Skip to content

Commit a51e420

Browse files
branczbrancz
authored
Get pod list via CRI first (#3116)
This is a successor for #3064 The method used in this PR is from crictl: https://github.com/kubernetes-sigs/cri-tools/blob/master/cmd/crictl/pod_stats.go The upgrade for selinux and containerd fixes CVE-2025-52881 and CVE-2024-25621 , respectively.
2 parents 85e668c + 5b1e546 commit a51e420

File tree

4 files changed

+240
-31
lines changed

4 files changed

+240
-31
lines changed

‎go.mod‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ require (
1212
github.com/apache/arrow/go/v16 v16.1.0
1313
github.com/armon/circbuf v0.0.0-20190214190532-5111143e8da2
1414
github.com/common-nighthawk/go-figure v0.0.0-20210622060536-734e95fb86be
15-
github.com/containerd/containerd v1.7.27
15+
github.com/containerd/containerd v1.7.29
1616
github.com/docker/docker v28.3.3+incompatible
1717
github.com/dustin/go-humanize v1.0.1
1818
github.com/elastic/go-freelru v0.16.0
@@ -52,15 +52,19 @@ require (
5252
k8s.io/api v0.32.3
5353
k8s.io/apimachinery v0.32.3
5454
k8s.io/client-go v0.32.3
55+
k8s.io/cri-api v0.32.3
56+
k8s.io/cri-client v0.32.3
5557
)
5658

5759
require (
5860
buf.build/gen/go/gogo/protobuf/protocolbuffers/go v1.36.6-20240617172848-e1dbca2775a7.1 // indirect
61+
cyphar.com/go-pathrs v0.2.1 // indirect
5962
github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 // indirect
6063
github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20230306123547-8075edf89bb0 // indirect
6164
github.com/Microsoft/go-winio v0.6.2 // indirect
6265
github.com/Microsoft/hcsshim v0.12.9 // indirect
6366
github.com/beorn7/perks v1.0.1 // indirect
67+
github.com/blang/semver/v4 v4.0.0 // indirect
6468
github.com/cenkalti/backoff/v4 v4.3.0 // indirect
6569
github.com/cespare/xxhash/v2 v2.3.0 // indirect
6670
github.com/cilium/ebpf v0.19.0 // indirect
@@ -74,6 +78,7 @@ require (
7478
github.com/containerd/platforms v0.2.1 // indirect
7579
github.com/containerd/ttrpc v1.2.7 // indirect
7680
github.com/containerd/typeurl/v2 v2.2.3 // indirect
81+
github.com/cyphar/filepath-securejoin v0.6.0 // indirect
7782
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
7883
github.com/distribution/reference v0.6.0 // indirect
7984
github.com/docker/go-connections v0.6.0 // indirect
@@ -101,6 +106,7 @@ require (
101106
github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 // indirect
102107
github.com/hashicorp/go-version v1.7.0 // indirect
103108
github.com/ianlancetaylor/demangle v0.0.0-20250417193237-f615e6bd150b // indirect
109+
github.com/inconshreveable/mousetrap v1.1.0 // indirect
104110
github.com/josharian/intern v1.0.0 // indirect
105111
github.com/josharian/native v1.1.0 // indirect
106112
github.com/jpillora/backoff v1.0.0 // indirect
@@ -126,13 +132,15 @@ require (
126132
github.com/opencontainers/go-digest v1.0.0 // indirect
127133
github.com/opencontainers/image-spec v1.1.1 // indirect
128134
github.com/opencontainers/runtime-spec v1.2.1 // indirect
129-
github.com/opencontainers/selinux v1.12.0 // indirect
135+
github.com/opencontainers/selinux v1.13.0 // indirect
130136
github.com/pbnjay/memory v0.0.0-20210728143218-7b4eea64cf58 // indirect
131137
github.com/pierrec/lz4/v4 v4.1.22 // indirect
132138
github.com/pkg/errors v0.9.1 // indirect
133139
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
134140
github.com/prometheus/client_model v0.6.2 // indirect
135141
github.com/prometheus/procfs v0.16.0 // indirect
142+
github.com/spf13/cobra v1.8.1 // indirect
143+
github.com/spf13/pflag v1.0.5 // indirect
136144
github.com/x448/float16 v0.8.4 // indirect
137145
go.opencensus.io v0.24.0 // indirect
138146
go.opentelemetry.io/auto/sdk v1.1.0 // indirect
@@ -150,7 +158,7 @@ require (
150158
golang.org/x/oauth2 v0.30.0 // indirect
151159
golang.org/x/term v0.34.0 // indirect
152160
golang.org/x/text v0.28.0 // indirect
153-
golang.org/x/time v0.11.0 // indirect
161+
golang.org/x/time v0.12.0 // indirect
154162
golang.org/x/tools v0.36.0 // indirect
155163
golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
156164
google.golang.org/genproto v0.0.0-20250414145226-207652e42e2e // indirect
@@ -159,6 +167,7 @@ require (
159167
gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
160168
gopkg.in/inf.v0 v0.9.1 // indirect
161169
gopkg.in/yaml.v2 v2.4.0 // indirect
170+
k8s.io/component-base v0.32.3 // indirect
162171
k8s.io/klog/v2 v2.130.1 // indirect
163172
k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff // indirect
164173
k8s.io/utils v0.0.0-20250321185631-1f6e0b77f77e // indirect

