You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+111-7
Original file line number
Diff line number
Diff line change
@@ -29,7 +29,7 @@ This will download and compile `kubectl-trace` so that you can use it as a kubec
29
29
You don't need to setup anything on your cluster before using it, please don't use it already
30
30
on a production system, just because this isn't yet 100% ready.
31
31
32
-
**Run a program from string literal:**
32
+
### Run a program from string literal
33
33
34
34
In this case we are running a program that probes a tracepoint
35
35
on the node `ip-180-12-0-152.ec2.internal`.
@@ -39,15 +39,15 @@ kubectl trace run ip-180-12-0-152.ec2.internal -e "tracepoint:syscalls:sys_enter
39
39
```
40
40
41
41
42
-
**Run a program from file:**
42
+
### Run a program from file
43
43
44
44
Here we run a program named `read.bt` against the node `ip-180-12-0-152.ec2.internal`
45
45
46
46
```
47
47
kubectl trace run ip-180-12-0-152.ec2.internal -f read.bt
48
48
```
49
49
50
-
**Run a program against a Pod**
50
+
### Run a program against a Pod
51
51
52
52
53
53
@@ -83,6 +83,114 @@ So, running against a pod **doesn't mean** that your bpftrace program will be co
83
83
knowledge of the context of a container, in this case only the root process id is supported via the `$container_pid` variable.
84
84
85
85
86
+
### Using a custom service account
87
+
88
+
By default `kubectl trace` will use the `default` service account in the target namespace (that is also `default`), to schedule the pods needed for your bpftrace program.
89
+
90
+
If you need to pass a service account you can use the `--serviceaccount` flag.
91
+
92
+
```bash
93
+
kubectl trace run --serviceaccount=kubectltrace ip-180-12-0-152.ec2.internal -f read.bt
94
+
```
95
+
96
+
### Executing in a cluster using Pod Security Policies
97
+
98
+
If your cluster has pod security policies you will need to make so that `kubectl trace` can
99
+
use a service account that can run privileged containers.
100
+
101
+
That service account, then will need to be in a group that uses the proper privileged `PodSecurityPolicy`.
102
+
103
+
First, create the service account that you will use with `kubectl trace`,
104
+
you can use a different namespace other than `default`, just remember to pass that namespace to the `run` command when you will use `kubectl trace`:
105
+
106
+
```yaml
107
+
apiVersion: v1
108
+
kind: ServiceAccount
109
+
metadata:
110
+
name: kubectltrace
111
+
namespace: default
112
+
```
113
+
114
+
Now that we have a `kubectltrace` service account let's create a Pod Security Policy:
115
+
116
+
```yaml
117
+
apiVersion: policy/v1beta1
118
+
kind: PodSecurityPolicy
119
+
metadata:
120
+
name: kubectltrace
121
+
spec:
122
+
fsGroup:
123
+
rule: RunAsAny
124
+
privileged: true
125
+
runAsUser:
126
+
rule: RunAsAny
127
+
seLinux:
128
+
rule: RunAsAny
129
+
supplementalGroups:
130
+
rule: RunAsAny
131
+
volumes:
132
+
- '*'
133
+
allowedCapabilities:
134
+
- '*'
135
+
hostPID: true
136
+
hostIPC: true
137
+
hostNetwork: true
138
+
hostPorts:
139
+
- min: 1
140
+
max: 65536
141
+
```
142
+
143
+
Ok, this `PodSecurityPolicy` will allow users assigned to it to run privileged containers,
144
+
`kubectl trace`needs that because of the extended privileges eBPF programs need to run with
145
+
to trace your kernel and programs running in it.
146
+
147
+
Now with a `ClusterRoleBinding` you bind the `ClusterRole` with the `ServiceAccount`, so that
148
+
they can work together with the `PodSecurityPolicy` we just created.
149
+
150
+
You can change the `namespace: default` here if you created the service account in a namespace other than `default`.
151
+
152
+
```yaml
153
+
apiVersion: rbac.authorization.k8s.io/v1
154
+
kind: ClusterRole
155
+
metadata:
156
+
name: kubectltrace-psp
157
+
rules:
158
+
- apiGroups:
159
+
- policy
160
+
resources:
161
+
- podsecuritypolicies
162
+
resourceNames:
163
+
- kubectltrace
164
+
verbs:
165
+
- use
166
+
---
167
+
apiVersion: rbac.authorization.k8s.io/v1
168
+
kind: ClusterRoleBinding
169
+
metadata:
170
+
name: kubectltrace-psp
171
+
subjects:
172
+
- kind: ServiceAccount
173
+
name: kubectltrace
174
+
namespace: default
175
+
roleRef:
176
+
apiGroup: rbac.authorization.k8s.io
177
+
kind: ClusterRole
178
+
name: kubectltrace-psp
179
+
```
180
+
181
+
OK! Now that we are all set we can just run the program by specifying the service account
182
+
we just created and it will use our pod security policy!
183
+
184
+
```bash
185
+
kubectl trace run --serviceaccount=kubectltrace ip-180-12-0-152.ec2.internal -f read.bt
186
+
```
187
+
188
+
If you used a different namespace other than default for your service account, you will want to specify the namespace too, like this:
189
+
190
+
```bash
191
+
kubectl trace run --namespace=mynamespace --serviceaccount=kubectltrace ip-180-12-0-152.ec2.internal -f read.bt
192
+
```
193
+
86
194
### More bpftrace programs
87
195
88
196
Need more programs? Look [here](https://github.com/iovisor/bpftrace/tree/master/tools).
@@ -119,10 +227,6 @@ kubectl trace run pod/<pod-name> -c <container> f read.bt
119
227
120
228
So I would say, the next thing is to run bpftrace programs at a pod scope other than at node scope.</strike>
121
229
122
-
**bpftrace work**
123
-
124
-
I also plan to contribute some IO functions to bpftrace to send data to a backend database like InfluxDB instead of only stdout
125
-
because that would enable having things like graphs showing
0 commit comments