TechPrufer
Get started
Spotify
Spotify logoSpotify · Feature trail

GKE Node Memory Analysis

1 post · May 2023

What this trail covers

Spotify has developed a new method for analyzing volatile memory on Google Kubernetes Engine (GKE) nodes. This approach combines open-source tools (AVML, dwarf2json, Volatility 3) to create kernel memory dumps and build symbol files, enabling detailed inspection of processes and memory activities. This provides an open-source alternative or complement to commercial monitoring solutions for GKE environments.

All Spotify trails
  1. Analyzing Volatile Memory on a Google Kubernetes Engine NodeThis post details a novel method for performing memory analysis on GKE nodes by leveraging AVML for kernel memory dumps, dwarf2json for building kernel symbol files (using an undocumented API to access vmlinux from COS build IDs), and Volatility 3 for analysis. It demonstrates how to achieve this by using a privileged container to access /proc/kcore and outlines the architecture and steps involved.