Skip to content

Commit 1bebf84

Browse files
author
Néstor Salceda
authored
Add support to eBPF instead of Kernel Module for capturing system calls (#3)
This will make the capture plugin with COS refs #2
1 parent 004d527 commit 1bebf84

File tree

3 files changed

+128
-22
lines changed

3 files changed

+128
-22
lines changed

README.md

+4-3
Original file line numberDiff line numberDiff line change
@@ -55,9 +55,10 @@ to capture.
5555

5656
There are a few parameters for this plugin:
5757

58-
| Flag | Description |
59-
|------------------------|---------------------------------------|
60-
| `-ns` or `--namespace` | The namespace scope of the target Pod |
58+
| Flag | Description |
59+
|------------------------|----------------------------------------------------------------|
60+
| `-ns` or `--namespace` | The namespace scope of the target Pod |
61+
| `--ebpf` | Use eBPF probe instead of kernel module for capturing syscalls |
6162

6263

6364
Aditionally, all the flags for the `sysdig` cli tool are supported. You can

kubectl-capture

+109-17
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ capture_duration="120"
1010
now=$(date +%s)
1111
capture_pod=""
1212
sysdig_params=""
13+
ebpf="0"
1314

1415
function main() {
1516
parse_arguments "$@"
@@ -31,6 +32,9 @@ function parse_arguments() {
3132
capture_duration=$2
3233
shift
3334
;;
35+
--ebpf)
36+
ebpf="1"
37+
;;
3438
-w|--write=*|-z|--compress|-pc|-pk|-pm|-print=*|-S|--summary)
3539
# Do not allow changes on these parameters
3640
echo $0: $1: skipping parameter for Sysdig>&2
@@ -59,6 +63,7 @@ function usage_and_die() {
5963
Usage: kubectl capture POD [-ns NAMESPACE] [sysdig options]
6064
Options:
6165
-ns | --namespace The namespace where the target pod lives (default: default)
66+
--ebpf Launch capture pod with eBPF probe instead of kernel module
6267
EOF
6368
exit $1
6469
}
@@ -70,6 +75,32 @@ function start_capture() {
7075
exit 1
7176
fi
7277

78+
if [[ "${ebpf}" -eq "1" ]];then
79+
build_capture_pod_for_ebpf
80+
else
81+
build_capture_pod
82+
fi
83+
84+
kubectl apply -f capture-pod.yaml > /dev/null 2>&1
85+
rm capture-pod.yaml
86+
87+
echo "Sysdig is starting to capture system calls:"
88+
echo ""
89+
echo "Node: ${node}"
90+
echo "Pod: ${pod}"
91+
echo "Duration: ${capture_duration} seconds"
92+
echo "Parameters for Sysdig: ${sysdig_params}"
93+
echo ""
94+
95+
wait_until_finished
96+
97+
kubectl cp ${capture_pod}:/${capture_pod}.scap.gz ${capture_pod}.scap.gz > /dev/null 2>&1
98+
kubectl delete pod ${capture_pod} > /dev/null 2>&1
99+
echo "The capture has been downloaded to your hard disk at:"
100+
echo "${PWD}/${capture_pod}.scap.gz"
101+
}
102+
103+
function build_capture_pod() {
73104
cat << EOF > capture-pod.yaml
74105
apiVersion: v1
75106
kind: Pod
@@ -136,24 +167,85 @@ spec:
136167
path: /usr
137168
nodeName: ${node}
138169
EOF
170+
}
139171

