Network observability

Monitor TCP connect using kprobe hooks

To view TCP connect events, apply the example TCP connect TracingPolicy:

kubectl apply -f

To start monitoring events in the xwing pod run the Tetragon CLI:

kubectl logs -n kube-system -l -c export-stdout -f | tetra getevents -o compact --namespace default --pod xwing

In another terminal, start generate a TCP connection. Here we use curl.

kubectl exec -it xwing -- curl

The output in the first terminal will capture the new connect and write,

🚀 process default/xwing /usr/bin/curl
🔌 connect default/xwing /usr/bin/curl tcp ->
📤 sendmsg default/xwing /usr/bin/curl tcp -> bytes 73
🧹 close   default/xwing /usr/bin/curl tcp ->
💥 exit    default/xwing /usr/bin/curl 0

To disable the TracingPolicy run:

kubectl delete -f