Skip to content

Commit 6a414b3

Browse files
skrthomasskrthomas
committed
OSDOCS-10877: Virtualization in Network Observability
1 parent 66ad93a commit 6a414b3

7 files changed

+122
-9
lines changed

‎_topic_maps/_topic_map.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2922,6 +2922,8 @@ Topics:
29222922
File: network-observability-operator-monitoring
29232923
- Name: Scheduling resources
29242924
File: network-observability-scheduling-resources
2925+
- Name: Secondary networks
2926+
File: network-observability-secondary-networks
29252927
- Name: Network Observability CLI
29262928
Dir: netobserv_cli
29272929
Topics:

‎modules/network-observability-SRIOV-configuration.adoc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
// Module included in the following assemblies:
22
//
3-
// * network_observability/configuring-operator.adoc
3+
// * observability/network_observability/network-observability-secondary-networks.adoc
44

55
:_mod-docs-content-type: PROCEDURE
66
[id="network-observability-SR-IOV-config_{context}"]

‎modules/network-observability-virtualization-configuration.adoc‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * observability/network_observability/network-observability-secondary-networks.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="network-observability-virtualization-config_{context}"]
7+
= Configuring virtual machine (VM) secondary network interfaces for Network Observability
8+
You can observe networking patterns on an OpenShift Virtualization setup by identifying eBPF-enriched network flows coming from VMs that are connected to secondary networks, such as through Open Virtual Network (OVN)-Kubernetes, or SR-IOV CNI plugins. Network flows coming from VMs that are connected to the default internal pod network are automatically captured by Network Observability.
9+
10+
.Procedure
11+
. Get information about the virtual machine launcher pod by running the following command. This information is used in Step 2:
12+
+
13+
[source,terminal]
14+
----
15+
$ oc get pod virt-launcher-<vm_name>-<suffix> -n <namespace> -o yaml
16+
----
17+
+
18+
[source,yaml]
19+
----
20+
$ oc get pod virt-launcher-fedora-aqua-fowl-13-zr2x9 -n my-vms -o yaml
21+
apiVersion: v1
22+
kind: Pod
23+
metadata:
24+
annotations:
25+
k8s.v1.cni.cncf.io/network-status: |-
26+
[{
27+
"name": "ovn-kubernetes",
28+
"interface": "eth0",
29+
"ips": [
30+
"10.129.2.39"
31+
],
32+
"mac": "0a:58:0a:81:02:27",
33+
"default": true,
34+
"dns": {}
35+
},
36+
{
37+
"name": "my-vms/l2-network", <1>
38+
"interface": "podc0f69e19ba2", <2>
39+
"ips": [
40+
"10.10.10.15"
41+
], <3>
42+
"mac": "02:fb:f8:00:00:12", <4>
43+
"dns": {}
44+
}]
45+
name: virt-launcher-fedora-aqua-fowl-13-zr2x9
46+
namespace: my-vms
47+
spec:
48+
...
49+
status:
50+
...
51+
----
52+
<1> The name of the secondary network.
53+
<2> The network interface name of the secondary network.
54+
<3> The list of IPs used by the secondary network.
55+
<4> The MAC address used for secondary network.
56+
57+
. In the web console, navigate to *Operators* -> *Installed Operators*.
58+
. Under the *Provided APIs* heading for the *NetObserv Operator*, select *Flow Collector*.
59+
. Select *cluster* and then select the *YAML* tab.
60+
. Configure `FlowCollector` based on the information you found from the additional network investigation.
61+
+
62+
[source,yaml]
63+
----
64+
apiVersion: flows.netobserv.io/v1beta2
65+
kind: FlowCollector
66+
metadata:
67+
name: cluster
68+
spec:
69+
# ...
70+
ebpf:
71+
privileged: true <1>
72+
processor:
73+
advanced:
74+
secondaryNetworks:
75+
- index: <2>
76+
- Interface
77+
- MAC <3>
78+
- IP <4>
79+
name: my-vms/l2-network <5>
80+
# ...
81+
----
82+
<.> Ensure that the ebpf agent is in `privileged` mode so that the flows are enriched according to the MAC address.
83+
<.> Define the fields to use for indexing the virtual machine launcher pods. These should form a unique identifier across the cluster according to the fields available in `k8s.v1.cni.cncf.io/network-status` annotation. Not all secondary networks have all the index fields in this example. Ensure that only the fields that are annotated in your secondary interface are listed here and if they are not annotated, they are removed.
84+
<.> If your additional network information has a MAC address, specify it here.
85+
<.> If your additional network information has an IP address, specify it here.
86+
<.> Specify the name of the network found in `k8s.v1.cni.cncf.io/network-status` annotation. Usually <namespace>/<network_attachement_definition_name>.
87+
88+
. Ping from one VM to another for secondary interface IP.
89+
90+
.Verification
91+
. Navigate to the *Network Traffic* page.
92+
. Filter by *Source* IP using your virtual machine IP found in `k8s.v1.cni.cncf.io/network-status` annotation.
93+
. View both *Source* and *Destination* fields should enriched identifying VM launcher Pods and VM instance as Owners

