-
Notifications
You must be signed in to change notification settings - Fork 4.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Use add_kubernetes_metadata
IP & port matching in Packetbeat
#5707
Changes from 1 commit
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -12,6 +12,7 @@ import ( | |
const ( | ||
ContainerIndexerName = "container" | ||
PodNameIndexerName = "pod_name" | ||
IPPortIndexerName = "ip_port" | ||
) | ||
|
||
// Indexer take known pods and generate all the metadata we need to enrich | ||
|
@@ -248,3 +249,81 @@ func containerID(status PodContainerStatus) string { | |
} | ||
return "" | ||
} | ||
|
||
// IPPortIndexer indexes pods based on all their host:port combinations | ||
type IPPortIndexer struct { | ||
genMeta GenMeta | ||
} | ||
|
||
// NewIPPortIndexer creates and returns a new indexer for pod IP & ports | ||
func NewIPPortIndexer(_ common.Config, genMeta GenMeta) (Indexer, error) { | ||
return &IPPortIndexer{genMeta: genMeta}, nil | ||
} | ||
|
||
// GetMetadata returns metadata for the given pod, if it matches the index | ||
func (h *IPPortIndexer) GetMetadata(pod *Pod) []MetadataIndex { | ||
commonMeta := h.genMeta.GenerateMetaData(pod) | ||
hostPorts := h.GetIndexes(pod) | ||
var metadata []MetadataIndex | ||
|
||
if pod.Status.PodIP == "" { | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. If a pod does not have an IP address, it means no metadata is availabe? Should this return an error? There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. We wouldn't be dealing with this error anyway, it could make sense to log this, but I think it's just defensive code |
||
return metadata | ||
} | ||
for i := 0; i < len(hostPorts); i++ { | ||
dobreak := false | ||
containerMeta := commonMeta.Clone() | ||
for _, container := range pod.Spec.Containers { | ||
ports := container.Ports | ||
|
||
for _, port := range ports { | ||
if port.ContainerPort == int64(0) { | ||
continue | ||
} | ||
if strings.Index(hostPorts[i], fmt.Sprintf("%s:%d", pod.Status.PodIP, port.ContainerPort)) != -1 { | ||
containerMeta["container"] = common.MapStr{ | ||
"name": container.Name, | ||
} | ||
dobreak = true | ||
break | ||
} | ||
} | ||
|
||
if dobreak { | ||
break | ||
} | ||
|
||
} | ||
|
||
metadata = append(metadata, MetadataIndex{ | ||
Index: hostPorts[i], | ||
Data: containerMeta, | ||
}) | ||
} | ||
|
||
return metadata | ||
} | ||
|
||
// GetIndexes returns the indexes for the given Pod | ||
func (h *IPPortIndexer) GetIndexes(pod *Pod) []string { | ||
var hostPorts []string | ||
|
||
ip := pod.Status.PodIP | ||
if ip == "" { | ||
return hostPorts | ||
} | ||
for _, container := range pod.Spec.Containers { | ||
ports := container.Ports | ||
|
||
for _, port := range ports { | ||
if port.ContainerPort != int64(0) { | ||
hostPorts = append(hostPorts, fmt.Sprintf("%s:%d", ip, port.ContainerPort)) | ||
} else { | ||
hostPorts = append(hostPorts, ip) | ||
} | ||
|
||
} | ||
|
||
} | ||
|
||
return hostPorts | ||
} |
This file was deleted.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I would add 2 change entries. One to "applies to all beats" that the IpProcessor is now available for all beats (also filebeat for example) and the other one as above that IpProcessor is set as default for PB.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
good point! I added a new entry