Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support antctl command for packetcapture #6884

Open
wants to merge 6 commits into
base: main
Choose a base branch
from
Open

Support antctl command for packetcapture #6884

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
12bc0c3
Support antctl command for packetcapture
hangyan Feb 6, 2025
43a9451
reuse decompress func
hangyan Feb 7, 2025
18cc669
Apply suggestions from code review
hangyan Feb 11, 2025
e44de62
update
hangyan Feb 12, 2025
d47637b
update
hangyan Feb 13, 2025
1459f0f
update doc
hangyan Feb 17, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 42 additions & 0 deletions docs/antctl.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,7 @@ running in three different modes:
- [Dumping OVS flows](#dumping-ovs-flows)
- [OVS packet tracing](#ovs-packet-tracing)
- [Traceflow](#traceflow)
- [PacketCapture](#packetcapture)
- [Antctl Proxy](#antctl-proxy)
- [Flow Aggregator commands](#flow-aggregator-commands)
- [Dumping flow records](#dumping-flow-records)
Expand Down Expand Up @@ -571,6 +572,47 @@ $ antctl traceflow -S pod1 -D svc1 -f tcp --live-traffic -t 1m
$ antctl traceflow -D pod1 -f tcp,tcp_dst=80 --live-traffic --dropped-only -t 10m
```

### PacketCapture

`antctl packetcapture` (or `antctl pc`) command is used to start a `PacketCapture`
and retrieve the captured result. After the result packet file is copied out,
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

After the result packet file (in pcapng format)

the PacketCapture will be deleted. Users can also create a PacketCapture with `kubectl`,
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

maybe add this sentence here:

The command will display the local path to the pcapng file as it exits.

but `antctl` provide a simpler way. For more information about PacketCapture,
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

s/provide a simpler way/makes it easier

refer to [PacketCapture guide](packetcapture-guide.md).

To start a PacketCapture, users must provide the following arguments:

* `--source` (or `-S`)
* `--destination` (or `-D`)
* `--number` (or `-n`)

Note: one of `--source` and `--destination` must be a pod.

The `--flow` (or `-f`) argument can be used to specify the PacketCapture packet
headers with the [ovs-ofctl](http://www.openvswitch.org//support/dist-docs/ovs-ofctl.8.txt)
flow syntax(This argument works similar as Traceflow). The supported flow fields
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
flow syntax(This argument works similar as Traceflow). The supported flow fields
flow syntax. This argument works the same way as the one for `antctl traceflow`. The supported flow fields

include: IP protocol (`icmp`, `tcp`, `udp`), source and destination ports
(`tcp_src`, `tcp_dst`, `udp_src`, `udp_dst`).

By default, the command will wait for the PacketCapture to succeed or fail, or
timeout. The default timeout is 10 seconds, but can be changed with the
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

or to timeout

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

wrong default timeout value, it is 60s

`--timeout` (or `-t`) argument. Add the `--no-wait` flag to start a PacketCapture
without waiting for its results. In this case, the command will not delete the
PacketCapture resource.

More examples of `antctl packetcapture`:

```bash
Start capturing packets from pod1 to pod2, both Pods are in Namespace default
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

if you use the bash syntax highlighting, add the comment sign # before each description sentence