‎go.sum‎

Lines changed: 24 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ buf.build/gen/go/parca-dev/parca/protocolbuffers/go v1.36.6-20250212095114-4db6f
77
buf.build/gen/go/prometheus/prometheus/protocolbuffers/go v1.36.6-20250320161912-af2aab87b1b3.1 h1:EuFqAB/kfs/jh9aUGcvBjcxtU89wnXwsuQfcwGX1rhE=
88
buf.build/gen/go/prometheus/prometheus/protocolbuffers/go v1.36.6-20250320161912-af2aab87b1b3.1/go.mod h1:ea/VK8bRnfyOuhQRzIk5hGigCqbZdzI8SHNLC3IyABU=
99
cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
10+
cyphar.com/go-pathrs v0.2.1 h1:9nx1vOgwVvX1mNBWDu93+vaceedpbsDqo+XuBGL40b8=
11+
cyphar.com/go-pathrs v0.2.1/go.mod h1:y8f1EMG7r+hCuFf/rXsKqMJrJAUoADZGNh5/vZPKcGc=
1012
dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
1113
dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
1214
github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 h1:He8afgbRMd7mFxO99hRNu+6tazq8nFF9lIwo9JFroBk=
@@ -36,6 +38,8 @@ github.com/armon/circbuf v0.0.0-20190214190532-5111143e8da2 h1:7Ip0wMmLHLRJdrloD
3638
github.com/armon/circbuf v0.0.0-20190214190532-5111143e8da2/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o=
3739
github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
3840
github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
41+
github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
42+
github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
3943
github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
4044
github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
4145
github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
@@ -55,8 +59,8 @@ github.com/common-nighthawk/go-figure v0.0.0-20210622060536-734e95fb86be h1:J5BL
5559
github.com/common-nighthawk/go-figure v0.0.0-20210622060536-734e95fb86be/go.mod h1:mk5IQ+Y0ZeO87b858TlA645sVcEcbiX6YqP98kt+7+w=
5660
github.com/containerd/cgroups/v3 v3.0.5 h1:44na7Ud+VwyE7LIoJ8JTNQOa549a8543BmzaJHo6Bzo=
5761
github.com/containerd/cgroups/v3 v3.0.5/go.mod h1:SA5DLYnXO8pTGYiAHXz94qvLQTKfVM5GEVisn4jpins=
58-
github.com/containerd/containerd v1.7.27 h1:yFyEyojddO3MIGVER2xJLWoCIn+Up4GaHFquP7hsFII=
59-
github.com/containerd/containerd v1.7.27/go.mod h1:xZmPnl75Vc+BLGt4MIfu6bp+fy03gdHAn9bz+FreFR0=
62+
github.com/containerd/containerd v1.7.29 h1:90fWABQsaN9mJhGkoVnuzEY+o1XDPbg9BTC9QTAHnuE=
63+
github.com/containerd/containerd v1.7.29/go.mod h1:azUkWcOvHrWvaiUjSQH0fjzuHIwSPg1WL5PshGP4Szs=
6064
github.com/containerd/containerd/api v1.8.0 h1:hVTNJKR8fMc/2Tiw60ZRijntNMd1U+JVMyTRdsD2bS0=
6165
github.com/containerd/containerd/api v1.8.0/go.mod h1:dFv4lt6S20wTu/hMcP4350RL87qPWLVa/OHOwmmdnYc=
6266
github.com/containerd/continuity v0.4.5 h1:ZRoN1sXq9u7V6QoHMcVWGhOwDFqZ4B9i5H6un1Wh0x4=
@@ -81,6 +85,9 @@ github.com/coreos/pkg v0.0.0-20240122114842-bbd7aa9bf6fb h1:GIzvVQ9UkUlOhSDlqmrQ
8185
github.com/coreos/pkg v0.0.0-20240122114842-bbd7aa9bf6fb/go.mod h1:E3G3o1h8I7cfcXa63jLwjI0eiQQMgzzUDFVpN/nH/eA=
8286
github.com/cpuguy83/dockercfg v0.3.2 h1:DlJTyZGBDlXqUZ2Dk2Q3xHs/FtnooJJVaad2S9GKorA=
8387
github.com/cpuguy83/dockercfg v0.3.2/go.mod h1:sugsbF4//dDlL/i+S+rtpIWp+5h0BHJHfjj5/jFyUJc=
88+
github.com/cpuguy83/go-md2man/v2 v2.0.4/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
89+
github.com/cyphar/filepath-securejoin v0.6.0 h1:BtGB77njd6SVO6VztOHfPxKitJvd/VPT+OFBFMOi1Is=
90+
github.com/cyphar/filepath-securejoin v0.6.0/go.mod h1:A8hd4EnAeyujCJRrICiOWqjS1AX0a9kM5XL+NwKoYSc=
8491
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
8592
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
8693
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
@@ -197,6 +204,8 @@ github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSo
197204
github.com/ianlancetaylor/demangle v0.0.0-20230524184225-eabc099b10ab/go.mod h1:gx7rwoVhcfuVKG5uya9Hs3Sxj7EIvldVofAWIUtGouw=
198205
github.com/ianlancetaylor/demangle v0.0.0-20250417193237-f615e6bd150b h1:ogbOPx86mIhFy764gGkqnkFC8m5PJA7sPzlk9ppLVQA=
199206
github.com/ianlancetaylor/demangle v0.0.0-20250417193237-f615e6bd150b/go.mod h1:gx7rwoVhcfuVKG5uya9Hs3Sxj7EIvldVofAWIUtGouw=
207+
github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
208+
github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
200209
