Project: Inspektor Gadget (Observability and Analysis / Observability)
File: install-kubernetes.md

title: Installing on Kubernetes weight: 10 description: > How to install Inspektor Gadget on Kubernetes <!-- toc --> - - - - - - - <!-- /toc --> Inspektor Gadget is composed of a `kubectl` plugin executed in the user's system and a DaemonSet deployed in the cluster. Choose one way to install the Inspektor Gadget `kubectl` plugin. is the recommended way to install `kubectl gadget`. You can follow the to install it and then install `kubectl gadget` by executing the following commands. ```bash $ kubectl krew install gadget $ kubectl gadget --help ``` Download the asset for a given release and platform from the , uncompress and move the `kubectl-gadget` executable to your `PATH`. ```bash $ IGVERSION=$(curl -s https://api.github.com/repos/inspektor-gadget/inspektor-gadget/releases/latest | jq -r .tagname) $ IG_ARCH=amd64 $ curl -sL https://github.com/inspektor-gadget/inspektor-gadget/releases/download/${IGVERSION}/kubectl-gadget-linux-${IGARCH}-${IG_VERSION}.tar.gz | sudo tar -C /usr/local/bin -xzf - kubectl-gadget $ kubectl gadget version ``` To build Inspektor Gadget from source, you'll need to have a Golang version 1.22 or higher installed. ```bash $ git clone https://github.com/inspektor-gadget/inspektor-gadget.git $ cd inspektor-gadget $ make kubectl-gadget-linux-amd64 $ sudo cp kubectl-gadget-linux-amd64 /usr/local/bin/kubectl-gadget $ kubectl gadget version ``` ```bash $ kubectl gadget deploy ``` This will deploy the gadget DaemonSet along with its RBAC rules. If you wish to install an alternative gadget image, you could use the following commands: ```bash $ kubectl gadget deploy --image=ghcr.io/myfork/inspektor-gadget:tag ``` The `--node-selector` flag accepts a [label selector](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors) that defines the nodes where Inspektor Gadget will be deloyed to: ```bash $ kubectl gadget deploy --node-selector kubernetes.io/hostname=minikube-m02 $ kubectl gadget deploy --node-selector kubernetes.io/hostname!=minikube $ kubectl gadget deploy --node-selector 'kubernetes.io/hostname in (minikube, minikube-m03)' ``` By default Inspektor Gadget is deployed to the namespace `gadget`. This can be changed with the `--gadget-namespace` flag. When using gadgets (e.g. `kubectl gadget trace exec`) the deployed namespace is discovered automatically and no additional flags are needed during the usage. For `undeploy` the `--gadget-namespace` flag is mandatory. Inspektor Gadget needs to detect when containers are started and stopped. The different supported modes can be set by using the `hook-mode` option: `auto`(default): Inspektor Gadget will try to find the best option based on the system it is running on. `crio`: Use the [CRIO hooks](https://github.com/containers/podman/blob/v3.4.4/pkg/hooks/docs/oci-hooks.5.md) support. Inspektor Gadget installs the required hooks in `/etc/containers/oci/hooks.d`, be sure that path is part of the `hooks_dir` option on . If `hooks_dir` is not declared at all, that path is considered by default. `podinformer`: Use a Kubernetes controller to get information about new pods. This option is racy and the first events produced by a container could be lost. This mode is selected when `auto` is used and the above modes are not available. `nri`: Use the . It requires containerd v1.5 and it's not considered when `auto` is used. `fanotify`: Uses the Linux API. It works with both runc and crun. It requires to run in the host pid namespace

`fanotify+ebpf`: Uses the Linux API and an eBPF module. It works with both runc and crun. It works regardless of the pid namespace configuration. By default, Inspektor Gadget runs as unconfined because it needs to write to different files under `/sys`. It is nonetheless possible to deploy Inspektor Gadget using a custom AppArmor profile with the `--apparmor-profile` flag: ```bash $ kubectl gadget deploy --apparmor-profile 'localhost/inspektor-gadget-profile' ``` Note that, the AppArmor profile should already exists in the cluster to be used. By default, Inspektor Gadget syscalls are not restricted. If the seccomp profile operator is , you can use the `--seccomp-profile` flag to deploy Inspektor Gadget with a custom seccomp profile. Note that, the profile should follow the : ```bash $ cat 'gadget-profile.yaml' apiVersion: security-profiles-operator.x-k8s.io/v1beta1 kind: SeccompProfile metadata: namespace: gadget name: profile spec: defaultAction: SCMPACTERRNO syscalls: action: SCMPACTALLOW names: accept4 access arch_prctl bind ... $ kubectl gadget deploy --seccomp-profile 'gadget-profile.yaml' ``` This section explains the additional steps that are required to run Inspektor Gadget in some platforms. You can deploy Inspektor Gadget in `minikube` in different ways: Manually, using the `kubectl gadget deploy` command as described above. Using the available since . We recommend to use the `docker` driver: ```bash $ minikube start --driver=docker ``` But can also use the `kvm2` one: ```bash $ minikube start --driver=kvm2 ``` The following command will remove all the resources created by Inspektor Gadget from the cluster: ```bash $ kubectl gadget undeploy ``` Inspektor Gadget requires the kubectl-gadget plugin and the DaemonSet deployed on the cluster to be the exact same version. Even if this is possible that different versions work well together, we don't provide any guarantee in those cases. We'll visit this policy again once we approach to the v1.0 release. The tool can be built and installed independently. The result is a single binary (statically linked) that can be copied to a Kubernetes node or any host to trace its containers. It is possible to download the asset for a given release and platform from the . For instance, to download the latest release for linux-amd64: ```bash $ IGVERSION=$(curl -s https://api.github.com/repos/inspektor-gadget/inspektor-gadget/releases/latest | jq -r .tagname) $ IG_ARCH=amd64 $ curl -sL https://github.com/inspektor-gadget/inspektor-gadget/releases/download/${IGVERSION}/ig-linux-${IGARCH}-${IG_VERSION}.tar.gz | sudo tar -C /usr/local/bin -xzf - ig $ ig version ``` `ig` is built using a Docker container relying on , so you don't have to worry about installing dependencies: ```bash $ make ig $ sudo cp ig /usr/local/bin/ ``` Inspektor Gadget has some experimental features disabled by default. Users can enable those features, however they don't provide any stability and could be removed at any time. `kubectl gadget deploy` provides an `--experimental` flag to enabled them. ```bash $ kubectl gadget deploy --experimental $ kubectl logs -n gadget $PODNAME -f | grep -i experimental ... time="2023-06-15T15:20:03Z" level=info msg="Experimental features enabled" ... $ kubectl gadget trace exec INFO[0000] Experimental features enabled ... ```