[Helm] Missing CAP_BPF in retina-agent Daemonset spec

[ohookins]

Describe the bug
The linuxutil and packetforward plugins (which are enabled by default in the basic setup instructions) require the CAP_BPF kernel capability. However this seems to be missing from the default set of capabilities added in the Helm chart:

• https://github.com/microsoft/retina/blob/main/deploy/standard/manifests/controller/helm/retina/templates/daemonset.yaml#L110-L115
• https://github.com/microsoft/retina/blob/main/deploy/standard/manifests/controller/helm/retina/values.yaml#L140-L147

As a result, the agent errors out being unable to retrieve any metrics from any of the present interfaces.

To Reproduce
Steps to reproduce the behavior:

1. Install retina-agent via the Helm chart.
2. Observe that the daemonset and pods lack the CAP_BPF capability.
3. Observe that the agent cannot retrieve any interface metrics.

Expected behavior
BPF is added to the default set of capabilities in the Helm chart.

Screenshots
N/A

Platform (please complete the following information):

• OS: Amazon Linux 2
• Kubernetes Version: EKS 1.34
• Host: AWS EC2 instances
• Retina Version: 1.20

Additional context
Add any other context about the problem here.

[nddq]

AFAIK, linuxutils does not require CAP_BPF, and SYS_ADMIN should already covers BPF permissions for the plugins. What exactly is the issue you were seeing here, and did you verify that explicitly adding CAP_BPF resolved those issues?

[ohookins]

@nddq you're absolutely correct, and I think I made a number of changes that unfortunately made it look like this fixed the problem when it didn't. Here's the error I'm getting:

retina ts=2026-04-23T23:02:44.403Z level=error caller=linuxutil/ethtool_stats_linux.go:105 msg="Error while retrieving stats:" ifacename=eni07152960da9 error="
failed to retrieve interface stats: no such device" errorVerbose="no such device\nfailed to retrieve interface stats\ngithub.com/microsoft/retina/pkg/plugin/li
nuxutil.(*CachedEthtool).StatsWithBuffer\n\t/go/src/github.com/microsoft/retina/pkg/plugin/linuxutil/ethtool_handle_linux.go:42\ngithub.com/microsoft/retina/pk
g/plugin/linuxutil.(*EthtoolReader).readInterfaceStats\n\t/go/src/github.com/microsoft/retina/pkg/plugin/linuxutil/ethtool_stats_linux.go:98\ngithub.com/micros
oft/retina/pkg/plugin/linuxutil.(*EthtoolReader).readAndUpdate\n\t/go/src/github.com/microsoft/retina/pkg/plugin/linuxutil/ethtool_stats_linux.go:67\ngithub.co
m/microsoft/retina/pkg/plugin/linuxutil.(*linuxUtil).run.func2\n\t/go/src/github.com/microsoft/retina/pkg/plugin/linuxutil/linuxutil_linux.go:122\nruntime.goex
it\n\t/usr/local/go/src/runtime/asm_amd64.s:1771"

I get this for every virtual interface on the instance.