‎observability/network_observability/configuring-operator.adoc‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -24,10 +24,5 @@ For more information about specifying flow format, see xref:../../observability/
2424

2525
include::modules/network-observability-configuring-FLP-sampling.adoc[leveloffset=+1]
2626
include::modules/network-observability-configuring-quickfilters-flowcollector.adoc[leveloffset=+1]
27-
include::modules/network-observability-SRIOV-configuration.adoc[leveloffset=+1]
28-
[role="_additional-resources"]
29-
.Additional resources
30-
For more information about creating the `SriovNetwork` custom resource, see xref:../../networking/hardware_networks/configuring-sriov-device.adoc#cnf-creating-an-additional-sriov-network-with-vrf-plug-in_configuring-sriov-device[Creating an additional SR-IOV network attachment with the CNI VRF plugin].
31-
3227
include::modules/network-observability-resource-recommendations.adoc[leveloffset=+1]
3328
include::modules/network-observability-resources-table.adoc[leveloffset=+2]

‎observability/network_observability/installing-operators.adoc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ Once you create the `FlowCollector` instance, you can reconfigure it, but the po
4343
4444
* xref:../../observability/network_observability/configuring-operator.adoc#network-observability-flowcollector-kafka-config_network_observability[Configuring the Flow Collector resource with Kafka]
4545
* xref:../../observability/network_observability/configuring-operator.adoc#network-observability-enriched-flows_network_observability[Export enriched network flow data to Kafka or IPFIX]
46-
* xref:../../observability/network_observability/configuring-operator.adoc#network-observability-SR-IOV-config_network_observability[Configuring monitoring for SR-IOV interface traffic]
46+
* xref:../../observability/network_observability/network-observability-secondary-networks.adoc#network-observability-SR-IOV-config_secondary_networks[Configuring monitoring for SR-IOV interface traffic]
4747
* xref:../../observability/network_observability/observing-network-traffic.adoc#network-observability-working-with-conversations_nw-observe-network-traffic[Working with conversation tracking]
4848
* xref:../../observability/network_observability/observing-network-traffic.adoc#network-observability-dns-tracking_nw-observe-network-traffic[Working with DNS tracking]
4949
* xref:../../observability/network_observability/observing-network-traffic.adoc#network-observability-packet-drops_nw-observe-network-traffic[Working with packet drops]

‎observability/network_observability/network-observability-operator-release-notes.adoc‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -249,7 +249,7 @@ For more information, see xref:../../observability/network_observability/observi
249249

