vee1e/KubeArmor
1
0
Fork 0
mirror of https://github.com/vee1e/KubeArmor.git synced 2026-09-01 10:18:29 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
KubeArmor/getting-started/dns_visibility.md
Vaibhav Anand Singh b5d4f0ad2d fix: correct spelling mistakes across the project 
Signed-off-by: Vaibhav Anand Singh <vaibhavanandsingh24@gmail.com>
2026-05-15 10:50:42 +05:30

12 KiB
Raw Permalink Blame History

DNS Visibility

kubearmor supports dns visibility for egress traffic at both pod level and host level.

To gain the visibility, it uses kprobe/udp_sendmsg to access the payload of a DNS packet sent over a UDP connection. It provides these three information retrieved from the DNS query payload:

  1. domain name
  2. destination address (dns server)
  3. qtype (DNS record type) [A: ipv4 address, AAAA: ipv6 address]

To enable the dns visibility kubearmor supports dns as a visibility flag, user can enable it at pod, namespace or global level, see here for more details.

Example:

  1. annotate namespace to enable dns visibility

kubectl annotate ns default kubearmor-visibility=process,network,dns

  1. create a deployment in default namespace

kubectl create deployment nginx --image nginx

  1. watch logs in another terminal

karmor logs --logFilter all --operation Network --namespace default

  1. generate a dns query event

root@nginx-779797d5bd-wlrsn:/# curl google.com
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>301 Moved</TITLE></HEAD><BODY>
<H1>301 Moved</H1>
The document has moved
<A HREF="http://www.google.com/">here</A>.
</BODY></HTML>

