Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

docs: Network Monitoring section of Getting Started incorrectly indicates no new events #2687

Open
scottslowe opened this issue Jul 17, 2024 · 0 comments
Labels
area/documentation Improvements or additions to documentation

Comments

@scottslowe
Copy link
Contributor

scottslowe commented Jul 17, 2024

The Networking Monitoring section of the Getting Started guide states that "no new events" will be generated when using curl to connect from the "xwing" Pod to a cluster-internal FQDN (like deathstar.svc.cluster.local) or its equivalent ClusterIP (like 10.100.100.1).

However, this isn't correct. No new connect events will be generated, but new process and exit events will be generated since execution monitoring is still active:

🚀 process default/xwing /usr/bin/curl -s -XPOST deathstar.default.svc.cluster.local/v1/request-landing
💥 exit    default/xwing /usr/bin/curl -s -XPOST deathstar.default.svc.cluster.local/v1/request-landing 0
💥 exit    default/xwing /bin/bash  0
🚀 process default/xwing /usr/bin/bash -c "curl -s -XPOST 10.100.100.1/v1/request-landing"
🚀 process default/xwing /usr/bin/curl -s -XPOST 10.100.100.1/v1/request-landing
💥 exit    default/xwing /usr/bin/curl -s -XPOST 10.100.100.1/v1/request-landing 0
🚀 process default/xwing /usr/bin/bash -c "curl -s -XPOST 10.100.100.1/v1/request-landing"
🚀 process default/xwing /usr/bin/curl -s -XPOST 10.100.100.1/v1/request-landing
💥 exit    default/xwing /usr/bin/curl -s -XPOST 10.100.100.1/v1/request-landing 0

We should either:

  1. Update the docs to indicate that Tetragon won't generate new connect events, but that execution monitoring events are still reported; or
  2. update the docs to filter out execution monitoring events (which I believe can be done via --event-types, but I haven't personally tested this yet).
@mtardy mtardy added the area/documentation Improvements or additions to documentation label Jul 17, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area/documentation Improvements or additions to documentation
Projects
None yet
Development

No branches or pull requests

2 participants