github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
201210
github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
202211
github.com/josharian/native v1.1.0 h1:uuaP0hAbW7Y4l0ZRQ6C9zfb7Mg1mbFKry/xzDAfmtLA=
@@ -285,8 +294,8 @@ github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJw
285294
github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
286295
github.com/opencontainers/runtime-spec v1.2.1 h1:S4k4ryNgEpxW1dzyqffOmhI1BHYcjzU8lpJfSlR0xww=
287296
github.com/opencontainers/runtime-spec v1.2.1/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
288-
github.com/opencontainers/selinux v1.12.0 h1:6n5JV4Cf+4y0KNXW48TLj5DwfXpvWlxXplUkdTrmPb8=
289-
github.com/opencontainers/selinux v1.12.0/go.mod h1:BTPX+bjVbWGXw7ZZWUbdENt8w0htPSrlgOOysQaU62U=
297+
github.com/opencontainers/selinux v1.13.0 h1:Zza88GWezyT7RLql12URvoxsbLfjFx988+LGaWfbL84=
298+
github.com/opencontainers/selinux v1.13.0/go.mod h1:XxWTed+A/s5NNq4GmYScVy+9jzXhGBVEOAyucdRUY8s=
290299
github.com/orisano/pixelmatch v0.0.0-20220722002657-fb0b55479cde/go.mod h1:nZgzbfBr3hhjoZnS66nKrHmduYNpc34ny7RK4z5/HM0=
291300
github.com/parca-dev/oomprof v0.1.5 h1:FrfjL9CLDNb2oUfy1XO2BF6wi7SGVBKKSgW75m83lWI=
292301
github.com/parca-dev/oomprof v0.1.5/go.mod h1:iqI6XrmiNWOa8m2vEIKo+GtQrqbWCMLFpBWuk8RuAPs=
@@ -316,10 +325,13 @@ github.com/prometheus/prometheus v0.303.0 h1:wsNNsbd4EycMCphYnTmNY9JASBVbp7NWwJn
316325
github.com/prometheus/prometheus v0.303.0/go.mod h1:8PMRi+Fk1WzopMDeb0/6hbNs9nV6zgySkU/zds5Lu3o=
317326
github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
318327
github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
328+
github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
319329
github.com/shirou/gopsutil/v4 v4.25.6 h1:kLysI2JsKorfaFPcYmcJqbzROzsBWEOAtw6A7dIfqXs=
320330
github.com/shirou/gopsutil/v4 v4.25.6/go.mod h1:PfybzyydfZcN+JMMjkF6Zb8Mq1A/VcogFFg7hj50W9c=
321331
github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
322332
github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
333+
github.com/spf13/cobra v1.8.1 h1:e5/vxKd/rZsfSJMUX1agtjeTDf+qv1/JdBF8gg5k9ZM=
334+
github.com/spf13/cobra v1.8.1/go.mod h1:wHxEcudfqmLYa8iTfL+OuZPbBZkmvliBWKIezN3kD9Y=
323335
github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
324336
github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
325337
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
@@ -465,8 +477,8 @@ golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
465477
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
466478
golang.org/x/text v0.28.0 h1:rhazDwis8INMIwQ4tpjLDzUhx6RlXqZNPEM0huQojng=
467479
golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU=
468-
golang.org/x/time v0.11.0 h1:/bpjEDfN9tkoN/ryeYHnv5hcMlc8ncjMcM4XBk5NWV0=
469-
golang.org/x/time v0.11.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
480+
golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
481+
golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
470482
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
471483
golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
472484
golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
@@ -536,6 +548,12 @@ k8s.io/apimachinery v0.32.3 h1:JmDuDarhDmA/Li7j3aPrwhpNBA94Nvk5zLeOge9HH1U=
536548
k8s.io/apimachinery v0.32.3/go.mod h1:GpHVgxoKlTxClKcteaeuF1Ul/lDVb74KpZcxcmLDElE=
537549
k8s.io/client-go v0.32.3 h1:RKPVltzopkSgHS7aS98QdscAgtgah/+zmpAogooIqVU=
538550
k8s.io/client-go v0.32.3/go.mod h1:3v0+3k4IcT9bXTc4V2rt+d2ZPPG700Xy6Oi0Gdl2PaY=
551+
k8s.io/component-base v0.32.3 h1:98WJvvMs3QZ2LYHBzvltFSeJjEx7t5+8s71P7M74u8k=
552+
k8s.io/component-base v0.32.3/go.mod h1:LWi9cR+yPAv7cu2X9rZanTiFKB2kHA+JjmhkKjCZRpI=
553+
k8s.io/cri-api v0.32.3 h1:E8VXbXNn4yAgmuKTeNzg0C1MFSxzTdlHSwUvjuYlPTY=
554+
k8s.io/cri-api v0.32.3/go.mod h1:DCzMuTh2padoinefWME0G678Mc3QFbLMF2vEweGzBAI=
555+
k8s.io/cri-client v0.32.3 h1:+D2ajlFpXsUcr/9ofYcE5kVqVK4Q97wnZHeH80oDEzw=
556+
k8s.io/cri-client v0.32.3/go.mod h1:W1+Z8QsVnLkoGqtJ41B5SRHfQn6/mqGORdfNDl2cEkw=
539557
k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
540558
k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
541559
k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff h1:/usPimJzUKKu+m+TE36gUyGcf03XZEP0ZIKgKj35LS4=