  1. observe telemetry logs with kfunc=UDP_SENDMSG in Data field

[
  {
    "Timestamp": 1765218527,
    "UpdatedTime": "2025-12-08T18:28:47.125539Z",
    "ClusterName": "default",
    "HostName": "archlinux",
    "NamespaceName": "default",
    "Owner": {
      "Ref": "Deployment",
      "Name": "nginx",
      "Namespace": "default"
    },
    "PodName": "nginx-779797d5bd-wlrsn",
    "Labels": "app=nginx",
    "ContainerID": "c830ee7121da37bde4021a90d51728d05bf2e71ac5a31b6461a39b7cf77cffb1",
    "ContainerName": "nginx",
    "ContainerImage": "docker.io/library/nginx:latest@sha256:553f64aecdc31b5bf944521731cd70e35da4faed96b2b7548a3d8e2598c52a42",
    "ParentProcessName": "/usr/bin/bash",
    "ProcessName": "/usr/bin/curl",
    "HostPPID": 247074,
    "HostPID": 251151,
    "PPID": 41,
    "PID": 51,
    "UID": 0,
    "Type": "ContainerLog",
    "Source": "/usr/bin/curl google.com",
    "Operation": "Network",
    "Resource": "sa_family=AF_INET sin_port=53",
    "Data": "kfunc=UDP_SENDMSG,domain=google.com.default.svc.cluster.local,daddr=10.43.0.10,qtype=AAAA",
    "EventData": {
      "Kfunc": "UDP_SENDMSG,domain=google.com.default.svc.cluster.local,daddr=10.43.0.10,qtype=AAAA",
      "Sa_family": "AF_INET",
      "Sin_port": "53"
    },
    "Result": "Passed",
    "Cwd": "/",
    "TTY": "pts0",
    "ExecEvent": {
      "ExecID": "1078688820741427",
      "ExecutableName": "curl"
    }
  },
  {
    "Timestamp": 1765218527,
    "UpdatedTime": "2025-12-08T18:28:47.125535Z",
    "ClusterName": "default",
    "HostName": "archlinux",
    "NamespaceName": "default",
    "Owner": {
      "Ref": "Deployment",
      "Name": "nginx",
      "Namespace": "default"
    },
    "PodName": "nginx-779797d5bd-wlrsn",
    "Labels": "app=nginx",
    "ContainerID": "c830ee7121da37bde4021a90d51728d05bf2e71ac5a31b6461a39b7cf77cffb1",
    "ContainerName": "nginx",
    "ContainerImage": "docker.io/library/nginx:latest@sha256:553f64aecdc31b5bf944521731cd70e35da4faed96b2b7548a3d8e2598c52a42",
    "ParentProcessName": "/usr/bin/bash",
    "ProcessName": "/usr/bin/curl",
    "HostPPID": 247074,
    "HostPID": 251151,
    "PPID": 41,
    "PID": 51,
    "UID": 0,
    "Type": "ContainerLog",
    "Source": "/usr/bin/curl google.com",
    "Operation": "Network",
    "Resource": "sa_family=AF_INET sin_port=53",
    "Data": "kfunc=UDP_SENDMSG,domain=google.com.default.svc.cluster.local,daddr=10.43.0.10,qtype=A",
    "EventData": {
      "Kfunc": "UDP_SENDMSG,domain=google.com.default.svc.cluster.local,daddr=10.43.0.10,qtype=A",
      "Sa_family": "AF_INET",
      "Sin_port": "53"
    },
    "Result": "Passed",
    "Cwd": "/",
    "TTY": "pts0",
    "ExecEvent": {
      "ExecID": "1078688820741427",
      "ExecutableName": "curl"
    }
  },
  {
    "Timestamp": 1765218527,
    "UpdatedTime": "2025-12-08T18:28:47.126117Z",
    "ClusterName": "default",
    "HostName": "archlinux",
    "NamespaceName": "default",
    "Owner": {
      "Ref": "Deployment",
      "Name": "nginx",
      "Namespace": "default"
    },
    "PodName": "nginx-779797d5bd-wlrsn",
    "Labels": "app=nginx",
    "ContainerID": "c830ee7121da37bde4021a90d51728d05bf2e71ac5a31b6461a39b7cf77cffb1",
    "ContainerName": "nginx",
    "ContainerImage": "docker.io/library/nginx:latest@sha256:553f64aecdc31b5bf944521731cd70e35da4faed96b2b7548a3d8e2598c52a42",
    "ParentProcessName": "/usr/bin/bash",
    "ProcessName": "/usr/bin/curl",
    "HostPPID": 247074,
    "HostPID": 251151,
    "PPID": 41,
    "PID": 51,
    "UID": 0,
    "Type": "ContainerLog",
