Skip to content

Commit 8868895

Browse files
skrthomasskrthomas
committed
OSDOCS-10877: Virtualization in Network Observability
1 parent 66ad93a commit 8868895

File tree

5 files changed

+123
-6
lines changed

5 files changed

+123
-6
lines changed

‎_topic_maps/_topic_map.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2922,6 +2922,8 @@ Topics:
29222922
File: network-observability-operator-monitoring
29232923
- Name: Scheduling resources
29242924
File: network-observability-scheduling-resources
2925+
- Name: Secondary networks
2926+
File: network-observability-secondary-networks
29252927
- Name: Network Observability CLI
29262928
Dir: netobserv_cli
29272929
Topics:

‎modules/network-observability-SRIOV-configuration.adoc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
// Module included in the following assemblies:
22
//
3-
// * network_observability/configuring-operator.adoc
3+
// * observability/network_observability/network-observability-secondary-networks.adoc
44

55
:_mod-docs-content-type: PROCEDURE
66
[id="network-observability-SR-IOV-config_{context}"]

‎modules/network-observability-virtualization-configuration.adoc‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * observability/network_observability/network-observability-secondary-networks.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="network-observability-virtualization-config_{context}"]
7+
= Configuring virtual machine (VM) secondary network interfaces for Network Observability
8+
You can observe networking patterns on an OpenShift Virtualization setup by identifying eBPF-enriched network flows coming from VMs that are connected to secondary networks, such as through Open Virtual Network (OVN)-Kubernetes, or SR-IOV CNI plugins. Network flows coming from VMs that are connected to the default internal pod network are automatically captured by Network Observability.
9+
10+
.Procedure
11+
. Get information about the virtual machine launcher pod by running the following command. This information is used in Step 2:
12+
+
13+
[source,terminal]
14+
----
15+
$ oc get pod virt-launcher-<vm_name>-<suffix> -n <namespace> -o yaml
16+
----
17+
+
18+
[source,yaml]
19+
----
20+
$ oc get pod virt-launcher-fedora-aqua-fowl-13-zr2x9 -n my-vms -o yaml
21+
apiVersion: v1
22+
kind: Pod
23+
metadata:
24+
annotations:
25+
k8s.v1.cni.cncf.io/network-status: |-
26+
[{
27+
"name": "ovn-kubernetes",
28+
"interface": "eth0",
29+
"ips": [
30+
"10.129.2.39"
31+
],
32+
"mac": "0a:58:0a:81:02:27",
33+
"default": true,
34+
"dns": {}
35+
},
36+
{
37+
"name": "my-vms/l2-network", <1>
38+
"interface": "podc0f69e19ba2", <2>
39+
"ips": [
40+
"10.10.10.15"
41+
], <3>
42+
"mac": "02:fb:f8:00:00:12", <4>
43+
"dns": {}
44+
}]
45+
name: virt-launcher-fedora-aqua-fowl-13-zr2x9
46+
namespace: my-vms
47+
spec:
48+
...
49+
status:
50+
...
51+
----
52+
<1> The name of the secondary network.
53+
<2> The network interface name of the secondary network.
54+
<3> The list of IPs used by the secondary network.
55+
<4> The MAC address used for secondary network.
56+
57+
. In the web console, navigate to *Operators* -> *Installed Operators*.
58+
. Under the *Provided APIs* heading for the *NetObserv Operator*, select *Flow Collector*.
59+
. Select *cluster* and then select the *YAML* tab.
60+
. Configure `FlowCollector` based on the information you found from the additional network investigation.
61+
+
62+
[source,yaml]
63+
----
64+
apiVersion: flows.netobserv.io/v1beta2
65+
kind: FlowCollector
66+
metadata:
67+
name: cluster
68+
spec:
69+
# ...
70+
ebpf:
71+
privileged: true <1>
72+
processor:
73+
advanced:
74+
secondaryNetworks:
75+
- index: <2>
76+
- Interface
77+
- MAC <3>
78+
- IP <4>
79+
name: my-vms/l2-network <5>
80+
# ...
81+
----
82+
<1> Ensure that the ebpf agent is in `privileged` mode so that the flows are enriched according to the MAC address.
83+
<2> Define the fields to use for indexing the virtual machine launcher pods. These should form a unique identifier across the cluster according to the fields available in `k8s.v1.cni.cncf.io/network-status` annotation.
84+
+
85+
[IMPORTANT]
86+
====
87+
Not all secondary networks have all the index fields in this example. Ensure that only the fields that are annotated in your secondary interface are listed here and if they are not annotated, they are removed.
88+
====
89+
<3> If your additional network information has a MAC address, specify add it here.
90+
<4> If your additional network information has an IP address, specify add it here.
91+
<5> Specify the name of the network found in `k8s.v1.cni.cncf.io/network-status` annotation. Usually <namespace>/<network_attachement_definition_name>.
92+
93+
. Ping from one VM to another for secondary interface IP.
94+
95+
.Verification
96+
. Navigate to the *Network Traffic* page.
97+
. Filter by *Source* IP using your virtual machine IP found in `k8s.v1.cni.cncf.io/network-status` annotation.
98+
. View both *Source* and *Destination* fields should enriched identifying VM launcher Pods and VM instance as Owners

