{"process_connect":{"process":{"exec_id":"aXAtMTkyLTE2OC04OS02NC51cy13ZXN0LTIuY29tcHV0ZS5pbnRlcm5hbDo1MTk4MjQzMTU2NzYzNzkzOjE2ODM2MTY=","pid":1683616,"uid":100,"cwd":"/home/curl_user","binary":"/usr/bin/curl","arguments":"-sS -m 2 -H \"Metadata: true\" http://169.254.169.254/metadata/instance?api-version=2021-02-01","flags":"execve clone inInitTree","start_time":"2025-11-04T23:04:29.589981246Z","auid":4294967295,"pod":{"namespace":"kube-system","name":"meta-probe","container":{"id":"containerd://143a7d33738521d2efb3f43c005ccb78daa91bd58327efba1d837a2d1da2badf","name":"meta-probe","image":{"id":"docker.io/curlimages/curl@sha256:d9b4541e214bcd85196d6e92e2753ac6d0ea699f0af5741f8c6cccbfcf00ef4b","name":"docker.io/curlimages/curl:8.10.1"},"pid":11,"security_context":{}},"pod_labels":{"run":"meta-probe"},"workload":"meta-probe","workload_kind":"Pod"},"docker":"143a7d33738521d2efb3f43c005ccb7","parent_exec_id":"aXAtMTkyLTE2OC04OS02NC51cy13ZXN0LTIuY29tcHV0ZS5pbnRlcm5hbDo1MTk4MjQzMTM3NDQzMDA5OjE2ODM1OTg=","tid":1683616,"in_init_tree":true},"parent":{"exec_id":"aXAtMTkyLTE2OC04OS02NC51cy13ZXN0LTIuY29tcHV0ZS5pbnRlcm5hbDo1MTk4MjQzMTM3NDQzMDA5OjE2ODM1OTg=","pid":1683598,"uid":100,"cwd":"/home/curl_user","binary":"/bin/sh","arguments":"-c \"\n  set -x\n  # --- GCP style (requires Metadata-Flavor header) ---\n  curl -sS -m 2 -H \"Metadata-Flavor: Google\" \\\n    http://169.254.169.254/computeMetadata/v1/instance/id || true\n\n  # --- AWS IMDSv2 (token then query) ---\n  TOKEN=$(curl -sS -m 2 -X PUT \"http://169.254.169.254/latest/api/token\" \\\n    -H \"X-aws-ec2-metadata-token-ttl-seconds: 30\" || true) ; \\\n  curl -sS -m 2 -H \"X-aws-ec2-metadata-token: $TOKEN\" \\\n    http://169.254.169.254/latest/meta-data/instance-id || true\n\n  # --- Azure IMDS (requires Metadata: true header) ---\n  curl -sS -m 2 -H \"Metadata: true\" \\\n    \"http://169.254.169.254/metadata/instance?api-version=2021-02-01\" || true\n  \"","flags":"execve inInitTree","start_time":"2025-11-04T23:04:29.570660839Z","auid":4294967295,"pod":{"namespace":"kube-system","name":"meta-probe","container":{"id":"containerd://143a7d33738521d2efb3f43c005ccb78daa91bd58327efba1d837a2d1da2badf","name":"meta-probe","image":{"id":"docker.io/curlimages/curl@sha256:d9b4541e214bcd85196d6e92e2753ac6d0ea699f0af5741f8c6cccbfcf00ef4b","name":"docker.io/curlimages/curl:8.10.1"},"pid":1,"security_context":{}},"pod_labels":{"run":"meta-probe"},"workload":"meta-probe","workload_kind":"Pod"},"docker":"143a7d33738521d2efb3f43c005ccb7","parent_exec_id":"aXAtMTkyLTE2OC04OS02NC51cy13ZXN0LTIuY29tcHV0ZS5pbnRlcm5hbDo1MTk4MjQzMTM2MjI4MjM4OjE2ODM1OTg=","tid":1683598,"in_init_tree":true},"source_ip":"192.168.74.108","source_port":35882,"destination_ip":"169.254.169.254","destination_port":80,"sock_cookie":"18446462614959554560","protocol":"TCP"},"node_name":"ip-192-168-89-64.us-west-2.compute.internal","time":"2025-11-04T23:04:29.593956658Z","cluster_name":"k8s-goat-cluster","node_labels":{"alpha.eksctl.io/cluster-name":"k8s-goat-cluster","alpha.eksctl.io/nodegroup-name":"ng-a99d40b1","beta.kubernetes.io/arch":"arm64","beta.kubernetes.io/instance-type":"t4g.medium","beta.kubernetes.io/os":"linux","eks.amazonaws.com/capacityType":"ON_DEMAND","eks.amazonaws.com/nodegroup":"ng-a99d40b1","eks.amazonaws.com/nodegroup-image":"ami-0339636baccc3c183","eks.amazonaws.com/sourceLaunchTemplateId":"lt-0da0169006f2a7c39","eks.amazonaws.com/sourceLaunchTemplateVersion":"1","failure-domain.beta.kubernetes.io/region":"us-west-2","failure-domain.beta.kubernetes.io/zone":"us-west-2c","k8s.io/cloud-provider-aws":"16c540d8ecc5192189b6444fb194814b","kubernetes.io/arch":"arm64","kubernetes.io/hostname":"ip-192-168-89-64.us-west-2.compute.internal","kubernetes.io/os":"linux","node.kubernetes.io/instance-type":"t4g.medium","topology.k8s.aws/zone-id":"usw2-az3","topology.kubernetes.io/region":"us-west-2","topology.kubernetes.io/zone":"us-west-2c"}}
{"process_connect":{"process":{"exec_id":"aXAtMTkyLTE2OC04OS02NC51cy13ZXN0LTIuY29tcHV0ZS5pbnRlcm5hbDo1MTk4MjQzMTUwNzc0MDI0OjE2ODM2MTU=","pid":1683615,"uid":100,"cwd":"/home/curl_user","binary":"/usr/bin/curl","arguments":"-sS -m 2 -H \"X-aws-ec2-metadata-token: AQAEAHIz49ArdkUMCPJOLU689dDd_p75GTMzTW0OIOHoKaor7DD3bQ==\" http://169.254.169.254/latest/meta-data/instance-id","flags":"execve clone inInitTree","start_time":"2025-11-04T23:04:29.583991263Z","auid":4294967295,"pod":{"namespace":"kube-system","name":"meta-probe","container":{"id":"containerd://143a7d33738521d2efb3f43c005ccb78daa91bd58327efba1d837a2d1da2badf","name":"meta-probe","image":{"id":"docker.io/curlimages/curl@sha256:d9b4541e214bcd85196d6e92e2753ac6d0ea699f0af5741f8c6cccbfcf00ef4b","name":"docker.io/curlimages/curl:8.10.1"},"pid":10,"security_context":{}},"pod_labels":{"run":"meta-probe"},"workload":"meta-probe","workload_kind":"Pod"},"docker":"143a7d33738521d2efb3f43c005ccb7","parent_exec_id":"aXAtMTkyLTE2OC04OS02NC51cy13ZXN0LTIuY29tcHV0ZS5pbnRlcm5hbDo1MTk4MjQzMTM3NDQzMDA5OjE2ODM1OTg=","tid":1683615,"in_init_tree":true},"parent":{"exec_id":"aXAtMTkyLTE2OC04OS02NC51cy13ZXN0LTIuY29tcHV0ZS5pbnRlcm5hbDo1MTk4MjQzMTM3NDQzMDA5OjE2ODM1OTg=","pid":1683598,"uid":100,"cwd":"/home/curl_user","binary":"/bin/sh","arguments":"-c \"\n  set -x\n  # --- GCP style (requires Metadata-Flavor header) ---\n  curl -sS -m 2 -H \"Metadata-Flavor: Google\" \\\n    http://169.254.169.254/computeMetadata/v1/instance/id || true\n\n  # --- AWS IMDSv2 (token then query) ---\n  TOKEN=$(curl -sS -m 2 -X PUT \"http://169.254.169.254/latest/api/token\" \\\n    -H \"X-aws-ec2-metadata-token-ttl-seconds: 30\" || true) ; \\\n  curl -sS -m 2 -H \"X-aws-ec2-metadata-token: $TOKEN\" \\\n    http://169.254.169.254/latest/meta-data/instance-id || true\n\n  # --- Azure IMDS (requires Metadata: true header) ---\n  curl -sS -m 2 -H \"Metadata: true\" \\\n    \"http://169.254.169.254/metadata/instance?api-version=2021-02-01\" || true\n  \"","flags":"execve