    "Source": "/usr/bin/curl google.com",
    "Operation": "Network",
    "Resource": "sa_family=AF_INET sin_port=53",
    "Data": "kfunc=UDP_SENDMSG,domain=google.com.svc.cluster.local,daddr=10.43.0.10,qtype=A",
    "EventData": {
      "Kfunc": "UDP_SENDMSG,domain=google.com.svc.cluster.local,daddr=10.43.0.10,qtype=A",
      "Sa_family": "AF_INET",
      "Sin_port": "53"
    },
    "Result": "Passed",
    "Cwd": "/",
    "TTY": "pts0",
    "ExecEvent": {
      "ExecID": "1078688820741427",
      "ExecutableName": "curl"
    }
  },
  {
    "Timestamp": 1765218527,
    "UpdatedTime": "2025-12-08T18:28:47.126209Z",
    "ClusterName": "default",
    "HostName": "archlinux",
    "NamespaceName": "default",
    "Owner": {
      "Ref": "Deployment",
      "Name": "nginx",
      "Namespace": "default"
    },
    "PodName": "nginx-779797d5bd-wlrsn",
    "Labels": "app=nginx",
    "ContainerID": "c830ee7121da37bde4021a90d51728d05bf2e71ac5a31b6461a39b7cf77cffb1",
    "ContainerName": "nginx",
    "ContainerImage": "docker.io/library/nginx:latest@sha256:553f64aecdc31b5bf944521731cd70e35da4faed96b2b7548a3d8e2598c52a42",
    "ParentProcessName": "/usr/bin/bash",
    "ProcessName": "/usr/bin/curl",
    "HostPPID": 247074,
    "HostPID": 251151,
    "PPID": 41,
    "PID": 51,
    "UID": 0,
    "Type": "ContainerLog",
    "Source": "/usr/bin/curl google.com",
    "Operation": "Network",
    "Resource": "sa_family=AF_INET sin_port=53",
    "Data": "kfunc=UDP_SENDMSG,domain=google.com.svc.cluster.local,daddr=10.43.0.10,qtype=AAAA",
    "EventData": {
      "Kfunc": "UDP_SENDMSG,domain=google.com.svc.cluster.local,daddr=10.43.0.10,qtype=AAAA",
      "Sa_family": "AF_INET",
      "Sin_port": "53"
    },
    "Result": "Passed",
    "Cwd": "/",
    "TTY": "pts0",
    "ExecEvent": {
      "ExecID": "1078688820741427",
      "ExecutableName": "curl"
    }
  },
  {
    "Timestamp": 1765218527,
    "UpdatedTime": "2025-12-08T18:28:47.126649Z",
    "ClusterName": "default",
    "HostName": "archlinux",
    "NamespaceName": "default",
    "Owner": {
      "Ref": "Deployment",
      "Name": "nginx",
      "Namespace": "default"
    },
    "PodName": "nginx-779797d5bd-wlrsn",
    "Labels": "app=nginx",
    "ContainerID": "c830ee7121da37bde4021a90d51728d05bf2e71ac5a31b6461a39b7cf77cffb1",
    "ContainerName": "nginx",
    "ContainerImage": "docker.io/library/nginx:latest@sha256:553f64aecdc31b5bf944521731cd70e35da4faed96b2b7548a3d8e2598c52a42",
    "ParentProcessName": "/usr/bin/bash",
    "ProcessName": "/usr/bin/curl",
    "HostPPID": 247074,
    "HostPID": 251151,
    "PPID": 41,
    "PID": 51,
    "UID": 0,
    "Type": "ContainerLog",
    "Source": "/usr/bin/curl google.com",
    "Operation": "Network",
    "Resource": "sa_family=AF_INET sin_port=53",
    "Data": "kfunc=UDP_SENDMSG,domain=google.com.cluster.local,daddr=10.43.0.10,qtype=AAAA",
    "EventData": {
      "Kfunc": "UDP_SENDMSG,domain=google.com.cluster.local,daddr=10.43.0.10,qtype=AAAA",
      "Sa_family": "AF_INET",
      "Sin_port": "53"
    },
    "Result": "Passed",
    "Cwd": "/",
    "TTY": "pts0",
    "ExecEvent": {
      "ExecID": "1078688820741427",
      "ExecutableName": "curl"
    }
  },
  {
    "Timestamp": 1765218527,
    "UpdatedTime": "2025-12-08T18:28:47.126645Z",
    "ClusterName": "default",
    "HostName": "archlinux",
    "NamespaceName": "default",
    "Owner": {
      "Ref": "Deployment",
      "Name": "nginx",
      "Namespace": "default"
    },
    "PodName": "nginx-779797d5bd-wlrsn",
    "Labels": "app=nginx",
