Kubernetes v1.28 SidecarContainers — An API for sidecar containers

Philippe Bogaerts
4 min readAug 16, 2023

Introduction

As per Kubernetes documentation , K8S now allows you to specify a restartPolicy for init containers which is independent of the Pod and other init containers.

This features is available starting with Kubernetes 1.28 in alpha through a feature gate named SidecarContainers. Alpha features are NOT enabled by default.

Through the years, I have been researching different ways to capture traffic in pods (see references). So here we go again!

Maintained and updated here:
https://github.com/xxradar/tcpdump-initContainers-always

How to enable the feature gate

I compiled a small step-by-step install for a self-managed #k8s setup

  • Create 3 ubuntu nodes
  • On the control-plane node:
curl https://raw.githubusercontent.com/xxradar/k8s-calico-oss-install-containerd/main/setup-cluster-config.sh | bash
  • On the worker nodes:
curl https://raw.githubusercontent.com/xxradar/install_k8s_ubuntu/main/setup_node_latest.sh | bash
  • Run the join command on the worker nodes
    (copy/paste output from control-plane node)

--

--

Philippe Bogaerts

#BruCON co-founder, #OWASP supporter, Application Delivery and Web Application Security, #Kubernetes and #container, #pentesting enthousiast, BBQ & cocktails !!