本文详细描述了如何通过`crictl`工具查询Docker容器的PID，进而获取其使用的网络接口信息。同时提到在HaProxy配置中遇到的DNS解析问题，即短域名无法被kube-dns解析，给出了示例和报文分析。
步骤
-
查container id，docker的话差不多
[root@master1 ~]# crictl ps |grep haproxy 5bb56c0921182 2e29f1a5b65d9 18 hours ago Running haproxy 0 b173c3f984643 haproxy-deployment-587cf97455-7xx7b -
根据container id 查找pid（docker可以用docker inspect --format {{.State.Pid}} containerID）
[root@master1 ~]# crictl inspect 5bb56c0921182 | python -c 'import sys, json; data = json.load(sys.stdin); print(data["info"]["pid"])' 2469984 -
找到容器使用的网卡
[root@master1 ~]# nsenter -n -t 2469984 ip addr 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 32104: eth0@if32105: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether 16:b2:ba:06:4d:a4 brd ff:ff:ff:ff:ff:ff link-netnsid 0 inet 192.168.1.111/32 scope global eth0 valid_lft forever preferred_lft forever inet6 fe80::14b2:baff:fe06:4da4/64 scope link valid_lft forever preferred_lft forever -
上面的那个
if32105是关键信息，然后在 host 机器上找到这个@if32105对应的网卡:[root@master1 ~]# ip addr 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: ens32: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000 link/ether 00:50:56:b8:be:b9 brd ff:ff:ff:ff:ff:ff inet 10.148.151.130/23 brd 10.148.151.255 scope global noprefixroute ens32 valid_lft forever preferred_lft forever inet6 fe80::db71:3b9e:9958:a419/64 scope link noprefixroute valid_lft forever preferred_lft forever 3: cilium_net@cilium_host: <BROADCAST,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether 66:ce:b7:1a:d7:3f brd ff:ff:ff:ff:ff:ff inet6 fe80::64ce:b7ff:fe1a:d73f/64 scope link valid_lft forever preferred_lft forever ... 83: lxc9dc62fde4d9f@if82: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether ce:1c:5b:15:f0:65 brd ff:ff:ff:ff:ff:ff link-netns cni-5b3219cf-14b2-d39b-c104-8698dd1effb7 inet6 fe80::cc1c:5bff:fe15:f065/64 scope link valid_lft forever preferred_lft forever 32105: lxcd6f187d66d97@if32104: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether 4a:8c:5d:74:dc:34 brd ff:ff:ff:ff:ff:ff link-netns cni-1f7b1b65-5fbb-5945-9b91-e10f623df249 inet6 fe80::488c:5dff:fe74:dc34/64 scope link valid_lft forever preferred_lft forever 18027: lxc7930a002d196@if18026: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether 1e:98:95:d9:89:94 brd ff:ff:ff:ff:ff:ff link-netns cni-1a78e78c-5e35-f51b-fda3-ac09b3ca0e9f inet6 fe80::1c98:95ff:fed9:8994/64 scope link valid_lft forever preferred_lft forever ... -
这个
lxcd6f187d66d97:就是我们要找的@if32105网卡信息，抓包的时候指定对应的网卡lxcd6f187d66d97， 现在可以抓包了:tcpdump -i lxcd6f187d66d97 -A -w capture.pcap -
命令
用命令表示以上过程：
[root@master2 ~]# nsenter -n -t $(crictl inspect $(crictl ps | grep haproxy | sed -n "2p"| awk '{print $1}') | python -c 'import sys, json; data = json.load(sys.stdin); print(data["info"]["pid"])'
) ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
42: eth0@if43: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
link/ether 56:54:49:a0:1b:0b brd ff:ff:ff:ff:ff:ff link-netnsid 0
inet 192.168.2.84/32 scope global eth0
valid_lft forever preferred_lft forever
inet6 fe80::5454:49ff:fea0:1b0b/64 scope link
valid_lft forever preferred_lft forever
# 找到对应的网卡lxc006abd15e53b
[root@master2 ~]# ip addr | sed -n '/^43: /,/^[0-9]*: /p'
43: lxc006abd15e53b@if42: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
link/ether 5a:4b:a8:9b:ff:57 brd ff:ff:ff:ff:ff:ff link-netns cni-a79cf5f9-801f-2d7f-bb14-6be41c134817
inet6 fe80::584b:a8ff:fe9b:ff57/64 scope link
valid_lft forever preferred_lft forever
47: lxc1186459d5c30@if46: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
遗留问题
-
HaProxy配置DNS解析时，如果server配置的域名是短域名，则kube-dns无法解析？
# 如果配置成dbsrv1.platform，则无法解析 listen opengauss bind *:6000 option httpchk http-check expect status 200 default-server inter 3s fall 3 rise 2 on-marked-down shutdown-sessions server dbsrv1 dbsrv1.platform.svc.cluster.local:5432 maxconn 100 check port 8008 resolvers kube-dns server dbsrv2 dbsrv2.platform.svc.cluster.local:5432 maxconn 100 check port 8008 resolvers kube-dns server dbsrv3 dbsrv3.platform.svc.cluster.local:5432 maxconn 100 check port 8008 resolvers kube-dns # 报文如下 13 0.020614 38879 192.168.2.42 DNS 86 Standard query 0xe5d5 A dbsrv2.platform OPT 14 0.020641 49559 192.168.2.42 DNS 86 Standard query 0xe5d5 A dbsrv2.platform OPT 15 0.020737 53 192.168.2.243 DNS 161 Standard query response 0xe5d5 No such name A dbsrv2.platform SOA a.root-servers.net OPT 16 0.020783 53 192.168.2.243 DNS 161 Standard query response 0xe5d5 No such name A dbsrv2.platform SOA a.root-servers.net OPT
934
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
