feat: handle kubelet TCP/HTTP probes #72
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Adds support for pods with IPv6 in the activator and redirector.
ctrox
force-pushed
the
probes
branch
4 times, most recently
from
444e3b5 to
0225ca3
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This adds probe handling to the activator and socket tracker. The activator detects HTTP probes based on the user-agent header and TCP probes are detected as kubelet does not send any data, so we get an immediate EOF when trying to peek into the connection buffer. A bit trickier is the detection of those probes in the eBPF socket tracker. We match up connections from the
kubeletprocess to the expected pod IP address and ignore those in the tracker. This requires some adjustments depending on the k8s distribution, for example in k3s the kubelet is embedded in thek3sprocess. The k3s deployment manifests have been adjusted accordingly to pass that via a manager flag.Closes #34