kube-monkey icon indicating copy to clipboard operation
kube-monkey copied to clipboard

Support more forms of failure: execute command in containers

Open misgod-yy opened this issue 5 years ago • 2 comments

Support for executing command in containers. Users could design different kinds of failures by executing different commands. Add monkey behavior in kube-monkey's config as follows:

[kubemonkey]
dry_run = true                           # Terminations are only logged
run_hour = 8                             # Run scheduling at 8am on weekdays
harm_type = "exec_pod"                   # Monkey's behavior is to execute command in containers. Default value is "delete_pod", which represents deleting pods
start_hour = 10                          # Don't schedule any pod deaths before 10am
end_hour = 16                            # Don't schedule any pod deaths after 4pm
blacklisted_namespaces = ["kube-system"] # Critical apps live here
time_zone = "America/New_York"           # Set tzdata timezone example. Note the field is time_zone not timezone

Add command and containter for executing commands as follows:

apiVersion: v1
kind: Pod
metadata:
  annotations:
    kube-monkey/exec-cmd: echo hello
  labels:
    kube-monkey/enabled: enabled
    kube-monkey/identifier: canary
    kube-monkey/kill-mode: fixed
    kube-monkey/kill-value: "1"
    kube-monkey/mtbf: "1"
    kube-monkey/container-name: "main"
[... omitted ...]

Test in k8s cluster: exec_cmd_pic

misgod-yy avatar Jan 09 '20 08:01 misgod-yy

This looks interesting but very inflexible. With the suggested approach you can only run the same exact attack against all your victims. It seems a bit odd to use annotations with the command, but it would be more flexible.

worldtiki avatar Feb 22 '20 14:02 worldtiki

This looks interesting but very inflexible. With the suggested approach you can only run the same exact attack against all your victims. It seems a bit odd to use annotations with the command, but it would be more flexible.

Thx for the suggestion. I've recommit the annotation label for pod to run different commands in container. It could support more complicated attack.

misgod-yy avatar Feb 25 '20 13:02 misgod-yy