Using trace bind
The trace bind gadget is used to stream socket binding syscalls.
How to use it?
First, we need to create one pod for us to play with:
$ kubectl run test-pod --image busybox:latest sleep inf
You can now use the gadget, but output will be empty:
$ kubectl gadget trace bind
NODE NAMESPACE POD CONTAINER PID COMM PROTO ADDR PORT OPTS IF
Indeed, it is waiting for socket binding to occur.
So, in another terminal, exec
the container and use nc
:
$ kubectl exec -ti test-pod -- nc -l -p 4242 -w 1
nc: timeout
command terminated with exit code 1
Go back to the first terminal and see:
NODE NAMESPACE POD CONTAINER PID COMM PROTO ADDR PORT OPTS IF
minikube default test-pod test-pod 58208 nc IP :: 4242 .R... 0
This line corresponds to the socket binding operation initiated by nc
.
Restricting output to certain PID, ports or succeeded and failed port bindings
With the following options, you can restrict the output:
--pid
only prints events where socket binding is done by the given PID.-P/--ports
only prints events where these ports are used for socket bindings.-i/--ignore-errors
only prints events where the bind succeeded.
So, this command will print all (i.e. succeeded and failed) attempts to bind a socket on port 4242 or 4343 by PID 42:
$ kubectl gadget trace bind -i=false --pid 42 -P=4242,4343
Only print some information
You can customize the information printed using -o custom-columns=column0,...,columnN
.
This command will only show the PID and command of the process which sent a signal:
$ kubectl gadget trace bind -o custom-columns=pid,comm
PID COMM
61198 nc
The following command is the same as default printing:
$ kubectl gadget trace bind -o custom-columns=node,namespace,container,pod,pid,proto,addr,port,opts,if
NODE NAMESPACE CONTAINER POD PID PROTO ADDR PORT OPTS IF
minikube default test-pod test-pod 61985 IP :: 4242 .R... 0
Use JSON output
This gadget supports JSON output, for this simply use -o json
:
$ kubectl gadget trace bind -o json
{"type":"normal","node":"minikube","namespace":"default","pod":"test-pod","container":"test-pod","pid":62232,"comm":"nc","proto":"IP","addr":"::","port":4343,"opts":".R...","if":"0","mountnsid":4026532579}
# You can use jq to make the output easier to read:
$ kubectl gadget trace bind -o json | jq
{
"type": "normal",
"node": "minikube",
"namespace": "default",
"pod": "test-pod",
"container": "test-pod",
"pid": 62232,
"comm": "nc",
"proto": "IP",
"addr": "::",
"port": 4343,
"opts": ".R...",
"if": "0",
"mountnsid": 4026532579
}
Clean everything
Congratulations! You reached the end of this guide! You can now delete the pod you created:
$ kubectl delete pod test-pod
pod "test-pod" deleted