Skip to content

Commit 47a5711

Browse files
eharris128eharris128
authored
List all k8s debuggable containers (#84)
* Run make fmt Signed-off-by: Evan Harris <echarris@smcm.edu> * Support getting debuggable containers across more than one pod Signed-off-by: Evan Harris <echarris@smcm.edu> --------- Signed-off-by: Evan Harris <echarris@smcm.edu>
1 parent a60daa6 commit 47a5711

File tree

5 files changed

+110
-76
lines changed

5 files changed

+110
-76
lines changed

‎pkg/app/master/command/debug/handle_kubernetes_runtime.go‎

Lines changed: 52 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,23 @@ func HandleKubernetesRuntime(
9696
return
9797
}
9898

99+
if commandParams.ActionListDebuggableContainers {
100+
xc.Out.State("action.list_debuggable_containers",
101+
ovars{"namespace": nsName})
102+
103+
result, err := listK8sDebuggableContainers(ctx, api, nsName, "")
104+
if err != nil {
105+
logger.WithError(err).Error("listK8sDebuggableContainers")
106+
xc.FailOn(err)
107+
}
108+
109+
for cname, iname := range result {
110+
xc.Out.Info("debuggable.container", ovars{"name": cname, "image": iname})
111+
}
112+
113+
return
114+
}
115+
99116
pod, podName, err := ensurePod(ctx, api, nsName, commandParams.TargetPod)
100117
if apierrors.IsNotFound(err) {
101118
logger.WithError(err).
@@ -136,22 +153,6 @@ func HandleKubernetesRuntime(
136153
"ec.count": len(pod.Spec.EphemeralContainers),
137154
}).Debug("target pod info")
138155

139-
if commandParams.ActionListDebuggableContainers {
140-
xc.Out.State("action.list_debuggable_containers",
141-
ovars{"namespace": nsName, "pod": podName})
142-
result, err := listK8sDebuggableContainers(ctx, api, nsName, podName)
143-
if err != nil {
144-
logger.WithError(err).Error("listK8sDebuggableContainers")
145-
xc.FailOn(err)
146-
}
147-
148-
for cname, iname := range result {
149-
xc.Out.Info("debuggable.container", ovars{"name": cname, "image": iname})
150-
}
151-
152-
return
153-
}
154-
155156
//todo: need to check that if targetRef is not empty it is valid
156157

157158
if commandParams.ActionListSessions {
@@ -1033,6 +1034,37 @@ func listK8sDebuggableContainers(
10331034
api *kubernetes.Clientset,
10341035
nsName string,
10351036
podName string) (map[string]string, error) {
1037+
activeContainers := map[string]string{}
1038+
debuggableContainers := map[string]string{}
1039+
1040+
// List all pods in the namespace
1041+
if podName == "" {
1042+
pods, err := api.CoreV1().Pods(nsName).List(ctx, metav1.ListOptions{})
1043+
if err != nil {
1044+
return nil, err
1045+
}
1046+
1047+
for _, pod := range pods.Items {
1048+
if pod.Status.Phase != corev1.PodRunning {
1049+
continue
1050+
}
1051+
1052+
activeNames := getActiveContainerNames(pod.Status.ContainerStatuses)
1053+
for _, name := range activeNames {
1054+
activeContainers[name] = ""
1055+
}
1056+
1057+
for _, c := range pod.Spec.Containers {
1058+
_, found := activeContainers[c.Name]
1059+
if found {
1060+
containerKey := fmt.Sprintf("%s/%s", pod.Name, c.Name)
1061+
debuggableContainers[containerKey] = c.Image
1062+
}
1063+
}
1064+
}
1065+
1066+
return debuggableContainers, nil
1067+
}
10361068

10371069
pod, err := api.CoreV1().Pods(nsName).Get(ctx, podName, metav1.GetOptions{})
10381070
if err != nil {
@@ -1044,19 +1076,18 @@ func listK8sDebuggableContainers(
10441076
}
10451077

