通過(guò)kubectl連接到ASM實(shí)例，使用以下內(nèi)容創(chuàng)建ASMPacketInspector.yaml。

apiVersion: istio.alibabacloud.com/v1beta1
kind: ASMPacketInspector
metadata:
  name: test
spec:
  pod:
    clusterId: ${ACK Cluster ID}
    namespace: default
    name: ${sleep pod name}
  tcpDumpParams: '-i any port 80'
  duration: 60s
  fileName: sleep.pcap

執(zhí)行以下命令部署ASMPacketInspector資源。

kubectl apply -f ASMPacketInspector.yaml

ASMPacketInspector資源部署后，ASM會(huì)自動(dòng)在sleep pod中抓取80端口的數(shù)據(jù)包（httpbin pod暴露的服務(wù)端口），抓包時(shí)長(zhǎng)為60s。在此期間，通過(guò)kubectl連接到ASM實(shí)例添加的Kubernetes集群，執(zhí)行以下命令。

kubectl exec -it <sleep pod name> -c sleep --  sh -c 'for i in $(seq 1 30); do curl httpbin:8000 -I ; echo "request $i done"; done'

此命令會(huì)自動(dòng)從sleep pod向httpbin服務(wù)發(fā)送30次請(qǐng)求。

通過(guò)kubectl連接到ASM實(shí)例，執(zhí)行以下命令查看抓包結(jié)果。

kubectl get ASMPacketInspector test -o yaml

預(yù)期結(jié)果：

apiVersion: istio.alibabacloud.com/v1beta1
kind: ASMPacketInspector
metadata:
  ******
spec:
  ******
status:
  completedAt: null
  conditions:
  - time: "2024-06-12T08:15:33Z"
    type: Inspecting
  - message: 'inspecting job status: Running'
    time: "2024-06-12T08:15:43Z"
    type: Inspecting
  - message: 'inspecting job status: Running'
    time: "2024-06-12T08:15:53Z"
    type: Inspecting
  - message: 'inspecting job status: Running'
    time: "2024-06-12T08:16:03Z"
    type: Inspecting
  - message: 'inspecting job status: Running'
    time: "2024-06-12T08:16:13Z"
    type: Inspecting
  - message: 'inspecting job status: Running'
    time: "2024-06-12T08:16:23Z"
    type: Inspecting
  filePath: /tmp/sleep.pcap
  phase: Inspecting
  runningOnNode: *******
  startAt: "2024-06-12T08:15:43Z"
  taskId: inspector-zumnmwdc

從status部分的runningOnNode可以看到抓包運(yùn)行的node，filePath代表輸出文件的路徑。登錄到指定節(jié)點(diǎn)將文件下載到本地。

通過(guò)kubectl連接到ASM實(shí)例添加的Kubernetes集群，執(zhí)行以下命令查看sleep應(yīng)用運(yùn)行在哪個(gè)Node上。

kubectl  get pod -o wide 

預(yù)期輸出：

NAME                       READY   STATUS    RESTARTS   AGE     IP           NODE                       NOMINATED NODE   READINESS GATES
httpbin-6c8f47d9b9-stq72   2/2     Running   0          33m     172.16.*.*   cn-***.172.16.*.*   <none>           <none>
sleep-84f9785988-ft9rm     2/2     Running   0          3h56m   172.16.*.*   cn-***.172.16.*.*   <none>           <none>

登錄到目標(biāo)節(jié)點(diǎn)。操作步驟詳情，請(qǐng)參見(jiàn)通過(guò)密碼或密鑰認(rèn)證登錄Linux實(shí)例。

1. 執(zhí)行以下命令查看sleep應(yīng)用對(duì)應(yīng)的容器CONTAINER ID。

   sudo crictl ps |grep <Pod名稱關(guān)鍵字>

   預(yù)期輸出：

   CONTAINER           IMAGE               CREATED             STATE                      
   a1a214d2*****       35d28df4*****       2 days ago          Running

2. 使用CONTAINER ID參數(shù)，執(zhí)行以下命令查看容器PID。

   sudo crictl inspect  a1a214d2***** |grep -i PID

   預(yù)期輸出：

       "pid": 2309838,    # 目標(biāo)容器的PID進(jìn)程號(hào)。
               "pid": 1
               "type": "pid"

3. 執(zhí)行以下抓包命令。

   sudo nsenter -t <容器PID> tcpdump -i any port 80 -w /tmp/test.pcap

   將命令執(zhí)行后生成的test.pcap文件下載到本地。