Running Kubeshark at a steady state
Running Kubeshark at a steady state, without using the Dashboard should require very little resources in terms of CPU and memory. In this state, Kubeshark captures all traffic and save it to the Worker nodes local storage.
Using the Dashboard
Depending on the amount of traffic and the various queries perform in the dashboard, the dashboard can consume significant efforts.
In any event, Workers will not consume more resources than the provided limits.
If the traffic workload is high, you can assign dedicated resources that will be used only when you conduct your investigation and will offload .
The following elements impact performance and resource consumption:
- Using the dashboard
- The KFL
Running Kubeshark without the dashboard
Using the Dashboard
|ALLOC||Bytes of allocated heap objects including all reachable objects, as well as unreachable objects that the garbage collector has not yet freed. Specifically, ALLOC increases as heap objects are allocated and decreases as the heap is swept and unreachable objects are freed. Sweeping occurs incrementally between GC cycles, so these two processes occur simultaneously, and as a result ALLOC tends to change smoothly.|
|RSS||Resident set size. The portion of memory occupied by a process that is held in main memory (RAM).|
|CPU||100 = 1 CPU|
|PROCESSED BYTES||Amount of bytes processed over period of time|
|TOTAL PACKETS||Amount of packets processed over period of time|
|REASSEMBLED||Amount of messages that were successfully reassembled over period of time|
|PACKETS RECEIVED||Amount of packets received over period of time|
|PACKETS DROPPEDs||Amount of packets dropped over period of time|
(1) Medium load test, using two workers of size c5.xlarge, over a short period of time, using AF_PACKET with no dashboard
|#||Period||Test Type||Dashboard||Library||ALLOC||CPU||PROCESSED BYTES||TOTAL PACKETS||REASSEMBLED||PACKETS RECEIVED||PACKETS DROPPED|
Scenarios 1-2 did not consider whether the dashboard was open or not.
(1) Small load testing over a short period of time, using AF_PACKET and KFL to focus only on two pods: no reassembly
(2) Small load testing over a short period of time, using AF_PACKET and KFL to focus only on two pods: with reassembly
(3) Stress testing over a long period of time, using AF_PACKET and KFL to focus only on two pods
|Scenario||Period||Test Type||Library||ALLOC||RSS||CPU||PROCESSED BYTES||TOTAL PACKETS||REASSEMBLED||PACKETS RECEIVED||PACKETS DROPPED|