• Decision: Replace eBPF-uprobe-based TLS key extraction with an LD_PRELOAD shared-library interposer that wraps SSL_CTX_new/SSL_CTX_new_ex and registers OpenSSL's own SSL_CTX_set_keylog_callback. OpenSSL formats and hands us the exact NSS line; the callback ships it to the sidecar over a Unix domain socket, where the existing internal/keylog NSS validator/dedup/secure-writer pipeline (unchanged) appends it to the tmpfs keylog. eBPF stays exactly as-is for Feature 01's connect4/sockops transparent redirect; only the TLS key extraction mechanism changes.
• Reason: SSL_CTX_set_keylog_callback is versioned public OpenSSL API (@@OPENSSL_3.0.0) that cannot be stripped without breaking the library's own ABI contract — confirmed present in .dynsym on this project's target Ubuntu libssl.so.3 even though .symtab/debug symbols and the internal keylog routine are gone. It sidesteps struct-offset/verifier fragility entirely: no bpf_probe_read_user, no per-version offset table, no BTF/CO-RE dependency, and OpenSSL formats the NSS line itself instead of the sidecar reconstructing it from raw memory.
• Trade-off: No longer "pure eBPF" for this half of the system — it is classic dynamic-linker interposition (the same technique curl/Firefox use for SSLKEYLOGFILE), requiring the sidecar to control the app container's launch environment (LD_PRELOAD= env var + a bind-mounted .so) rather than attaching from outside after the fact. GoTLS (statically linked, no dynamic OpenSSL to interpose) remains an interface-only follow-on, unchanged from AD-008.
• Side effects (positive): drops the sidecar's need for CAP_PERFMON (uprobe-only) and the pod's shared PID namespace (was uprobe-attach-only) entirely — both were load-bearing only for the mechanism this replaces. internal/keylog/discovery.go, openssl_offsets.go, event.go, consumer.go, and bpf/tls_keylog.bpf.c are removed; internal/keylog/nss.go and writer.go are reused unchanged.
• Scope: Feature 02 (mechanism); Feature 03's Podman harness (drops --share pid, CAP_PERFMON; adds the interposer .so + LD_PRELOAD wiring on the app container).
• Date: 2026-09-12
• Status: active