It's Not Always the Network (But Here's How to Prove It): Kubernetes Packet...
summary
Practical playbook for proving whether networking is at fault: three concrete capture strategies and when to use each. Use tcpdump on eth0 from the node to inspect VXLAN/overlay and veth drops; use kubectl sniff (kubectl cp + exec) for quick pod captures with caveats; use kubectl debug + netshoot ephemeral containers to capture localhost and pod-side traffic. Demo with Cilium and Hubble exposes a bad nameserver 10.42.42.42 causing 1s DNS timeouts that add up to a 4s user delay.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 2:04Network misdiagnosis causes
- 6:00Packet capture importance
- 6:21Kubernetes packet capture strategies
- 14:09KSniff for capture
- 17:04Ephemeral containers debugging
- 19:13Live demo troubleshooting
- 25:50DNS misconfiguration analysis
- 26:12eBPF network observability
- 31:40Strategies recap
- 33:07Summary
related talks
29m“Are These Things Talking to Each Other?” - Observing Kubernetes Networking...
33mThree Surprising K8s Networking “Features” and How to Defend Against Them
32mUnderstand and Troubleshoot the “Magic” of Kubernetes Networking - Minhan Xia & Rohit Ramkumar
28mHow to Break your Kubernetes Cluster with Networking
27mDeconstructing K8s Networking for Knowledge and Profit
51mHow Kubernetes Networking Really Works: A Packet’s Journey Across Pods and Nodes
40mAttacking Kubernetes Clusters Through Your Network Plumbing
20mKubernetes Networking 101