tracee in Kubernetes

[itaysk]

tracee should be able to run in a Kubernetes. the goal is for a user to be able to start tracing one pod or container, without jumping through too many hoops.
this issue is for tracking Kubernetes related requests and tasks.

To be discussed:

• running tracee in pods vs running on nodes.
• what are the implications of running many instances of tracee on the same node?
• client/server architecture can be used to separate event collecting from filtering.
• we currently do detect containers, but we don't allow to target a specific container.
• consider filtering by mnt ns and cgroups

related to #20

[itaysk]

bcc is starting to create a standard way for "container filtering" where by tools will implement options for mnt ns and cgroups filtering

[itaysk]

inspektor-gadget is a kubernetes native platform to integrate ebpf tools. there's a suggestion to add tracee as a tool, which will help us accelerate kubernetes integration: inspektor-gadget/inspektor-gadget#106

[ayoubeddafali]

Subscribed to thiis interesting thread