inInitTree","start_time":"2025-11-04T23:04:29.570660839Z","auid":4294967295,"pod":{"namespace":"kube-system","name":"meta-probe","container":{"id":"containerd://143a7d33738521d2efb3f43c005ccb78daa91bd58327efba1d837a2d1da2badf","name":"meta-probe","image":{"id":"docker.io/curlimages/curl@sha256:d9b4541e214bcd85196d6e92e2753ac6d0ea699f0af5741f8c6cccbfcf00ef4b","name":"docker.io/curlimages/curl:8.10.1"},"pid":1,"security_context":{}},"pod_labels":{"run":"meta-probe"},"workload":"meta-probe","workload_kind":"Pod"},"docker":"143a7d33738521d2efb3f43c005ccb7","parent_exec_id":"aXAtMTkyLTE2OC04OS02NC51cy13ZXN0LTIuY29tcHV0ZS5pbnRlcm5hbDo1MTk4MjQzMTM2MjI4MjM4OjE2ODM1OTg=","tid":1683598,"in_init_tree":true},"source_ip":"192.168.74.108","source_port":35872,"destination_ip":"169.254.169.254","destination_port":80,"sock_cookie":"18446462614959583680","protocol":"TCP"},"node_name":"ip-192-168-89-64.us-west-2.compute.internal","time":"2025-11-04T23:04:29.587958749Z","cluster_name":"k8s-goat-cluster","node_labels":{"alpha.eksctl.io/cluster-name":"k8s-goat-cluster","alpha.eksctl.io/nodegroup-name":"ng-a99d40b1","beta.kubernetes.io/arch":"arm64","beta.kubernetes.io/instance-type":"t4g.medium","beta.kubernetes.io/os":"linux","eks.amazonaws.com/capacityType":"ON_DEMAND","eks.amazonaws.com/nodegroup":"ng-a99d40b1","eks.amazonaws.com/nodegroup-image":"ami-0339636baccc3c183","eks.amazonaws.com/sourceLaunchTemplateId":"lt-0da0169006f2a7c39","eks.amazonaws.com/sourceLaunchTemplateVersion":"1","failure-domain.beta.kubernetes.io/region":"us-west-2","failure-domain.beta.kubernetes.io/zone":"us-west-2c","k8s.io/cloud-provider-aws":"16c540d8ecc5192189b6444fb194814b","kubernetes.io/arch":"arm64","kubernetes.io/hostname":"ip-192-168-89-64.us-west-2.compute.internal","kubernetes.io/os":"linux","node.kubernetes.io/instance-type":"t4g.medium","topology.k8s.aws/zone-id":"usw2-az3","topology.kubernetes.io/region":"us-west-2","topology.kubernetes.io/zone":"us-west-2c"}}
{"process_connect":{"process":{"exec_id":"aXAtMTkyLTE2OC04OS02NC51cy13ZXN0LTIuY29tcHV0ZS5pbnRlcm5hbDo1MTk4MjQzMTQ0Njk5NDQ3OjE2ODM2MTQ=","pid":1683614,"uid":100,"cwd":"/home/curl_user","binary":"/usr/bin/curl","arguments":"-sS -m 2 -X PUT http://169.254.169.254/latest/api/token -H \"X-aws-ec2-metadata-token-ttl-seconds: 30\"","flags":"execve clone inInitTree","start_time":"2025-11-04T23:04:29.577916530Z","auid":4294967295,"pod":{"namespace":"kube-system","name":"meta-probe","container":{"id":"containerd://143a7d33738521d2efb3f43c005ccb78daa91bd58327efba1d837a2d1da2badf","name":"meta-probe","image":{"id":"docker.io/curlimages/curl@sha256:d9b4541e214bcd85196d6e92e2753ac6d0ea699f0af5741f8c6cccbfcf00ef4b","name":"docker.io/curlimages/curl:8.10.1"},"pid":9,"security_context":{}},"pod_labels":{"run":"meta-probe"},"workload":"meta-probe","workload_kind":"Pod"},"docker":"143a7d33738521d2efb3f43c005ccb7","parent_exec_id":"aXAtMTkyLTE2OC04OS02NC51cy13ZXN0LTIuY29tcHV0ZS5pbnRlcm5hbDo1MTk4MjQzMTQ0MjIyMDM0OjE2ODM2MTM=","tid":1683614,"in_init_tree":true},"parent":{"exec_id":"aXAtMTkyLTE2OC04OS02NC51cy13ZXN0LTIuY29tcHV0ZS5pbnRlcm5hbDo1MTk4MjQzMTQ0MjIyMDM0OjE2ODM2MTM=","pid":1683613,"uid":100,"cwd":"/home/curl_user","binary":"/bin/sh","arguments":"-c \"\n  set -x\n  # --- GCP style (requires Metadata-Flavor header) ---\n  curl -sS -m 2 -H \"Metadata-Flavor: Google\" \\\n    http://169.254.169.254/computeMetadata/v1/instance/id || true\n\n  # --- AWS IMDSv2 (token then query) ---\n  TOKEN=$(curl -sS -m 2 -X PUT \"http://169.254.169.254/latest/api/token\" \\\n    -H \"X-aws-ec2-metadata-token-ttl-seconds: 30\" || true) ; \\\n  curl -sS -m 2 -H \"X-aws-ec2-metadata-token: $TOKEN\" \\\n    http://169.254.169.254/latest/meta-data/instance-id || true\n\n  # --- Azure IMDS (requires Metadata: true header) ---\n  curl -sS -m 2 -H \"Metadata: true\" \\\n    \"http://169.254.169.254/metadata/instance?api-version=2021-02-01\" || true\n  \"","flags":"execve inInitTree","start_time":"2025-11-04T23:04:29.577440020Z","auid":4294967295,"pod":{"namespace":"kube-system","name":"meta-probe","container":{"id":"containerd://143a7d33738521d2efb3f43c005ccb78daa91bd58327efba1d837a2d1da2badf","name":"meta-probe","image":{"id":"docker.io/curlimages/curl@sha256:d9b4541e214bcd85196d6e92e2753ac6d0ea699f0af5741f8c6cccbfcf00ef4b","name":"docker.io/curlimages/curl:8.10.1"},"pid":8,"security_context":{}},"pod_labels":{"run":"meta-probe"},"workload":"meta-probe","workload_kind":"Pod"},"docker":"143a7d33738521d2efb3f43c005ccb7","parent_exec_id":"aXAtMTkyLTE2OC04OS02NC51cy13ZXN0LTIuY29tcHV0ZS5pbnRlcm5hbDo1MTk4MjQzMTM3NDQzMDA5OjE2ODM1OTg=","refcnt":1,"tid":1683613,"in_init_tree":true},"source_ip":"192.168.74.108","source_port":35860,"destination_ip":"169.254.169.254","destination_port":80,"sock_cookie":"18446462615607961856","protocol":"TCP"},"node_name":"ip-192-168-89-64.us-west-2.compute.internal","time":"2025-11-04T23:04:29.581721598Z","cluster_name":"k8s-goat-cluster","node_labels":{"alpha.eksctl.io/cluster-name":"k8s-goat-cluster","alpha.eksctl.io/nodegroup-name":"ng-a99d40b1","beta.kubernetes.io/arch":"arm64","beta.kubernetes.io/instance-type":"t4g.medium","beta.kubernetes.io/os":"linux","eks.amazonaws.com/capacityType":"ON_DEMAND","eks.amazonaws.com/nodegroup":"ng-a99d40b1","eks.amazonaws.com/nodegroup-image":"ami-0339636baccc3c183","eks.amazonaws.com/sourceLaunchTemplateId":"lt-0da0169006f2a7c39","eks.amazonaws.com/sourceLaunchTemplateVersion":"1","failure-domain.beta.kubernetes.io/region":"us-west-2","failure-domain.beta.kubernetes.io/zone":"us-west-2c","k8s.io/cloud-provider-aws":"16c540d8ecc5192189b6444fb194814b","kubernetes.io/arch":"arm64","kubernetes.io/hostname":"ip-192-168-89-64.us-west-2.compute.internal","kubernetes.io/os":"linux","node.kubernetes.io/instance-type":"t4g.medium","topology.k8s.aws/zone-id":"usw2-az3","topology.kubernetes.io/region":"us-west-2","topology.kubernetes.io/zone":"us-west-2c"}}
{"process_connect":{"process":{"exec_id":"aXAtMTkyLTE2OC04OS02NC51cy13ZXN0LTIuY29tcHV0ZS5pbnRlcm5hbDo1MTk4MjQzMTM4MTk1NjYyOjE2ODM2MTI=","pid":1683612,"uid":100,"cwd":"/home/curl_user","binary":"/usr/bin/curl","arguments":"-sS -m 2 -H \"Metadata-Flavor: Google\" http://169.254.169.254/computeMetadata/v1/instance/id","flags":"execve clone