How does mirrord join the same network namespace of the target pod?

[ettoredn]

Hi,

How does mirrord join the same network namespace of the target pod?

I'm not very familiar with k8s, so probably the answer is obvious, but I haven't found any specific mention of this in mirrord documentation.

[t4lz]

Hi @ettoredn, thanks for your question. The short answer is that mirrord's agent, running in the K8s cluster, associates the thread that does the sniffing and sending of network traffic, with the Linux net namespace of the target container (note that there are Kubernetes namespaces and Linux namespaces which are two different concepts that are both relevant for mirrord).

There are actually two possible types of mirrord agents. The default mode is a Job agent - mirrord will create a K8s Job, that will create an agent pod and remove that pod once it's done. In that mode, the agent will use setns in order to set the net namespace:

mirrord/mirrord/agent/src/namespace.rs

Line 48 in df3b7fd

setns(fd.as_raw_fd(), namespace_type.into())?;

The other type of mirrord agent is an agent that runs on an Ephemeral Container. With that option, the agent container is already in the same net namespace as the target container because K8s sets it that way for Ephemeral Containers.

For some further reading, Mehul from our team explained it in this blog post about Ephemeral containers.