Skip to main content

Captures

Overview​

Retina Capture allows users to capture network traffic/metadata for specified Nodes/Pods.

Captures are on-demand and can be output to persistent storage such as the host filesystem, a storage blob, etc.

Usage​

There are two methods for triggering a Capture:

Option 1: Retina CLI​

Prerequisite: Install Retina CLI

The command syntax is kubectl retina capture create [--flags].

Refer to the Capture Command documentation for more details.

Example​

This example captures network traffic for all Linux Nodes, storing the output in the folder /mnt/capture on each Node.

kubectl retina capture create --name capture-test --host-path /mnt/capture --node-selectors "kubernetes.io/os=linux"

Architecture​

For each Capture, a Kubernetes Job is created for each relevant Node (the Node could be selected and/or could be hosting a selected Pod). The Job's worker Pod runs for the specified duration, captures and wraps the network information into a tarball, and copies the tarball to the specified output location(s). As a special case, a Kubernetes secret will be created containing a storage blob SAS for security concerns, then mounted to the Pod.

A random hashed name is assigned to each Retina Capture to uniquely label it.

Overview of Retina Capture without operator

Option 2: Capture CRD (Custom Resource Definition)​

Prerequisite: Install Retina with capture support.

Refer to the Capture CRD documentation for more details.

Managed Storage Account​

To simplify the user experience, a managed storage account can be configured when setting up Retina. Instructions for this are provided here.

Example​

This example creates a Capture and stores the Capture artifacts into a storage account specified by Blob SAS URL.

Create a secret to store blob SAS URL (and store it in blob-upload-url.txt):

kubectl create secret generic blob-sas-url --from-file=blob-upload-url=./blob-upload-url.txt

Create a Capture specifying the secret created as blobUpload, this example will also store the artifact on the node host path.

apiVersion: retina.sh/v1alpha1
kind: Capture
metadata:
  name: capture-test
spec:
  captureConfiguration:
    captureOption:
      duration: 30s
    captureTarget:
      nodeSelector:
        matchLabels:
          kubernetes.io/hostname: aks-nodepool1-11396069-vmss000000
  outputConfiguration:
    hostPath: "/tmp/retina"
    blobUpload: blob-sas-url

More Retina Capture samples can be found here.

Architecture​

Similarly to Option 1, a Kubernetes Job is created for each relevant Node.

Overview of Retina Capture with operator