Network observability

Monitor TCP connect using kprobe hooks

To view TCP connect events, apply the example TCP connect TracingPolicy:

kubectl apply -f

To start monitoring events in the xwing pod run the Tetragon CLI:

kubectl logs -n kube-system -l -c export-stdout -f | tetra getevents -o compact --namespace default --pod xwing

In another terminal, start generate a TCP connection. Here we use curl.

kubectl exec -it xwing -- curl

The output in the first terminal will capture the new connect and write,

๐Ÿš€ process default/xwing /usr/bin/curl
๐Ÿ”Œ connect default/xwing /usr/bin/curl tcp ->
๐Ÿ“ค sendmsg default/xwing /usr/bin/curl tcp -> bytes 73
๐Ÿงน close   default/xwing /usr/bin/curl tcp ->
๐Ÿ’ฅ exit    default/xwing /usr/bin/curl 0

To disable the TracingPolicy run:

kubectl delete -f