$ antctl packetcaputre -S pod1 -D pod2
Start capturing packets from pod1 in Namespace ns1 to a destination IP
$ antctl packetcapture -S ns1/pod1 -D 192.168.123.123
Start capturing UDP packets from pod1 to pod2, with destination port 1234
$ antctl packetcapture -S pod1 -D pod2 -f udp,udp_dst=1234
Save the packets file to a specified directory
$ antctl packetcapture -S 192.168.123.123 -D pod2 -f tcp,tcp_dst=80 -o /tmp
```

### Antctl Proxy

antctl can run as a reverse proxy for the Antrea API (Controller or arbitrary
Expand Down
6 changes: 6 additions & 0 deletions pkg/antctl/antctl.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ import (
checkinstallation "antrea.io/antrea/pkg/antctl/raw/check/installation"
"antrea.io/antrea/pkg/antctl/raw/featuregates"
"antrea.io/antrea/pkg/antctl/raw/multicluster"
"antrea.io/antrea/pkg/antctl/raw/packetcapture"
"antrea.io/antrea/pkg/antctl/raw/proxy"
"antrea.io/antrea/pkg/antctl/raw/set"
"antrea.io/antrea/pkg/antctl/raw/supportbundle"
Expand Down Expand Up @@ -750,6 +751,11 @@ $ antctl get podmulticaststats pod -n namespace`,
supportAgent: true,
supportController: true,
},
{
cobraCommand: packetcapture.Command,
supportAgent: false,
supportController: true,
},
{
cobraCommand: proxy.Command,
supportAgent: false,
Expand Down
2 changes: 1 addition & 1 deletion pkg/antctl/command_list_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,7 +65,7 @@ func TestGetDebugCommands(t *testing.T) {
{
name: "Antctl running against controller mode",
mode: "controller",
expected: [][]string{{"version"}, {"get", "networkpolicy"}, {"get", "appliedtogroup"}, {"get", "addressgroup"}, {"get", "controllerinfo"}, {"supportbundle"}, {"traceflow"}, {"get", "featuregates"}},
expected: [][]string{{"version"}, {"get", "networkpolicy"}, {"get", "appliedtogroup"}, {"get", "addressgroup"}, {"get", "controllerinfo"}, {"supportbundle"}, {"traceflow"}, {"packetcapture"}, {"get", "featuregates"}},
},
{
name: "Antctl running against agent mode",
Expand Down
28 changes: 28 additions & 0 deletions pkg/antctl/raw/helper.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,8 +18,11 @@ import (
"context"
"fmt"
"net"
"path/filepath"
"strconv"
"strings"

"github.com/spf13/afero"
"github.com/spf13/cobra"
"golang.org/x/mod/semver"
corev1 "k8s.io/api/core/v1"
Expand All @@ -28,11 +31,13 @@ import (
"k8s.io/client-go/kubernetes/scheme"
"k8s.io/client-go/rest"

"antrea.io/antrea/pkg/antctl/raw/check"
"antrea.io/antrea/pkg/antctl/runtime"
"antrea.io/antrea/pkg/apis"
"antrea.io/antrea/pkg/apis/crd/v1beta1"
antrea "antrea.io/antrea/pkg/client/clientset/versioned"
antreascheme "antrea.io/antrea/pkg/client/clientset/versioned/scheme"
"antrea.io/antrea/pkg/util/compress"
"antrea.io/antrea/pkg/util/ip"
"antrea.io/antrea/pkg/util/k8s"
)
Expand Down Expand Up @@ -220,3 +225,26 @@ func CreateControllerClientCfg(
cfg.Host = fmt.Sprintf("https://%s", net.JoinHostPort(nodeIP, fmt.Sprint(controllerInfo.APIPort)))
return cfg, nil
}

type PodFileCopy interface {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: s/PodFileCopy/PodFileCopier

CopyFromPod(ctx context.Context, fs afero.Fs, namespace, name, containerName, srcPath, dstDir string) error
}

type PodFile struct {
RestConfig *rest.Config
Client kubernetes.Interface
}
Comment on lines +233 to +236
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

make the struct podFileCopier and add a NewPodFileCopier function. Things will be clearer with more accurate names.


func (p *PodFile) CopyFromPod(ctx context.Context, fs afero.Fs, namespace, name, containerName, srcPath, dstDir string) error {
dir, fileName := filepath.Split(srcPath)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

technically you should be using path.Split here and not filepath.Split, as the path is for a (potentially) different operating system

cmd := fmt.Sprintf("cd %s; tar cf - %s", dir, fileName)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

instead of cd, could we use the -C option for tar?

For example:

cmd := ["tar"]
if dir != "" {
        cmd = append(cmd, "-C", dir) 
}
cmd = append(cmd, "cf", "-", fileName)

This way, you should be able to skip the shell wrapping and exec the tar program directly. It's always better to do it this way and avoid the shell dependency in the container.

if dir == "" {
cmd = fmt.Sprintf("tar cf - %s", fileName)
}
cmdArr := []string{"/bin/sh", "-c", cmd}
output, _, err := check.ExecInPod(ctx, p.Client, p.RestConfig, namespace, name, containerName, cmdArr)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

please move the ExecInPod function definition to this file, it will make more sense

if err != nil {
return err
}
return compress.UnpackReader(fs, strings.NewReader(output), false, dstDir)
}
Loading
Loading