inInitTree","start_time":"2025-11-04T23:04:29.571413016Z","auid":4294967295,"pod":{"namespace":"kube-system","name":"meta-probe","container":{"id":"containerd://143a7d33738521d2efb3f43c005ccb78daa91bd58327efba1d837a2d1da2badf","name":"meta-probe","image":{"id":"docker.io/curlimages/curl@sha256:d9b4541e214bcd85196d6e92e2753ac6d0ea699f0af5741f8c6cccbfcf00ef4b","name":"docker.io/curlimages/curl:8.10.1"},"pid":7,"security_context":{}},"pod_labels":{"run":"meta-probe"},"workload":"meta-probe","workload_kind":"Pod"},"docker":"143a7d33738521d2efb3f43c005ccb7","parent_exec_id":"aXAtMTkyLTE2OC04OS02NC51cy13ZXN0LTIuY29tcHV0ZS5pbnRlcm5hbDo1MTk4MjQzMTM3NDQzMDA5OjE2ODM1OTg=","tid":1683612,"in_init_tree":true},"parent":{"exec_id":"aXAtMTkyLTE2OC04OS02NC51cy13ZXN0LTIuY29tcHV0ZS5pbnRlcm5hbDo1MTk4MjQzMTM3NDQzMDA5OjE2ODM1OTg=","pid":1683598,"uid":100,"cwd":"/home/curl_user","binary":"/bin/sh","arguments":"-c \"\n  set -x\n  # --- GCP style (requires Metadata-Flavor header) ---\n  curl -sS -m 2 -H \"Metadata-Flavor: Google\" \\\n    http://169.254.169.254/computeMetadata/v1/instance/id || true\n\n  # --- AWS IMDSv2 (token then query) ---\n  TOKEN=$(curl -sS -m 2 -X PUT \"http://169.254.169.254/latest/api/token\" \\\n    -H \"X-aws-ec2-metadata-token-ttl-seconds: 30\" || true) ; \\\n  curl -sS -m 2 -H \"X-aws-ec2-metadata-token: $TOKEN\" \\\n    http://169.254.169.254/latest/meta-data/instance-id || true\n\n  # --- Azure IMDS (requires Metadata: true header) ---\n  curl -sS -m 2 -H \"Metadata: true\" \\\n    \"http://169.254.169.254/metadata/instance?api-version=2021-02-01\" || true\n  \"","flags":"execve inInitTree","start_time":"2025-11-04T23:04:29.570660839Z","auid":4294967295,"pod":{"namespace":"kube-system","name":"meta-probe","container":{"id":"containerd://143a7d33738521d2efb3f43c005ccb78daa91bd58327efba1d837a2d1da2badf","name":"meta-probe","image":{"id":"docker.io/curlimages/curl@sha256:d9b4541e214bcd85196d6e92e2753ac6d0ea699f0af5741f8c6cccbfcf00ef4b","name":"docker.io/curlimages/curl:8.10.1"},"pid":1,"security_context":{}},"pod_labels":{"run":"meta-probe"},"workload":"meta-probe","workload_kind":"Pod"},"docker":"143a7d33738521d2efb3f43c005ccb7","parent_exec_id":"aXAtMTkyLTE2OC04OS02NC51cy13ZXN0LTIuY29tcHV0ZS5pbnRlcm5hbDo1MTk4MjQzMTM2MjI4MjM4OjE2ODM1OTg=","tid":1683598,"in_init_tree":true},"source_ip":"192.168.74.108","source_port":35852,"destination_ip":"169.254.169.254","destination_port":80,"sock_cookie":"18446462615607961856","protocol":"TCP"},"node_name":"ip-192-168-89-64.us-west-2.compute.internal","time":"2025-11-04T23:04:29.575896447Z","cluster_name":"k8s-goat-cluster","node_labels":{"alpha.eksctl.io/cluster-name":"k8s-goat-cluster","alpha.eksctl.io/nodegroup-name":"ng-a99d40b1","beta.kubernetes.io/arch":"arm64","beta.kubernetes.io/instance-type":"t4g.medium","beta.kubernetes.io/os":"linux","eks.amazonaws.com/capacityType":"ON_DEMAND","eks.amazonaws.com/nodegroup":"ng-a99d40b1","eks.amazonaws.com/nodegroup-image":"ami-0339636baccc3c183","eks.amazonaws.com/sourceLaunchTemplateId":"lt-0da0169006f2a7c39","eks.amazonaws.com/sourceLaunchTemplateVersion":"1","failure-domain.beta.kubernetes.io/region":"us-west-2","failure-domain.beta.kubernetes.io/zone":"us-west-2c","k8s.io/cloud-provider-aws":"16c540d8ecc5192189b6444fb194814b","kubernetes.io/arch":"arm64","kubernetes.io/hostname":"ip-192-168-89-64.us-west-2.compute.internal","kubernetes.io/os":"linux","node.kubernetes.io/instance-type":"t4g.medium","topology.k8s.aws/zone-id":"usw2-az3","topology.kubernetes.io/region":"us-west-2","topology.kubernetes.io/zone":"us-west-2c"}}