|
| 1 | +// Module included in the following assemblies: |
| 2 | +// |
| 3 | +// * observability/network_observability/network-observability-secondary-networks.adoc |
| 4 | + |
| 5 | +:_mod-docs-content-type: PROCEDURE |
| 6 | +[id="network-observability-virtualization-config_{context}"] |
| 7 | += Configuring virtual machine (VM) secondary network interfaces for Network Observability |
| 8 | +You can observe network traffic on an OpenShift Virtualization setup by identifying eBPF-enriched network flows coming from VMs that are connected to secondary networks, such as through OVN-Kubernetes. Network flows coming from VMs that are connected to the default internal pod network are automatically captured by Network Observability. |
| 9 | + |
| 10 | +.Procedure |
| 11 | +. Get information about the virtual machine launcher pod by running the following command. This information is used in Step 5: |
| 12 | ++ |
| 13 | +[source,terminal] |
| 14 | +---- |
| 15 | +$ oc get pod virt-launcher-<vm_name>-<suffix> -n <namespace> -o yaml |
| 16 | +---- |
| 17 | ++ |
| 18 | +[source,yaml] |
| 19 | +---- |
| 20 | +apiVersion: v1 |
| 21 | +kind: Pod |
| 22 | +metadata: |
| 23 | + annotations: |
| 24 | + k8s.v1.cni.cncf.io/network-status: |- |
| 25 | + [{ |
| 26 | + "name": "ovn-kubernetes", |
| 27 | + "interface": "eth0", |
| 28 | + "ips": [ |
| 29 | + "10.129.2.39" |
| 30 | + ], |
| 31 | + "mac": "0a:58:0a:81:02:27", |
| 32 | + "default": true, |
| 33 | + "dns": {} |
| 34 | + }, |
| 35 | + { |
| 36 | + "name": "my-vms/l2-network", <1> |
| 37 | + "interface": "podc0f69e19ba2", <2> |
| 38 | + "ips": [ <3> |
| 39 | + "10.10.10.15" |
| 40 | + ], |
| 41 | + "mac": "02:fb:f8:00:00:12", <4> |
| 42 | + "dns": {} |
| 43 | + }] |
| 44 | + name: virt-launcher-fedora-aqua-fowl-13-zr2x9 |
| 45 | + namespace: my-vms |
| 46 | +spec: |
| 47 | +# ... |
| 48 | +status: |
| 49 | +# ... |
| 50 | +---- |
| 51 | +<1> The name of the secondary network. |
| 52 | +<2> The network interface name of the secondary network. |
| 53 | +<3> The list of IPs used by the secondary network. |
| 54 | +<4> The MAC address used for secondary network. |
| 55 | + |
| 56 | +. In the web console, navigate to *Operators* -> *Installed Operators*. |
| 57 | +. Under the *Provided APIs* heading for the *NetObserv Operator*, select *Flow Collector*. |
| 58 | +. Select *cluster* and then select the *YAML* tab. |
| 59 | +. Configure `FlowCollector` based on the information you found from the additional network investigation: |
| 60 | ++ |
| 61 | +[source,yaml] |
| 62 | +---- |
| 63 | +apiVersion: flows.netobserv.io/v1beta2 |
| 64 | +kind: FlowCollector |
| 65 | +metadata: |
| 66 | + name: cluster |
| 67 | +spec: |
| 68 | +# ... |
| 69 | +ebpf: |
| 70 | + privileged: true <1> |
| 71 | + processor: |
| 72 | + advanced: |
| 73 | + secondaryNetworks: |
| 74 | + - index: <2> |
| 75 | + - MAC <3> |
| 76 | + name: my-vms/l2-network <4> |
| 77 | +# ... |
| 78 | +---- |
| 79 | +<.> Ensure that the eBPF agent is in `privileged` mode so that flows are collected for secondary interfaces. |
| 80 | +<.> Define the fields to use for indexing the virtual machine launcher pods. It is recommended to use the `MAC` address as the indexing field to get network flows enrichment for secondary interfaces. If you have overlapping MAC address between pods, then additional indexing fields, such as `IP` and `Interface`, could be added to have accurate enrichment. |
| 81 | +<.> If your additional network information has a MAC address, add `MAC` to the field list. |
| 82 | +<.> Specify the name of the network found in the `k8s.v1.cni.cncf.io/network-status` annotation. Usually <namespace>/<network_attachement_definition_name>. |
| 83 | + |
| 84 | +. Observe VM traffic: |
| 85 | +.. Navigate to the *Network Traffic* page. |
| 86 | +.. Filter by *Source* IP using your virtual machine IP found in `k8s.v1.cni.cncf.io/network-status` annotation. |
| 87 | +.. View both *Source* and *Destination* fields, which should be enriched, and identify the VM launcher pods and the VM instance as owners. |
0 commit comments