10461078
activeNames := getActiveContainerNames(pod.Status.ContainerStatuses)
1047-
activeContainers := map[string]string{}
10481079
for _, name := range activeNames {
1049-
activeContainers[name] = ""
1080+
debuggableContainers[name] = ""
10501081
}
10511082

10521083
for _, c := range pod.Spec.Containers {
1053-
_, found := activeContainers[c.Name]
1084+
_, found := debuggableContainers[c.Name]
10541085
if found {
1055-
activeContainers[c.Name] = c.Image
1086+
debuggableContainers[c.Name] = c.Image
10561087
}
10571088
}
10581089

1059-
return activeContainers, nil
1090+
return debuggableContainers, nil
10601091
}
10611092

10621093
func listDebuggableK8sContainersWithConfig(

‎pkg/system/syscalls_armf32.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ const (
77
SyscallArmMaxNum32 = 462
88
SyscallArmLastName32 = "mseal"
99
)
10+
1011
// https://github.com/torvalds/linux/blob/master/arch/arm64/tools/syscall_32.tbl , https://github.com/torvalds/linux/blob/master/arch/arm/tools/syscall.tbl
1112
var syscallNumTableArmFamily32 = map[uint32]string{
1213
0: "restart_syscall",

‎pkg/system/syscalls_armf64.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ const (
77
SyscallArmMaxNum64 = 462
88
SyscallArmLastName64 = "mseal"
99
)
10+
1011
// https://github.com/torvalds/linux/blob/master/scripts/syscall.tbl
1112
var syscallNumTableArmFamily64 = map[uint32]string{
1213
0: "io_setup",
@@ -290,7 +291,6 @@ var syscallNumTableArmFamily64 = map[uint32]string{
290291
293: "rseq",
291292
294: "kexec_file_load",
292293

293-
294294
424: "pidfd_send_signal",
295295
425: "io_uring_setup",
296296
426: "io_uring_enter",

‎pkg/system/syscalls_x86f32.go‎

Lines changed: 27 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ const (
44
SyscallX86MaxNum32 = 462
55
SyscallX86LastName32 = "mseal"
66
)
7+
78
// https://github.com/torvalds/linux/blob/master/arch/x86/entry/syscalls/syscall_32.tbl
89
// line numbers are aligned with the syscall number (-10)
910
var syscallNumTableX86Family32 = [...]string{
@@ -442,34 +443,34 @@ var syscallNumTableX86Family32 = [...]string{
442443
"fsmount",
443444
"fspick",
444445
"pidfd_open",
445-
"clone3", // 435
446-
"close_range", // 436
447-
"openat2", // 437
448-
"pidfd_getfd", // 438
449-
"faccessat2", // 439
450-
"process_madvise", // 440
451-
"epoll_pwait2", // 441
452-
"mount_setattr", // 442
453-
"quotactl_fd", // 443
446+
"clone3", // 435
447+
"close_range", // 436
448+
"openat2", // 437
449+
"pidfd_getfd", // 438
450+
"faccessat2", // 439
451+
"process_madvise", // 440
452+
"epoll_pwait2", // 441
453+
"mount_setattr", // 442
454+
"quotactl_fd", // 443
454455
"landlock_create_ruleset", // 444
455-
"landlock_add_rule", // 445
456-
"landlock_restrict_self", // 446
457-
"memfd_secret", // 447
458-
"process_mrelease", // 448
459-
"futex_waitv", // 449
456+
"landlock_add_rule", // 445
457+
"landlock_restrict_self", // 446
458+
"memfd_secret", // 447
459+
"process_mrelease", // 448
460+
"futex_waitv", // 449
460461
"set_mempolicy_home_node", // 450
461-
"cachestat", // 451
462-
"fchmodat2", // 452
463-
"map_shadow_stack", // 453
464-
"futex_wake", // 454
465-
"futex_wait", // 455
466-
"futex_requeue", // 456
467-
"statmount", // 457
468-
"listmount", // 458
469-
"lsm_get_self_attr", // 459
470-
"lsm_set_self_attr", // 460
471-
"lsm_list_modules", // 461
472-
"mseal", // 462
462+
"cachestat", // 451
463+
"fchmodat2", // 452
464+
"map_shadow_stack", // 453
465+
"futex_wake", // 454
466+
"futex_wait", // 455
467+
"futex_requeue", // 456
468+
"statmount", // 457
469+
"listmount", // 458
470+
"lsm_get_self_attr", // 459
471+
"lsm_set_self_attr", // 460
472+
"lsm_list_modules", // 461
473+
"mseal", // 462
473474
}
474475

