注册
登录
| 关键词： httpbin Pod Ksniff Wireshark nbsp static kubectl 监听 0.0 sleep |
对于相当一部分读者来说，在 Kubernetes 环境中，针对 Pod 进行抓包是个常规操作，在 Pod 中、在 Node 中都能够完成，抓出文件之后现场查看或者拷贝回来喂给 Wireshark 也都不难。 Ksniff 工具的作用是，把这些常规步骤组织起来，用一个简单的 kubectl 插件命令，就能完成这一系列的操作。 Ksniff 有几个很有意思的特色：
安装使用 Krew 能够很方便的安装 Ksniff： $ kubectl krew install sniff
Updated the local copy of plugin index.
Installing plugin: sniff
CAVEATS:
\
| This plugin needs the following programs:
| * wireshark (optional, used for live capture)
/
Installed plugin: sniff抓包到 Wireshark部署一个简单的 httpbin 服务： apiVersion: v1
kind: Service
metadata:
name: httpbin
labels:
app: httpbin
spec:
ports:
- name: http
port: 8000
targetPort: 80
selector:
app: httpbin
---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
name: httpbin
spec:
replicas: 1
template:
metadata:
labels:
app: httpbin
version: v1
spec:
containers:
- image: docker.io/kennethreitz/httpbin
imagePullPolicy: IfNotPresent
name: httpbin
ports:
- containerPort: 80服务启动之后，再启动一个客户端： apiVersion: extensions/v1beta1
kind: Deployment
metadata:
name: sleep
spec:
replicas: 1
template:
metadata:
labels:
app: sleep
version: v1
spec:
containers:
- name: sleep
image: dustise/sleep
imagePullPolicy: IfNotPresent然后就可以启动 $ kubectl sniff httpbin-5fc7cf895d-lr89b
...
INFO[0000] sniffing method: upload static tcpdump
...
INFO[0000] using tcpdump path at: '/Users/dustise/.krew/store/sniff/
。。。INFO[0002] executing command: '[/tmp/static-tcpdump -i any -U -w - ]' on container: 'httpbin', pod: 'httpbin-5fc7cf895d-lr89b', namespace: 'default'不难看出，ksniff 非常粗暴的将一个 tcpdump 上传到了被抓包的 Pod 上直接运行。并且命令执行后，直接启动了 Wireshark 进行监听。 下面从 sleep Pod 上给被监听 Pod 制造一点流量。 $ kubectl exec -it sleep-69bd44b5bb-tk6vn -- curl http://httpbin:8000/ip
{
"origin": "10.244.0.19"
}在 Wireshark 中会看到相应的数据包：
查看一下被监听 Pod 的进程： $ kubectl exec -it httpbin-5fc7cf895d-lr89b -- ps aux
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.0 0.6 85980 25100 ? Ss 15:42 0:01 /usr/bin/python
root 8 0.0 0.8 130364 35164 ? S 15:42 0:01 /usr/bin/python
root 35 0.0 0.0 6392 3568 ? Ss 15:50 0:00 /tmp/static-tcp
root 47 0.0 0.0 6392 3564 ? Ss 15:58 0:00 /tmp/static-tcp
root 70 0.0 0.0 6392 3564 ? Ss 16:17 0:00 /tmp/static-tcp
root 90 0.0 0.0 6392 3568 ? Ss 17:01 0:00 /tmp/static-tcp
root 102 0.0 0.0 6392 3568 ? Ss 17:05 0:00 /tmp/static-tcp不难看到，多出了几个 无特权 Pod 怎么办Ksniff 还提供了 $ kubectl sniff httpbin-5fc7cf895d-lr89b -p 1.1 ✱
INFO[0000] sniffing method: privileged pod
INFO[0000] using tcpdump path at: '/Users/dustise/.krew/store/sniff/71102253eded8900c8f7b0d0624c65b3c77ecd6bcd28fabc9a200da
ac502282a/static-tcpdump'
INFO[0000] no container specified, taking first container we found in pod.
INFO[0000] selected container: 'httpbin'
...
INFO[0000] creating privileged pod on node: 'vla'
...
INFO[0008] pod: 'ksniff-qpznn' created successfully on node: 'vla'
$ kubectl get pods
flaskapp-v1-5f58cbc685-9v4z9 1/1 Running 0 92m
httpbin-5fc7cf895d-lr89b 1/1 Running 0 93m
ksniff-689sx 1/1 Running 0 66m
sleep-69bd44b5bb-tk6vn 1/1 Running 0 93m可以看到，ksniff 创建了新的 Pod。并且也成功的启动了 Wireshark。再次执行： $ kubectl exec -it sleep-69bd44b5bb-tk6vn -- curl http://httpbin:8000/ip
{
"origin": "10.244.0.19"
}可以看到，Wireshark 中出现了新的数据包。 参考链接https://github.com/kubernetes-sigs/krew
https://github.com/eldadru/ksniff |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
