[kubernetes]-k8s网络排查利器nsenter

导语：看到有用nsenter在docker运行时的情况下，排查网络问题的脚本。学习了一下顺便增加了一个containerd版本

containerd版本

#!/usr/bin/env bash

function e_net() {
  set -eu
  pod=$(kubectl get pod "${pod_name}" -n "${namespace}" -o jsonpath='{.status.containerStatuses[0].containerID}' | cut -d '/' -f 3)
  # 去掉pid1
  pid=$(crictl inspect "${pod}" | jq -r '.info.pid')
  #pid=$(crictl inspect "${pod}" | grep -oP '"pid": \K\d+' |head -n 1)
  echo -e "\033[32m Entering pod netns for ${namespace}/${pod_name} \033[0m\n"
  cmd="nsenter -n -t ${pid}"
  echo -e "\033[32m Execute the command: ${cmd} \033[0m"
  ${cmd}
}

# 运行函数
pod_name=$1
namespace=${2:-"default"}
e_net

执行脚本

验证是否已经进入容器网络。在nsenter中telnet localhost 2181是可以的。但是有缺陷，无法用service名称通讯 。需要手动修改/etc/resolv.conf

cp  /etc/resolv.conf /tmp/
cat > /etc/resolv.conf <<EOF
search deepwise.svc.cluster.local svc.cluster.local cluster.local
nameserver 100.64.0.10
options ndots:5
EOF

# 抓包命令
tcpdump -nnnvv -As 0 -i eth0 port 80 -w demo2.pcap

docker版本

#!/usr/bin/env bash

function e_net() {
  set -eu
  pod=`kubectl get pod ${pod_name} -n ${namespace} -o template --template='{{range .status.containerStatuses}}{{.containerID}}{{end}}' | sed 's/docker:\/\/\(.*\)$/\1/'`
  pid=`docker inspect -f {{.State.Pid}} $pod`
  echo -e "\033[32m Entering pod netns for ${namespace}/${pod_name} \033[0m\n"
  cmd="nsenter -n -t ${pid}"
  echo -e "\033[32m Execute the command: ${cmd} \033[0m"
  ${cmd}
}

# 运行函数
pod_name=$1
namespace=${2-"default"}
e_net

https://cloud.tencent.com/developer/article/1638871