Skip to content

Latest commit

 

History

History
58 lines (24 loc) · 1.85 KB

dynamic-packet-capture.md

File metadata and controls

58 lines (24 loc) · 1.85 KB
Raw

Dynamic packet capture

Goal: Configure packet capture for specific pods and review captured payload.

Calico enterprise/cloud provide enhanced packet capture feature for DevOps troubleshooting. Packet captures are Kubernetes Custom Resources and thus native Kubernetes RBAC can be used to control which users/groups can run and access Packet Captures; this may be useful if Compliance or Governance policies mandate strict controls on running Packet Captures for specific workloads. This demo is simplified without RBAC but further details can be found here.

Steps

step 1. Capture all packet for nginx pods.

  1. Initial packet capture job from manager UI.

packet capture

  1. Schedule the packet capture job with specific port.

test packet capture

  1. You will see the job scheduled in service graph.

schedule packet capture

  1. Download the pcap file once the job is Capturing or Finished.

download packet capture

[Bonus] Calicocloud provide different RBAC role for packet capture resource.

Calicocloud provide pre-defined role in manage team - user which viwer doesn't have permissions to get/list Packet Capture resource.

  1. Add one of your team members in this calicocloud management plane.

create new user

  1. Confirm they accept your invite.

manage team user

  1. Use their email address to login calicocloud UI and confirm they cannot fetch or create any packet capture jobs.

fail to fetch

➡️ Global ThreatFeeds

↩️ Back to README.md