    "ContainerID": "c830ee7121da37bde4021a90d51728d05bf2e71ac5a31b6461a39b7cf77cffb1",
    "ContainerName": "nginx",
    "ContainerImage": "docker.io/library/nginx:latest@sha256:553f64aecdc31b5bf944521731cd70e35da4faed96b2b7548a3d8e2598c52a42",
    "ParentProcessName": "/usr/bin/bash",
    "ProcessName": "/usr/bin/curl",
    "HostPPID": 247074,
    "HostPID": 251151,
    "PPID": 41,
    "PID": 51,
    "UID": 0,
    "Type": "ContainerLog",
    "Source": "/usr/bin/curl google.com",
    "Operation": "Network",
    "Resource": "sa_family=AF_INET sin_port=53",
    "Data": "kfunc=UDP_SENDMSG,domain=google.com.cluster.local,daddr=10.43.0.10,qtype=A",
    "EventData": {
      "Kfunc": "UDP_SENDMSG,domain=google.com.cluster.local,daddr=10.43.0.10,qtype=A",
      "Sa_family": "AF_INET",
      "Sin_port": "53"
    },
    "Result": "Passed",
    "Cwd": "/",
    "TTY": "pts0",
    "ExecEvent": {
      "ExecID": "1078688820741427",
      "ExecutableName": "curl"
    }
  },
  {
    "Timestamp": 1765218527,
    "UpdatedTime": "2025-12-08T18:28:47.126997Z",
    "ClusterName": "default",
    "HostName": "archlinux",
    "NamespaceName": "default",
    "Owner": {
      "Ref": "Deployment",
      "Name": "nginx",
      "Namespace": "default"
    },
    "PodName": "nginx-779797d5bd-wlrsn",
    "Labels": "app=nginx",
    "ContainerID": "c830ee7121da37bde4021a90d51728d05bf2e71ac5a31b6461a39b7cf77cffb1",
    "ContainerName": "nginx",
    "ContainerImage": "docker.io/library/nginx:latest@sha256:553f64aecdc31b5bf944521731cd70e35da4faed96b2b7548a3d8e2598c52a42",
    "ParentProcessName": "/usr/bin/bash",
    "ProcessName": "/usr/bin/curl",
    "HostPPID": 247074,
    "HostPID": 251151,
    "PPID": 41,
    "PID": 51,
    "UID": 0,
    "Type": "ContainerLog",
    "Source": "/usr/bin/curl google.com",
    "Operation": "Network",
    "Resource": "sa_family=AF_INET sin_port=53",
    "Data": "kfunc=UDP_SENDMSG,domain=google.com,daddr=10.43.0.10,qtype=A",
    "EventData": {
      "Kfunc": "UDP_SENDMSG,domain=google.com,daddr=10.43.0.10,qtype=A",
      "Sa_family": "AF_INET",
      "Sin_port": "53"
    },
    "Result": "Passed",
    "Cwd": "/",
    "TTY": "pts0",
    "ExecEvent": {
      "ExecID": "1078688820741427",
      "ExecutableName": "curl"
    }
  },
  {
    "Timestamp": 1765218527,
    "UpdatedTime": "2025-12-08T18:28:47.127080Z",
    "ClusterName": "default",
    "HostName": "archlinux",
    "NamespaceName": "default",
    "Owner": {
      "Ref": "Deployment",
      "Name": "nginx",
      "Namespace": "default"
    },
    "PodName": "nginx-779797d5bd-wlrsn",
    "Labels": "app=nginx",
    "ContainerID": "c830ee7121da37bde4021a90d51728d05bf2e71ac5a31b6461a39b7cf77cffb1",
    "ContainerName": "nginx",
    "ContainerImage": "docker.io/library/nginx:latest@sha256:553f64aecdc31b5bf944521731cd70e35da4faed96b2b7548a3d8e2598c52a42",
    "ParentProcessName": "/usr/bin/bash",
    "ProcessName": "/usr/bin/curl",
    "HostPPID": 247074,
    "HostPID": 251151,
    "PPID": 41,
    "PID": 51,
    "UID": 0,
    "Type": "ContainerLog",
    "Source": "/usr/bin/curl google.com",
    "Operation": "Network",
    "Resource": "sa_family=AF_INET sin_port=53",
    "Data": "kfunc=UDP_SENDMSG,domain=google.com,daddr=10.43.0.10,qtype=AAAA",
    "EventData": {
      "Kfunc": "UDP_SENDMSG,domain=google.com,daddr=10.43.0.10,qtype=AAAA",
      "Sa_family": "AF_INET",
      "Sin_port": "53"
    },
    "Result": "Passed",
    "Cwd": "/",
    "TTY": "pts0",
    "ExecEvent": {
      "ExecID": "1078688820741427",
      "ExecutableName": "curl"
    }
  }
]