475476
func callNameX86Family32(num uint32) string {

‎pkg/system/syscalls_x86f64.go‎

Lines changed: 29 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ const (
44
SyscallX86MaxNum64 = 462
55
SyscallX86LastName64 = "mseal"
66
)
7+
78
// https://github.com/torvalds/linux/blob/master/arch/x86/entry/syscalls/syscall_64.tbl , https://github.com/torvalds/linux/blob/master/scripts/syscall.tbl
89
// line numbers are aligned with the syscall number (-10)
910
var syscallNumTableX86Family64 = [...]string{
@@ -341,7 +342,7 @@ var syscallNumTableX86Family64 = [...]string{
341342
"pkey_free",
342343
"statx",
343344
"io_pgetevents",
344-
"rseq", // 334
345+
"rseq", // 334
345346
"uretprobe", // 335
346347
"reserved.336",
347348
"reserved.337",
@@ -441,35 +442,35 @@ var syscallNumTableX86Family64 = [...]string{
441442
"fsconfig",
442443
"fsmount",
443444
"fspick",
444-
"pidfd_open", // 434
445-
"clone3", // 435
446-
"close_range", // 436
447-
"openat2", // 437
448-
"pidfd_getfd", // 438
449-
"faccessat2", // 439
450-
"process_madvise", // 440
451-
"epoll_pwait2", // 441
452-
"mount_setattr", // 442
453-
"quotactl_fd", // 443
445+
"pidfd_open", // 434
446+
"clone3", // 435
447+
"close_range", // 436
448+
"openat2", // 437
449+
"pidfd_getfd", // 438
450+
"faccessat2", // 439
451+
"process_madvise", // 440
452+
"epoll_pwait2", // 441
453+
"mount_setattr", // 442
454+
"quotactl_fd", // 443
454455
"landlock_create_ruleset", // 444
455-
"landlock_add_rule", // 445
456-
"landlock_restrict_self", // 446
457-
"memfd_secret", // 447
458-
"process_mrelease", // 448
459-
"futex_waitv", // 449
456+
"landlock_add_rule", // 445
457+
"landlock_restrict_self", // 446
458+
"memfd_secret", // 447
459+
"process_mrelease", // 448
460+
"futex_waitv", // 449
460461
"set_mempolicy_home_node", // 450
461-
"cachestat", // 451
462-
"fchmodat2", // 452
463-
"map_shadow_stack", // 453
464-
"futex_wake", // 454
465-
"futex_wait", // 455
466-
"futex_requeue", // 456
467-
"statmount", // 457
468-
"listmount", // 458
469-
"lsm_get_self_attr", // 459
470-
"lsm_set_self_attr", // 460
471-
"lsm_list_modules", // 461
472-
"mseal", // 462
462+
"cachestat", // 451
463+
"fchmodat2", // 452
464+
"map_shadow_stack", // 453
465+
"futex_wake", // 454
466+
"futex_wait", // 455
467+
"futex_requeue", // 456
468+
"statmount", // 457
469+
"listmount", // 458
470+
"lsm_get_self_attr", // 459
471+
"lsm_set_self_attr", // 460
472+
"lsm_list_modules", // 461
473+
"mseal", // 462
473474
}
474475

475476
func callNameX86Family64(num uint32) string {

0 commit comments

Comments
 (0)