
retina ts=2026-01-22T13:26:50.689Z level=info caller=packetforward/packetforward_linux.go:178 msg="Start collecting packet forward metrics"
retina ts=2026-01-22T13:26:52.698Z level=info caller=dropreason/dropreason_linux.go:125 msg="DropReason metric compiled"
retina ts=2026-01-22T13:26:52.704Z level=info caller=dropreason/ebpfsetup_linux.go:69 msg="Distro check:" isMariner=false
retina ts=2026-01-22T13:26:52.704Z level=info caller=dropreason/ebpfsetup_linux.go:78 msg="Detected kernel" version=6.12.0
retina ts=2026-01-22T13:26:52.704Z level=info caller=dropreason/ebpfsetup_linux.go:82 msg="Ftrace status" enabled=true
retina ts=2026-01-22T13:26:53.100Z level=error caller=dropreason/dropreason_linux.go:156 msg="Error loading eBPF programs" error="field InetCskAcceptFexit: program inet_csk_accept_fexit: load program: permission denied: func 'inet_csk_accept' doesn't have 4-th argument: invalid bpf_context access off=24 size=8 (5 line(s) omitted)"
retina ts=2026-01-22T13:26:53.100Z level=info caller=server/server.go:79 msg="gracefully shutting down HTTP server..."
retina ts=2026-01-22T13:26:53.100Z level=info caller=server/server.go:71 msg="HTTP server stopped with err: http: Server closed"
retina ts=2026-01-22T13:26:53.101Z level=panic caller=controllermanager/controllermanager.go:112 msg="Error running controller manager" error="failed to reconcile plugin dropreason: failed to init plugin: field InetCskAcceptFexit: program inet_csk_accept_fexit: load program: permission denied: func 'inet_csk_accept' doesn't have 4-th argument: invalid bpf_context access off=24 size=8 (5 line(s) omitted)" errorVerbose="field InetCskAcceptFexit: program inet_csk_accept_fexit: load program: permission denied: func 'inet_csk_accept' doesn't have 4-th argument: invalid bpf_context access off=24 size=8 (5 line(s) omitted)\nfailed to init plugin\ngithub.com/microsoft/retina/pkg/managers/pluginmanager.(*PluginManager).Reconcile\n\t/go/src/github.com/microsoft/retina/pkg/managers/pluginmanager/pluginmanager.go:107\ngithub.com/microsoft/retina/pkg/managers/pluginmanager.(*PluginManager).Start\n\t/go/src/github.com/microsoft/retina/pkg/managers/pluginmanager/pluginmanager.go:159\ngithub.com/microsoft/retina/pkg/managers/controllermanager.(*Controller).Start.func1\n\t/go/src/github.com/microsoft/retina/pkg/managers/controllermanager/controllermanager.go:102\ngolang.org/x/sync/errgroup.(*Group).Go.func1\n\t/go/pkg/mod/golang.org/x/sync@v0.17.0/errgroup/errgroup.go:93\nruntime.goexit\n\t/usr/local/go/src/runtime/asm_amd64.s:1700\nfailed to reconcile plugin dropreason\ngithub.com/microsoft/retina/pkg/managers/pluginmanager.(*PluginManager).Start\n\t/go/src/github.com/microsoft/retina/pkg/managers/pluginmanager/pluginmanager.go:163\ngithub.com/microsoft/retina/pkg/managers/controllermanager.(*Controller).Start.func1\n\t/go/src/github.com/microsoft/retina/pkg/managers/controllermanager/controllermanager.go:102\ngolang.org/x/sync/errgroup.(*Group).Go.func1\n\t/go/pkg/mod/golang.org/x/sync@v0.17.0/errgroup/errgroup.go:93\nruntime.goexit\n\t/usr/local/go/src/runtime/asm_amd64.s:1700"
retina panic: Error running controller manager
retina
retina goroutine 90 [running]:
retina go.uber.org/zap/zapcore.CheckWriteAction.OnWrite(0x1?, 0xc00009e538?, {0x0?, 0x0?, 0xc000839900?})
retina 	/go/pkg/mod/go.uber.org/zap@v1.27.0/zapcore/entry.go:196 +0x54
retina go.uber.org/zap/zapcore.(*CheckedEntry).Write(0xc000e0e410, {0xc00303e840, 0x1, 0x1})
retina 	/go/pkg/mod/go.uber.org/zap@v1.27.0/zapcore/entry.go:262 +0x24a
retina go.uber.org/zap.(*Logger).Panic(0xc0009f0bc0?, {0x6b419bb?, 0x0?}, {0xc00303e840, 0x1, 0x1})
retina 	/go/pkg/mod/go.uber.org/zap@v1.27.0/logger.go:285 +0x4b
retina github.com/microsoft/retina/pkg/managers/controllermanager.(*Controller).Start(0xc000243ea0, {0x711a1b0?, 0xc0007c8f00?})
retina 	/go/src/github.com/microsoft/retina/pkg/managers/controllermanager/controllermanager.go:112 +0x2bc
retina created by github.com/microsoft/retina/cmd/standard.(*Daemon).Start in goroutine 1
retina 	/go/src/github.com/microsoft/retina/cmd/standard/daemon.go:313 +0x2caf

