<p>I want to build a python script that accesses a kubernetes worker node, lists the network interfaces and captures the traffic of the choosen interface (with tcpdump for exemple) and then store the pcap file somewhere on the master node.</p>
<p>I want to know if it is possible to access a worker node from my master node without ssh? (maybe with a direct k8s-apiserver call ?)
If ssh is the only way to access the worker node, how can i make a connection without entring the worker's password (for authentification).</p>
<p>Or maybe there is another way to do this ?</p>

Youva
<p>One way to connect nodes, when SSH isn't an option, would be to start some privileged container, that would access your nodes filesystem, disabling pid namespace isolation.</p>
<p>Say I have some node &quot;infra1&quot;</p>
<pre><code>$&gt; kubectl get nodes
infra1     Ready         infra         728d   v1.21.6
</code></pre>
<p>I can get in using:</p>
<pre><code>$ kubectl debug node/infra1 -it --image=busybox
Creating debugging pod node-debugger-infra1-s46g6 with container debugger on node infra1.
If you don't see a command prompt, try pressing enter.
/ #
/ # chroot /host
root@infra1:/# 
root@infra1:/# crictl ps | head -2
CONTAINER           IMAGE               CREATED             STATE               
NAME                       ATTEMPT             POD ID
a36863efe2a2e       3fb5cabb64693       4 minutes ago       Running             
</code></pre>
<p>The <code>/host</code> being a &quot;volume&quot;, sharing my host filesystem with that debug container. Using chroot, you're now working from your node runtime.</p>
<pre><code>$ k get pods 
NAME                                      READY   STATUS    RESTARTS   AGE
node-debugger-infra1-g5nwg                0/1     Error     0          71s
node-debugger-infra1-s46g6                1/1     Running   0          55s
</code></pre>
<p>In practice, this is done creating a Pod, such as the following:</p>
<pre><code>apiVersion: v1
kind: Pod
metadata:
  annotations:
    kubernetes.io/psp: hostaccess
  name: node-debugger-infra1-s46g6
  namespace: default
spec:
  containers:
  - image: busybox
    ...
    volumeMounts:
    - mountPath: /host
      name: host-root
      ...
  dnsPolicy: ClusterFirst
  enableServiceLinks: true
  hostIPC: true
  hostNetwork: true
  hostPID: true
  nodeName: infra1
  nodeSelector:
    kubernetes.io/os: linux
  preemptionPolicy: PreemptLowerPriority
  priority: 0
  restartPolicy: Never
  schedulerName: default-scheduler
  securityContext: {}
  serviceAccount: default
  serviceAccountName: default
  terminationGracePeriodSeconds: 30
  tolerations:
  - operator: Exists
  volumes:
  - hostPath:
      path: /
      type: &quot;&quot;
    name: host-root
  ...
</code></pre>
<hr />
<p>Answering your follow-up question, regarding caliXXX interfaces. Those are specific to calico SDN, although the same remarks may apply to other implementations: there's no easy way to resolve pods IPs from those.</p>
<p>We can however inspect pods configuration, figuring out which interface they use:</p>
<pre><code># crictl pods
...
b693b9ff6487c       3 hours ago         Ready               controller-6b78bff7d9-5b7vr                 metallb-system          2                   (default)

# crictl inspectp b693b9ff6487c | jq '.info.cniResult'
{
  &quot;Interfaces&quot;: {
    &quot;cali488d4aeb0e6&quot;: {
      &quot;IPConfigs&quot;: null,
      &quot;Mac&quot;: &quot;&quot;,
      &quot;Sandbox&quot;: &quot;&quot;
    },
    &quot;eth0&quot;: {
      &quot;IPConfigs&quot;: [
        {
          &quot;IP&quot;: &quot;10.233.105.55&quot;,
          &quot;Gateway&quot;: &quot;&quot;
        }
      ],
      &quot;Mac&quot;: &quot;&quot;,
      &quot;Sandbox&quot;: &quot;&quot;
    },
    &quot;lo&quot;: {
      &quot;IPConfigs&quot;: [
        {
          &quot;IP&quot;: &quot;127.0.0.1&quot;,
          &quot;Gateway&quot;: &quot;&quot;
        },
        {
          &quot;IP&quot;: &quot;::1&quot;,
          &quot;Gateway&quot;: &quot;&quot;
        }
      ],
      &quot;Mac&quot;: &quot;00:00:00:00:00:00&quot;,
      &quot;Sandbox&quot;: &quot;/var/run/netns/cni-55322514-e37a-2913-022a-9f7488df8ca5&quot;
    }
  },
  &quot;DNS&quot;: [
    {},
    {}
  ],
  &quot;Routes&quot;: null
}
</code></pre>
<p>Then, resolving the interface name for a given IP, we could so something like:</p>
<pre><code># MATCH_IP=&quot;10\.233\.105\.55&quot;
# crictl pods | awk '/Ready/{print $1}' | while read pod
    do
        crictl inspectp $pod | grep $MATCH_IP &gt;/dev/null 2&gt;&amp;1 || continue
        echo found pod $pod
        crictl inspectp $pod \
           | jq '.info.cniResult.Interfaces | with_entries(select(.key|match(&quot;cali&quot;))) | to_entries[] | .key'
        break
    done
found pod b693b9ff6487c
&quot;cali488d4aeb0e6&quot;
</code></pre>