‎observability/network_observability/configuring-operator.adoc‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -24,10 +24,5 @@ For more information about specifying flow format, see xref:../../observability/
2424

2525
include::modules/network-observability-configuring-FLP-sampling.adoc[leveloffset=+1]
2626
include::modules/network-observability-configuring-quickfilters-flowcollector.adoc[leveloffset=+1]
27-
include::modules/network-observability-SRIOV-configuration.adoc[leveloffset=+1]
28-
[role="_additional-resources"]
29-
.Additional resources
30-
For more information about creating the `SriovNetwork` custom resource, see xref:../../networking/hardware_networks/configuring-sriov-device.adoc#cnf-creating-an-additional-sriov-network-with-vrf-plug-in_configuring-sriov-device[Creating an additional SR-IOV network attachment with the CNI VRF plugin].
31-
3227
include::modules/network-observability-resource-recommendations.adoc[leveloffset=+1]
3328
include::modules/network-observability-resources-table.adoc[leveloffset=+2]

‎observability/network_observability/network-observability-secondary-networks.adoc‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
:_mod-docs-content-type: ASSEMBLY
2+
[id="network-observability-secondary-networks"]
3+
= Secondary networks
4+
include::_attributes/common-attributes.adoc[]
5+
:context: secondary_networks
6+
7+
toc::[]
8+
You can configure the Network Observability Operator to collect and enrich network flow data from secondary networks, such as SR-IOV and Open Virtual Network (OVN)-Kubernetes.
9+
10+
// Note to tech review:
11+
// Is the existing SR-IOV example we have, "Configuring monitoring for SR-IOV interface traffic", an example of secondary network? If so, it is not through a VM, right?
12+
13+
.Prerequisites
14+
* Access to an {product-title} cluster with an additional network interface, such as a secondary interface or an L2 network.
15+
* The `spec.agent.ebpf.privileged` field must be set to `true`.
16+
17+
include::modules/network-observability-SRIOV-configuration.adoc[leveloffset=+1]
18+
[role="_additional-resources"]
19+
.Additional resources
20+
For more information about creating the `SriovNetwork` custom resource, see xref:../../networking/hardware_networks/configuring-sriov-device.adoc#cnf-creating-an-additional-sriov-network-with-vrf-plug-in_configuring-sriov-device[Creating an additional SR-IOV network attachment with the CNI VRF plugin].
21+
22+
include::modules/network-observability-virtualization-configuration.adoc[leveloffset=+1]

0 commit comments

Comments
 (0)