140-
kubectl apply -f capture-pod.yaml > /dev/null 2>&1
141-
rm capture-pod.yaml
142-
143-
echo "Sysdig is starting to capture system calls:"
144-
echo ""
145-
echo "Node: ${node}"
146-
echo "Pod: ${pod}"
147-
echo "Duration: ${capture_duration} seconds"
148-
echo "Parameters for Sysdig: ${sysdig_params}"
149-
echo ""
150-
151-
wait_until_finished
152-
153-
kubectl cp ${capture_pod}:/${capture_pod}.scap.gz ${capture_pod}.scap.gz > /dev/null 2>&1
154-
kubectl delete pod ${capture_pod} > /dev/null 2>&1
155-
echo "The capture has been downloaded to your hard disk at:"
156-
echo "${PWD}/${capture_pod}.scap.gz"
172+
function build_capture_pod_for_ebpf() {
173+
cat << EOF > capture-pod.yaml
174+
apiVersion: v1
175+
kind: Pod
176+
metadata:
177+
name: "${capture_pod}"
178+
spec:
179+
hostNetwork: true
180+
containers:
181+
- name: capturer
182+
image: sysdig/sysdig
183+
args:
184+
- /bin/bash
185+
- "-c"
186+
- "echo '* Capturing system calls'; sysdig ${sysdig_params}; touch /.finished; trap 'exit 0' TERM; sleep infinity & wait \$!"
187+
imagePullPolicy: IfNotPresent
188+
securityContext:
189+
privileged: true
190+
env:
191+
- name: SYSDIG_BPF_PROBE
192+
value:
193+
resources:
194+
requests:
195+
cpu: 100m
196+
memory: 64Mi
197+
limits:
198+
cpu: 100m
199+
memory: 128Mi
200+
volumeMounts:
201+
- mountPath: /host/var/run/docker.sock
202+
name: docker-socket
203+
- mountPath: /host/dev
204+
name: dev-fs
205+
- mountPath: /host/proc
206+
name: proc-fs
207+
readOnly: true
208+
- mountPath: /host/boot
209+
name: boot-fs
210+
readOnly: true
211+
- mountPath: /host/lib/modules
212+
name: lib-modules
213+
readOnly: true
214+
- mountPath: /host/usr
215+
name: usr-fs
216+
readOnly: true
217+
- mountPath: /dev/shm
218+
name: dshm
219+
- mountPath: /host/etc
220+
name: etc-fs
221+
readOnly: true
222+
volumes:
223+
- name: dshm
224+
emptyDir:
225+
medium: Memory
226+
- name: docker-socket
227+
hostPath:
228+
path: /var/run/docker.sock
229+
- name: dev-fs
230+
hostPath:
231+
path: /dev
232+
- name: proc-fs
233+
hostPath:
234+
path: /proc
235+
- name: boot-fs
236+
hostPath:
237+
path: /boot
238+
- name: lib-modules
239+
hostPath:
240+
path: /lib/modules
241+
- name: usr-fs
242+
hostPath:
243+
path: /usr
244+
- name: etc-fs
245+
hostPath:
246+
path: /etc
247+
nodeName: ${node}
248+
EOF
157249
}
158250

159251
function wait_until_finished() {

test/kubectl-capture.bats

+15-2
Original file line numberDiff line numberDiff line change
@@ -9,12 +9,25 @@
99
kubectl delete deployment nginx
1010

1111
[ "$status" -eq 0 ]
12+
[ -f ${lines[-1]} ]
13+
}
14+
15+
@test "it does a capture using ebpf" {
16+
kubectl create deployment nginx-ebpf --image=nginx
17+
POD=$(kubectl get pod | grep nginx-ebpf | cut -f1 -d" ")
18+
19+
run ./kubectl-capture $POD --ebpf -M 5
20+
21+
kubectl delete deployment nginx-ebpf
22+
23+
[ "$status" -eq 0 ]
24+
[ -f ${lines[-1]} ]
1225
}
1326

1427
@test "when pod is inside a namespace it does a capture" {
1528
kubectl create namespace scope
16-
kubectl -n scope create deployment nginx --image=nginx
17-
POD=$(kubectl -n scope get pod | grep nginx | cut -f1 -d" ")
29+
kubectl -n scope create deployment nginx-namespace --image=nginx
30+
POD=$(kubectl -n scope get pod | grep nginx-namespace | cut -f1 -d" ")
1831

1932
run ./kubectl-capture $POD -M 5 -ns scope
2033

0 commit comments

Comments
 (0)