Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

NETOBSERV-2092 Inject drop events in drop fields #587

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
+66 −0
Open

NETOBSERV-2092 Inject drop events in drop fields #587

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions pkg/decode/decode_protobuf.go
View file
Original file line number Diff line number Diff line change
@@ -149,6 +149,14 @@ func RecordToMap(fr *model.Record) config.GenericMap {

if len(fr.NetworkMonitorEventsMD) != 0 {
out["NetworkEvents"] = fr.NetworkMonitorEventsMD
for _, event := range fr.NetworkMonitorEventsMD {
// override drop fields when network event action is dropped
if event["Action"] == "drop" {
out["PktDropBytes"] = fr.Metrics.Bytes
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is not right the same flow could be going through allow ingress and drop egress events ?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could we have the amount of packets / bytes from the event ?

Previously we had these amounts of drops. This is displayed in the plugin + dashboards so it would be very useful to get that back somehow

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

its not a single event same flow can have allow and deny event or 2 allow and 1 deny or any other combo so hard to tell, the drop we had will still work for everything else except netpol and adminnetpol right ?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes of course but the goal here is to be able to make graphs with the amount of bytes / packets / flows denied because of policies.

Copy link
Contributor Author

@jpinsonneau jpinsonneau Feb 27, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's how @jotak managed it for now: netobserv/network-observability-operator#863 + netobserv/flowlogs-pipeline#739
This is showing events rates. I'm not sure it's relevent for the user.

The console plugin could rely on prometheus for these but will not be able to query loki without extra processing

out["PktDropPackets"] = fr.Metrics.Packets
out["PktDropLatestDropCause"] = "OVS_DROP_EXPLICIT"
}
}
}

return out
58 changes: 58 additions & 0 deletions pkg/decode/decode_protobuf_test.go
View file
Original file line number Diff line number Diff line change
@@ -153,3 +153,61 @@ func TestPBFlowToMap(t *testing.T) {
"ZoneId": uint16(100),
}, out)
}

func TestPBFlowToMapDropEvent(t *testing.T) {
someTime := time.Now()
flow := &pbflow.Record{
EthProtocol: 2048,
Bytes: 12,
Packets: 34,
TimeFlowStart: timestamppb.New(someTime),
TimeFlowEnd: timestamppb.New(someTime),
Network: &pbflow.Network{},
Transport: &pbflow.Transport{},
NetworkEventsMetadata: []*pbflow.NetworkEvent{
{
Events: map[string]string{
"Action": "drop",
"Actor": "AdminNetworkPolicy",
"Direction": "ingress",
"Name": "my-policy",
},
},
},
}

out := PBFlowToMap(flow)
assert.NotZero(t, out["TimeReceived"])
delete(out, "TimeReceived")

var nilIntArr []int
var nilStrArr []string

assert.Equal(t, config.GenericMap{
"Bytes": uint64(12),
"SrcAddr": "0.0.0.0",
"DstAddr": "0.0.0.0",
"Dscp": uint8(0),
"DstMac": "00:00:00:00:00:00",
"SrcMac": "00:00:00:00:00:00",
"Packets": uint32(34),
"Proto": uint8(0),
"TimeFlowStartMs": someTime.UnixMilli(),
"TimeFlowEndMs": someTime.UnixMilli(),
"AgentIP": "0.0.0.0",
"PktDropBytes": uint64(12),
"PktDropPackets": uint32(34),
"PktDropLatestDropCause": "OVS_DROP_EXPLICIT",
"Etype": uint16(2048),
"IfDirections": nilIntArr,
"Interfaces": nilStrArr,
"NetworkEvents": []map[string]string{
{
"Action": "drop",
"Actor": "AdminNetworkPolicy",
"Direction": "ingress",
"Name": "my-policy",
},
},
}, out)
}