how to see the pod and veth relationship in kubernetes

kubernetes

Solution

is there anyway to see the relationship of kubernetes v1.15.2 pod and veth?

TL;DR : Yes. There is a bunch of similar topics on StackOverflow and even some scripts on Github.

Explanation:

There is a very good article on Kubernetes (K8s) networking.

Oversimplified, "K8s networking" handled by Linux’s network namespaces and virtual interfaces.

Below console output has been taken on my GKE cluster, but shall be applicable to standalone cluster as well.

$ sudo ip link show | egrep "veth|docker" | awk -F":" '{print $1": "$2}'
3:  docker0
5:  vethcf35c1bb@if3
6:  veth287168da@if3
7:  veth5c70f15b@if3
11:  veth62f193f7@if3
12:  vetha38273b3@if3
14:  veth240a8f81@if3

sudo docker ps --format '{{.ID}} {{.Names}} {{.Image}}' "$@"  | wc -l
25

As you can see, I have 6 `veth`'s serving traffic for 25 docker containers. Let's find the `veth` that serves traffic for one of the pods.

$ kubectl get pods 
NAME                         READY   STATUS    RESTARTS   AGE
server-go-7b57857cfb-p6m62   1/1     Running   0          7m41s

- Lets find the docker container id for the pod.

$ sudo docker ps --format '{{.ID}} {{.Pid}} {{.Names}} {{.Image}}' "$@" | grep POD_server
6aa1d952a9f3 k8s_POD_server-go-7b57857cfb-p6m62_default_02206a28-42e1-43a5-adb8-f6ab13258fb1_0 k8s.gcr.io/pause:3.1

- Checking a `pid` for it:

$ sudo docker inspect --format '{{.State.Pid}}' 6aa1d952a9f3
4012085

- Allowing system tools accessing the namespace of that `pid`:

$ sudo ln -sf /proc/${pid}/ns/net /var/run/netns/ns-${pid}

#in my case the commands were :
$ if [ ! -d /var/run/netns ]; then sudo  mkdir -p /var/run/netns; fi
$ sudo ln -sf /proc/4012085/ns/net /var/run/netns/ns-4012085

$ sudo ip netns exec "ns-4012085" ip link show type veth | grep "eth0"
3: eth0@if14: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1460 qdisc noqueue state UP mode DEFAULT group default 

- Checking exact interface that serves traffic for the container.

From that output (`eth0@if14`) we can say that the `eth0` for the `6aa1d952a9f3` docker container is linked to the interface `14: veth240a8f81@if3` on host machine.

Based on this example you can write your own script to match `veth` interfaces to Pods, containers, etc.

Hope that helps.

Problem

Original source

Related problems

• docker: how to get veth bridge interface pair easily?