Support containerd

[letian0805]

Is your feature request related to a problem? Please describe.

I need to monitor the DNS, TCP, HTTP and other network requests of containers and hosts, so I used kernel-collector to collect this information. But I found that it does not work properly under kubernetes because it does not support containerd, only docker.

Describe the solution you'd like

Adapt to the containerd environment.

Describe alternatives you've considered

No response

Additional context

No response

[yonch]

Hi @letian0805 !
Do you have any more details?

While the kernel-collector does not support fetching local metadata from containerd, the ebpf code should extract container UUIDs, whose metadata the k8s-collector gathers. If all that works, containerd based systems should output full metadata.

What are you seeing?

[letian0805]

Hi @yonch
Since I don't have a compilation environment, I'm currently using the v0.10.2 executable file released on GitHub, which does not have k8s-collector. At present, I have implemented a bridge program from containerd to docker in golang to proxy the request to containerd.

[yonch]

Oh I had the (wrong) assumption you were running under Kubernetes.

Can you share the proxy? How different are the two protocols?

[letian0805]

Oh I had the (wrong) assumption you were running under Kubernetes.

Can you share the proxy? How different are the two protocols?

I do run on Kubernetes, but I don't use k8s-collector. Compiling opentelemetry-network is a bit difficult, so I use the v0.10.2 executable released on github, which does not have k8s-collector. If you release an executable for k8s-collector, I would consider using k8s-collector.

The protocol of containerd is similar to that of docker, mainly implementing the methods of these docker interfaces and proxying to containerd. Specifically, you can view the data structure of docker by sending curl requests to docker, and view the api and data structure of containerd through the containerd sdk.

import (
	containersapi "github.com/containerd/containerd/api/services/containers/v1"
	namespacesapi "github.com/containerd/containerd/api/services/namespaces/v1"
	"github.com/containerd/containerd/namespaces"
)

func (s *server) init(mux *gin.Engine) {
	mux.GET("/containers/json", s.handleList)
	mux.GET("/:version/containers/json", s.handleList)
	mux.GET("/containers/:id/json", s.handleInspect)
	mux.GET("/:version/containers/:id/json", s.handleInspect)
	mux.GET("/_ping", func(ctx *gin.Context) {})
}

However, due to some differences in the protocols, some data will be lost, but this data does not affect my use.

[yonch]

Got it. We can keep this issue if someone wants to implement containerd support directly in the k8s collector.

There are container images for the two k8s-collector components:

https://hub.docker.com/r/otel/opentelemetry-ebpf-k8s-watcher

https://hub.docker.com/r/otel/opentelemetry-ebpf-k8s-relay

Might they be of use to you?

[letian0805]

@yonch Thanks! I'll try it.

[yonch]

The helm chart can serve as a recipe of how they interconnect

https://github.com/open-telemetry/opentelemetry-helm-charts/tree/main/charts/opentelemetry-ebpf

[letian0805]

The helm chart can serve as a recipe of how they interconnect

https://github.com/open-telemetry/opentelemetry-helm-charts/tree/main/charts/opentelemetry-ebpf

OK. I have another question about k8s-collector. If I want to collect network request monitoring indicators such as dns, tcp, and http of the container, is it enough to deploy only k8s-collector? Do I also need kernel-collector? Also, does it require that the network mode of the monitored container use container networking instead of host networking? I didn't see more detailed instructions in the documentation.

[letian0805]

I understand that k8s-collector is only responsible for collecting metadata, and kernel-collector is needed to collect the underlying network monitoring indicators. Given that k8s-collector requires more permissions and has two additional components, I personally think it is easier to get metadata directly from containerd.

[yonch]

I believe not all metadata flows from the kubernetes control place down to the container runtime. I don't remember which, maybe Pod names are available and Deployment names aren't, or something similar. But as long as your setup works for your purpose, the k8s collector isn't required.

Thanks for raising the issue.