k8s抓取pod內封包

使用krew指令可以很方便的安裝Ksniff

kubectl krew install sniff

運行一個測試用的nginx

deployment

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
spec:
  selector:
    matchLabels:
      app: nginx
  replicas: 2 # tells deployment to run 2 pods matching the template
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.14.2
        ports:
        - containerPort: 80

service

apiVersion: v1
kind: Service
metadata:
  annotations:
  labels:
    app: nginx
  name: nginx
  namespace: default
spec:
  clusterIP: 
  externalTrafficPolicy: Local
  ports:
  - name: web
    nodePort: 30589
    port: 80
    protocol: TCP
    targetPort: 80
  - name: ssl
    nodePort: 30655
    port: 443
    protocol: TCP
    targetPort: 443
  selector:
    app: nginx
  sessionAffinity: None
  type: LoadBalancer

然後就可以啟動ksniff插件對nginx的pod進行抓取

kubectl sniff nginx-deployment-54f57cf6bf-f824d

如果遇到以下錯誤

執行以下指令

sudo ln -s /Applications/Wireshark.app/Contents/MacOS/tshark /usr/local/bin/tshark
tshark -v

執行以下指令測試

kubectl sniff nginx-deployment-54f57cf6bf-f824d -f "port 80" -o - | tshark -r -

或是直接輸出檔案

kubectl sniff nginx-deployment-54f57cf6bf-f824d -o test

用軟體直接開test檔案