250250
[id="SR-IOV-configuration-1.4"]
251251
==== SR-IOV support
252-
You can now collect traffic from a cluster with Single Root I/O Virtualization (SR-IOV) device. For more information, see xref:../../observability/network_observability/configuring-operator.adoc#network-observability-SR-IOV-config_network_observability[Configuring the monitoring of SR-IOV interface traffic].
252+
You can now collect traffic from a cluster with Single Root I/O Virtualization (SR-IOV) device. For more information, see xref:../../observability/network_observability/network-observability-secondary-networks.adoc#network-observability-SR-IOV-config_secondary_networks[Configuring the monitoring of SR-IOV interface traffic].
253253

254254
[id="IPFIX-support-1.4"]
255255
==== IPFIX exporter support
@@ -266,7 +266,7 @@ Network Observability Operator can now run on `s390x` architecture. Previously i
266266
=== Bug fixes
267267
* Previously, the Prometheus metrics exported by Network Observability were computed out of potentially duplicated network flows. In the related dashboards, from *Observe* -> *Dashboards*, this could result in potentially doubled rates. Note that dashboards from the *Network Traffic* view were not affected. Now, network flows are filtered to eliminate duplicates before metrics calculation, which results in correct traffic rates displayed in the dashboards. (link:https://issues.redhat.com/browse/NETOBSERV-1131[*NETOBSERV-1131*])
268268

269-
* Previously, the Network Observability Operator agents were not able to capture traffic on network interfaces when configured with Multus or SR-IOV, non-default network namespaces. Now, all available network namespaces are recognized and used for capturing flows, allowing capturing traffic for SR-IOV. There are xref:../../observability/network_observability/configuring-operator.adoc#network-observability-SR-IOV-config_network_observability[configurations needed] for the `FlowCollector` and `SRIOVnetwork` custom resource to collect traffic.
269+
* Previously, the Network Observability Operator agents were not able to capture traffic on network interfaces when configured with Multus or SR-IOV, non-default network namespaces. Now, all available network namespaces are recognized and used for capturing flows, allowing capturing traffic for SR-IOV. There are xref:../../observability/network_observability/network-observability-secondary-networks.adoc#network-observability-SR-IOV-config_secondary_networks[configurations needed] for the `FlowCollector` and `SRIOVnetwork` custom resource to collect traffic.
270270
(link:https://issues.redhat.com/browse/NETOBSERV-1283[*NETOBSERV-1283*])
271271

272272
* Previously, in the Network Observability Operator details from *Operators* -> *Installed Operators*, the `FlowCollector` *Status* field might have reported incorrect information about the state of the deployment. The status field now shows the proper conditions with improved messages. The history of events is kept, ordered by event date. (link:https://issues.redhat.com/browse/NETOBSERV-1224[*NETOBSERV-1224*])

‎observability/network_observability/network-observability-secondary-networks.adoc‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
:_mod-docs-content-type: ASSEMBLY
2+
[id="network-observability-secondary-networks"]
3+
= Secondary networks
4+
include::_attributes/common-attributes.adoc[]
5+
:context: secondary_networks
6+
7+
toc::[]
8+
You can configure the Network Observability Operator to collect and enrich network flow data from secondary networks, such as SR-IOV and Open Virtual Network (OVN)-Kubernetes.
9+
10+
// Note to tech review:
11+
// Is the existing SR-IOV example we have, "Configuring monitoring for SR-IOV interface traffic", an example of secondary network? If so, it is not through a VM, right?
12+
13+
.Prerequisites
14+
* Access to an {product-title} cluster with an additional network interface, such as a secondary interface or an L2 network.
15+
* The `spec.agent.ebpf.privileged` field must be set to `true`.
16+
17+
include::modules/network-observability-SRIOV-configuration.adoc[leveloffset=+1]
18+
19+
[role="_additional-resources"]
20+
.Additional resources
21+
For more information about creating the `SriovNetwork` custom resource, see xref:../../networking/hardware_networks/configuring-sriov-device.adoc#cnf-creating-an-additional-sriov-network-with-vrf-plug-in_configuring-sriov-device[Creating an additional SR-IOV network attachment with the CNI VRF plugin].
22+
23+
include::modules/network-observability-virtualization-configuration.adoc[leveloffset=+1]

0 commit comments

Comments
 (0)