‎reporter/metadata/containermetadata.go‎

Lines changed: 56 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -108,6 +108,7 @@ type containerMetadataProvider struct {
108108
kubernetesClientQueryCount atomic.Uint64
109109
dockerClientQueryCount atomic.Uint64
110110
containerdClientQueryCount atomic.Uint64
111+
criClientQueryCount atomic.Uint64
111112

112113
// the kubernetes node name used to retrieve the pod information.
113114
nodeName string
@@ -128,6 +129,9 @@ type containerMetadataProvider struct {
128129
deferredPID *lru.SyncedLRU[libpf.PID, libpf.Void]
129130

130131
kubernetesNode *corev1.Node
132+
133+
// CRI client for direct container runtime queries
134+
criClient *criClient
131135
}
132136

133137
// hashString is a helper function for containerMetadataCache
@@ -189,6 +193,15 @@ func NewContainerMetadataProvider(ctx context.Context, nodeName string) (Metadat
189193
if err != nil {
190194
return nil, fmt.Errorf("failed to create kubernetes client %v", err)
191195
}
196+
197+
// Try to initialize CRI client for faster pod metadata retrieval
198+
criClient, err := newCRIClient("")
199+
if err != nil {
200+
log.Infof("CRI client not available, will use kube-apiserver: %v", err)
201+
} else {
202+
p.criClient = criClient
203+
log.Infof("Using CRI for pod metadata retrieval (reduced apiserver load)")
204+
}
192205
} else {
193206
log.Infof("Environment variable %s not set", kubernetesServiceHost)
194207
p.containerMetadataCache, err = lru.NewSynced[string, model.LabelSet](
@@ -600,61 +613,82 @@ func (p *containerMetadataProvider) getKubernetesPodMetadata(ctx context.Context
600613
model.LabelSet, error) {
601614
log.Debugf("Get kubernetes pod metadata for container id %v", pidContainerID)
602615

603-
p.kubernetesClientQueryCount.Add(1)
604-
pods, err := p.kubeClientSet.CoreV1().Pods("").List(ctx, v1.ListOptions{
605-
FieldSelector: "spec.nodeName=" + p.nodeName,
606-
})
607-
if err != nil {
608-
return nil, fmt.Errorf("failed to retrieve kubernetes pods, %v", err)
616+
var pods []corev1.Pod
617+
var err error
618+
619+
// Try CRI first if available (fastest, no apiserver load)
620+
if p.criClient != nil {
621+
p.criClientQueryCount.Add(1)
622+
pods, err = p.criClient.listPodsViaCRI(ctx, p.nodeName)
623+
if err != nil {
624+
log.Debugf("Failed to list pods via CRI, falling back to apiserver: %v", err)
625+
pods = nil
626+
}
627+
}
628+
629+
// Fallback to apiserver if CRI failed or not available
630+
if len(pods) == 0 {
631+
p.kubernetesClientQueryCount.Add(1)
632+
633+
// Use resourceVersion=0 to read from apiserver cache instead of etcd
634+
podList, err := p.kubeClientSet.CoreV1().Pods("").List(ctx, v1.ListOptions{
635+
FieldSelector: "spec.nodeName=" + p.nodeName,
636+
ResourceVersion: "0",
637+
})
638+
if err != nil {
639+
return nil, fmt.Errorf("failed to retrieve kubernetes pods, %v", err)
640+
}
641+
pods = podList.Items
609642
}
610643

611-
for j := range pods.Items {
612-
for i := range pods.Items[j].Status.ContainerStatuses {
644+
// Search for the container in pods
645+
for i := range pods {
646+
pod := &pods[i]
647+
648+
for _, cs := range pod.Status.ContainerStatuses {
613649
var containerID string
614-
if pods.Items[j].Status.ContainerStatuses[i].ContainerID == "" {
650+
if cs.ContainerID == "" {
615651
continue
616652
}
617-
if containerID, err = matchContainerID(pods.Items[j].Status.ContainerStatuses[i].ContainerID); err != nil {
653+
if containerID, err = matchContainerID(cs.ContainerID); err != nil {
618654
log.Error(err)
619655
continue
620656
}
621657
if containerID == pidContainerID {
622-
name := pods.Items[j].Status.ContainerStatuses[i].Name
623-
ctr := containerForName(name, pods.Items[j].Spec.Containers)
658+
ctr := containerForName(cs.Name, pod.Spec.Containers)
624659
if ctr == nil {
625-
log.Infof("failed to find kubernetes container in spec named: %s", name)
660+
log.Infof("failed to find kubernetes container in spec named: %s", cs.Name)
626661
continue
627662
}
628663

629-
return p.addPodContainerMetadata(&pods.Items[j], ctr, containerID, false), nil
664+
return p.addPodContainerMetadata(pod, ctr, containerID, false), nil
630665
}
631666
}
632667

633-
for i := range pods.Items[j].Status.InitContainerStatuses {
668+
for _, cs := range pod.Status.InitContainerStatuses {
634669
var containerID string
635-
if pods.Items[j].Status.InitContainerStatuses[i].ContainerID == "" {
670+
if cs.ContainerID == "" {
636671
continue
637672
}
638-
if containerID, err = matchContainerID(pods.Items[j].Status.InitContainerStatuses[i].ContainerID); err != nil {
673+
if containerID, err = matchContainerID(cs.ContainerID); err != nil {
639674
log.Error(err)
640675
continue
641676
}
642677
if containerID == pidContainerID {
643-
name := pods.Items[j].Status.InitContainerStatuses[i].Name
644-
ctr := containerForName(name, pods.Items[j].Spec.InitContainers)
678+
ctr := containerForName(cs.Name, pod.Spec.InitContainers)
645679
if ctr == nil {
646-
log.Infof("failed to find init kubernetes container in spec named: %s", name)
680+
log.Infof("failed to find init kubernetes container in spec named: %s", cs.Name)
647681
continue
648682
}
649683

650-
return p.addPodContainerMetadata(&pods.Items[j], ctr, containerID, false), nil
684+
return p.addPodContainerMetadata(pod, ctr, containerID, false), nil
651685
}
652686
}
653687
}
654688

655689
return nil,
656690
fmt.Errorf("failed to find matching kubernetes pod/container metadata for "+
657-
"containerID '%v' in %d pods", pidContainerID, len(pods.Items))
691+
"containerID '%v' in %d pods", pidContainerID, len(pods))
658692
}
659693

660694
func (p *containerMetadataProvider) getDockerContainerMetadata(ctx context.Context, pidContainerID string) (

0 commit comments

Comments
 (0)