Thanks 🙏

[skurtzemann]

Hi!
This issue seems to be the same than #1906?

[ohookins]

I'm seeing the same problem with Retina 1.1.0 and EKS 1.34.

Specifically:

retina ts=2026-04-13T07:08:20.479Z level=panic caller=controllermanager/controllermanager.go:112 msg="Error running controller manager" error="failed to
 reconcile plugin dropreason: failed to init plugin: field InetCskAcceptFexit: program inet_csk_accept_fexit: load program: permission denied: func 'ine
t_csk_accept' doesn't have 4-th argument: invalid bpf_context access off=24 size=8 (5 line(s) omitted)" errorVerbose="field InetCskAcceptFexit: program
inet_csk_accept_fexit: load program: permission denied: func 'inet_csk_accept' doesn't have 4-th argument: invalid bpf_context access off=24 size=8 (5 l
ine(s) omitted)\nfailed to init plugin\ngithub.com/microsoft/retina/pkg/managers/pluginmanager.(*PluginManager).Reconcile\n\t/go/src/github.com/microsof
t/retina/pkg/managers/pluginmanager/pluginmanager.go:107\ngithub.com/microsoft/retina/pkg/managers/pluginmanager.(*PluginManager).Start\n\t/go/src/githu
b.com/microsoft/retina/pkg/managers/pluginmanager/pluginmanager.go:159\ngithub.com/microsoft/retina/pkg/managers/controllermanager.(*Controller).Start.f
unc1\n\t/go/src/github.com/microsoft/retina/pkg/managers/controllermanager/controllermanager.go:102\ngolang.org/x/sync/errgroup.(*Group).Go.func1\n\t/go
/pkg/mod/golang.org/x/sync@v0.17.0/errgroup/errgroup.go:93\nruntime.goexit\n\t/usr/local/go/src/runtime/asm_amd64.s:1700\nfailed to reconcile plugin dro
preason\ngithub.com/microsoft/retina/pkg/managers/pluginmanager.(*PluginManager).Start\n\t/go/src/github.com/microsoft/retina/pkg/managers/pluginmanager
/pluginmanager.go:163\ngithub.com/microsoft/retina/pkg/managers/controllermanager.(*Controller).Start.func1\n\t/go/src/github.com/microsoft/retina/pkg/m
anagers/controllermanager/controllermanager.go:102\ngolang.org/x/sync/errgroup.(*Group).Go.func1\n\t/go/pkg/mod/golang.org/x/sync@v0.17.0/errgroup/errgr
oup.go:93\nruntime.goexit\n\t/usr/local/go/src/runtime/asm_amd64.s:1700"
retina panic: Error running controller manager

[nddq]

#1907 this might be the fix

[ohookins]

Same problem with v1.2.0.

[SRodi]

@skurtzemann I opened #2206 which should fix the dropreason issue on Linux 6.10+. After it’s released, could you please test it on your side? If it resolves the problem we can close this Issue.

[ohookins]

I've tested image hash c27b5e3 and it solves the issue.