Skip to content

Commit 0dfcb55

Browse files
skrthomasskrthomas
committed
OSDOCS-10877: Virtualization in Network Observability
1 parent 66ad93a commit 0dfcb55

File tree

4 files changed

+114
-0
lines changed

4 files changed

+114
-0
lines changed

‎_topic_maps/_topic_map.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2922,6 +2922,8 @@ Topics:
29222922
File: network-observability-operator-monitoring
29232923
- Name: Scheduling resources
29242924
File: network-observability-scheduling-resources
2925+
- Name: Secondary networks
2926+
File: network-observability-secondary-networks
29252927
- Name: Network Observability CLI
29262928
Dir: netobserv_cli
29272929
Topics:

‎modules/network-observability-virtualization-configuration.adoc‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * network_observability/configuring-operator.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="network-observability-virtualization-config_{context}"]
7+
= Configuring virtual machine (VM) secondary network interfaces for Network Observability
8+
You can observe networking patterns on an OpenShift Virtualization setup by identifying eBPF-enriched network flows coming from VMs that are connected to secondary networks, such as through Open Virtual Network (OVN)-Kubernetes, or SR-IOV CNI plugins. Network flows coming from VMs that are connected to the default internal pod network are automatically captured by Network Observability.
9+
10+
.Procedure
11+
. Get information about the virtual machine launcher pod by running the following command. This information is used in Step 2:
12+
+
13+
[source,terminal]
14+
----
15+
$ oc get pod virt-launcher-<vm_name>-<suffix> -n <namespace> -o yaml
16+
----
17+
+
18+
[source,yaml]
19+
----
20+
$ oc get pod virt-launcher-fedora-aqua-fowl-13-zr2x9 -n my-vms -o yaml
21+
apiVersion: v1
22+
kind: Pod
23+
metadata:
24+
annotations:
25+
k8s.v1.cni.cncf.io/network-status: |-
26+
[{
27+
"name": "ovn-kubernetes",
28+
"interface": "eth0",
29+
"ips": [
30+
"10.129.2.39"
31+
],
32+
"mac": "0a:58:0a:81:02:27",
33+
"default": true,
34+
"dns": {}
35+
},
36+
{
37+
"name": "my-vms/l2-network", <1>
38+
"interface": "podc0f69e19ba2", <2>
39+
"ips": [
40+
"10.10.10.15"
41+
], <3>
42+
"mac": "02:fb:f8:00:00:12", <4>
43+
"dns": {}
44+
}]
45+
name: virt-launcher-fedora-aqua-fowl-13-zr2x9
46+
namespace: my-vms
47+
spec:
48+
...
49+
status:
50+
...
51+
----
52+
<1> The name of the secondary network.
53+
<2> The network interface name of the secondary network.
54+
<3> The list of IPs used by the secondary network.
55+
<4> The MAC address used for secondary network.
56+
57+
. Configure `FlowCollector` based on the information you found from the additional network investigation.
58+
+
59+
[source,yaml]
60+
----
61+
apiVersion: flows.netobserv.io/v1beta2
62+
kind: FlowCollector
63+
metadata:
64+
name: cluster
65+
spec:
66+
# ...
67+
ebpf:
68+
privileged: true <1>
69+
processor:
70+
advanced:
71+
secondaryNetworks:
72+
- index: <2>
73+
- Interface
74+
- MAC
75+
- IP
76+
name: my-vms/l2-network <3>
77+
# ...
78+
----
79+
<1> Ensure that the ebpf agent is in `privileged` mode so that the flows are enriched according to the MAC address.
80+
<2> Define the fields to use for indexing the virtual machine launcher pods. These should form a unique identifier across the cluster according to the fields available in `k8s.v1.cni.cncf.io/network-status` annotation.
81+
+
82+
[IMPORTANT]
83+
====
84+
Not all secondary networks have all index fields. Ensure that only the fields that are annotated in your secondary interface are listed here and removed if not annotated.
85+
====
86+
<3> Specify the name of the network found in `k8s.v1.cni.cncf.io/network-status` annotation. Usually <namespace>/<network_attachement_definition_name>.
87+
88+
. Ping from one VM to another for secondary interface IP.
89+
90+
.Verification
91+
. Navigate to Netflow traffic page, Filter by *Source* IP using your virtual machine IP found in `k8s.v1.cni.cncf.io/network-status` annotation.
92+
. View both *Source* and *Destination* fields should enriched identifying VM launcher Pods and VM instance as Owners

‎observability/network_observability/configuring-operator.adoc‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,5 +29,7 @@ include::modules/network-observability-SRIOV-configuration.adoc[leveloffset=+1]
2929
.Additional resources
3030
For more information about creating the `SriovNetwork` custom resource, see xref:../../networking/hardware_networks/configuring-sriov-device.adoc#cnf-creating-an-additional-sriov-network-with-vrf-plug-in_configuring-sriov-device[Creating an additional SR-IOV network attachment with the CNI VRF plugin].
3131
32+
include::modules/network-observability-virtualization-configuration.adoc[leveloffset=+1]
33+
3234
include::modules/network-observability-resource-recommendations.adoc[leveloffset=+1]
3335
include::modules/network-observability-resources-table.adoc[leveloffset=+2]

‎observability/network_observability/network-observability-secondary-networks.adoc‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
:_mod-docs-content-type: ASSEMBLY
2+
[id="network-observability-secondary-networks"]
3+
= Secondary networks
4+
include::_attributes/common-attributes.adoc[]
5+
:context: secondary_networks
6+
7+
toc::[]
8+
9+
.Prerequisites
10+
* Access to an {product-title} cluster with an additional network interface, such as a secondary interface or an L2 network.
11+
* The `spec.agent.ebpf.privileged` field must be set to `true`.
12+
13+
include::modules/network-observability-SRIOV-configuration.adoc[leveloffset=+1]
14+
[role="_additional-resources"]
15+
.Additional resources
16+
For more information about creating the `SriovNetwork` custom resource, see xref:../../networking/hardware_networks/configuring-sriov-device.adoc#cnf-creating-an-additional-sriov-network-with-vrf-plug-in_configuring-sriov-device[Creating an additional SR-IOV network attachment with the CNI VRF plugin].
17+
18+
include::modules/network-observability-virtualization-configuration.adoc[leveloffset=+1]

0 commit comments

Comments
 (0)