@@ -10,6 +10,7 @@ capture_duration="120"
10
10
now=$( date +%s)
11
11
capture_pod=" "
12
12
sysdig_params=" "
13
+ ebpf=" 0"
13
14
14
15
function main() {
15
16
parse_arguments " $@ "
@@ -31,6 +32,9 @@ function parse_arguments() {
31
32
capture_duration=$2
32
33
shift
33
34
;;
35
+ --ebpf)
36
+ ebpf=" 1"
37
+ ;;
34
38
-w|--write=* |-z|--compress|-pc|-pk|-pm|-print=* |-S|--summary)
35
39
# Do not allow changes on these parameters
36
40
echo $0 : $1 : skipping parameter for Sysdig>&2
@@ -59,6 +63,7 @@ function usage_and_die() {
59
63
Usage: kubectl capture POD [-ns NAMESPACE] [sysdig options]
60
64
Options:
61
65
-ns | --namespace The namespace where the target pod lives (default: default)
66
+ --ebpf Launch capture pod with eBPF probe instead of kernel module
62
67
EOF
63
68
exit $1
64
69
}
@@ -70,6 +75,32 @@ function start_capture() {
70
75
exit 1
71
76
fi
72
77
78
+ if [[ " ${ebpf} " -eq " 1" ]]; then
79
+ build_capture_pod_for_ebpf
80
+ else
81
+ build_capture_pod
82
+ fi
83
+
84
+ kubectl apply -f capture-pod.yaml > /dev/null 2>&1
85
+ rm capture-pod.yaml
86
+
87
+ echo " Sysdig is starting to capture system calls:"
88
+ echo " "
89
+ echo " Node: ${node} "
90
+ echo " Pod: ${pod} "
91
+ echo " Duration: ${capture_duration} seconds"
92
+ echo " Parameters for Sysdig: ${sysdig_params} "
93
+ echo " "
94
+
95
+ wait_until_finished
96
+
97
+ kubectl cp ${capture_pod} :/${capture_pod} .scap.gz ${capture_pod} .scap.gz > /dev/null 2>&1
98
+ kubectl delete pod ${capture_pod} > /dev/null 2>&1
99
+ echo " The capture has been downloaded to your hard disk at:"
100
+ echo " ${PWD} /${capture_pod} .scap.gz"
101
+ }
102
+
103
+ function build_capture_pod() {
73
104
cat << EOF > capture-pod.yaml
74
105
apiVersion: v1
75
106
kind: Pod
@@ -136,24 +167,85 @@ spec:
136
167
path: /usr
137
168
nodeName: ${node}
138
169
EOF
170
+ }
139
171
140
- kubectl apply -f capture-pod.yaml > /dev/null 2>&1
141
- rm capture-pod.yaml
142
-
143
- echo " Sysdig is starting to capture system calls:"
144
- echo " "
145
- echo " Node: ${node} "
146
- echo " Pod: ${pod} "
147
- echo " Duration: ${capture_duration} seconds"
148
- echo " Parameters for Sysdig: ${sysdig_params} "
149
- echo " "
150
-
151
- wait_until_finished
152
-
153
- kubectl cp ${capture_pod} :/${capture_pod} .scap.gz ${capture_pod} .scap.gz > /dev/null 2>&1
154
- kubectl delete pod ${capture_pod} > /dev/null 2>&1
155
- echo " The capture has been downloaded to your hard disk at:"
156
- echo " ${PWD} /${capture_pod} .scap.gz"
172
+ function build_capture_pod_for_ebpf() {
173
+ cat << EOF > capture-pod.yaml
174
+ apiVersion: v1
175
+ kind: Pod
176
+ metadata:
177
+ name: "${capture_pod} "
178
+ spec:
179
+ hostNetwork: true
180
+ containers:
181
+ - name: capturer
182
+ image: sysdig/sysdig
183
+ args:
184
+ - /bin/bash
185
+ - "-c"
186
+ - "echo '* Capturing system calls'; sysdig ${sysdig_params} ; touch /.finished; trap 'exit 0' TERM; sleep infinity & wait \$ !"
187
+ imagePullPolicy: IfNotPresent
188
+ securityContext:
189
+ privileged: true
190
+ env:
191
+ - name: SYSDIG_BPF_PROBE
192
+ value:
193
+ resources:
194
+ requests:
195
+ cpu: 100m
196
+ memory: 64Mi
197
+ limits:
198
+ cpu: 100m
199
+ memory: 128Mi
200
+ volumeMounts:
201
+ - mountPath: /host/var/run/docker.sock
202
+ name: docker-socket
203
+ - mountPath: /host/dev
204
+ name: dev-fs
205
+ - mountPath: /host/proc
206
+ name: proc-fs
207
+ readOnly: true
208
+ - mountPath: /host/boot
209
+ name: boot-fs
210
+ readOnly: true
211
+ - mountPath: /host/lib/modules
212
+ name: lib-modules
213
+ readOnly: true
214
+ - mountPath: /host/usr
215
+ name: usr-fs
216
+ readOnly: true
217
+ - mountPath: /dev/shm
218
+ name: dshm
219
+ - mountPath: /host/etc
220
+ name: etc-fs
221
+ readOnly: true
222
+ volumes:
223
+ - name: dshm
224
+ emptyDir:
225
+ medium: Memory
226
+ - name: docker-socket
227
+ hostPath:
228
+ path: /var/run/docker.sock
229
+ - name: dev-fs
230
+ hostPath:
231
+ path: /dev
232
+ - name: proc-fs
233
+ hostPath:
234
+ path: /proc
235
+ - name: boot-fs
236
+ hostPath:
237
+ path: /boot
238
+ - name: lib-modules
239
+ hostPath:
240
+ path: /lib/modules
241
+ - name: usr-fs
242
+ hostPath:
243
+ path: /usr
244
+ - name: etc-fs
245
+ hostPath:
246
+ path: /etc
247
+ nodeName: ${node}
248
+ EOF
157
249
}
158
250
159
251
function wait_until_finished() {
0 commit comments