You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
To enable this feature in FlowCollector, enter `oc edit flowcollector` and configure the following in the **ebpf** section:
39
38
40
-
```
39
+
```yaml
41
40
spec:
42
41
agent:
43
42
ebpf:
@@ -50,7 +49,7 @@ spec:
50
49
51
50
To create a basic Nginx web server, enter the following commands on the command line. I created two of them, one with the namespace "chiefs" and another with namespace "eagles".
@@ -90,7 +89,7 @@ With OVN-Kubernetes and Network Events, you can see what's happening with a pack
90
89
91
90
On OVN-Kubernetes, this is disabled by default since this is a Technology Preview feature, so enable it by adding the feature gate named **OVNObservability**. On the command line, enter `oc edit featuregate` and change the **spec** section to:
92
91
93
-
```
92
+
```yaml
94
93
spec:
95
94
featureSet: CustomNoUpgrade
96
95
customNoUpgrade:
@@ -104,7 +103,7 @@ This can take upwards of *10+ minutes* for this to take effect, so be patient.
104
103
105
104
To enable this feature in FlowCollector, enter `oc edit flowcollector` and configure the following in the **ebpf** section:
106
105
107
-
```
106
+
```yaml
108
107
spec:
109
108
agent:
110
109
ebpf:
@@ -154,7 +153,7 @@ In summary, use `cidr` for the client side address and `peerCIDR` for the server
154
153
155
154
Each rule can have its own sampling rate. For example, you might want the eBPF Agent to sample all external traffic on source and destination, but for internal traffic, it's sufficient to sample at 50. Listing 5 shows how this can be done, assuming the default IP settings of 10.128.0.0/14 for pods and 172.30.0.0/16 for services.
156
155
157
-
```
156
+
```yaml
158
157
spec:
159
158
agent:
160
159
type: eBPF
@@ -183,7 +182,7 @@ The last rule with CIDR 0.0.0.0/0 is necessary to explicitly tell it to process
183
182
184
183
Another new option is **pktDrops**. With **pktDrops: true** and **action: Accept**, it includes the packet only if it's dropped. The prerequisite is that the eBPF feature, **PacketDrop** is enabled, which requires eBFP to be in **privileged** mode. Note this currently is not supported if you enable the **NetworkEvent** feature. Listing 6 shows an example configuration.
185
184
186
-
```
185
+
```yaml
187
186
spec:
188
187
agent:
189
188
type: eBPF
@@ -211,7 +210,7 @@ Kubernetes networking consists of a flat Layer 3 network and a single IP address
211
210
212
211
To enable this feature in FlowCollector, enter `oc edit flowcollector` and configure the following in the **ebpf** section:
213
212
214
-
```
213
+
```yaml
215
214
spec:
216
215
agent:
217
216
ebpf:
@@ -225,7 +224,7 @@ spec:
225
224
226
225
Let's create a user-defined network based on a namespace (Listing 8).
227
226
228
-
```
227
+
```yaml
229
228
apiVersion: v1
230
229
kind: Namespace
231
230
metadata:
@@ -242,7 +241,7 @@ You can use `oc apply` with the content in Listing 8, or copy and paste this int
242
241
243
242
Now create a UserDefinedNetwork instance (Listing 9). Again, use `oc apply` or paste into OpenShift web console.
244
243
245
-
```
244
+
```yaml
246
245
apiVersion: k8s.ovn.org/v1
247
246
kind: UserDefinedNetwork
248
247
metadata:
@@ -260,9 +259,9 @@ spec:
260
259
261
260
Now if you add a pod into this namespace, it will automatically have a secondary interface that is part of the UDN. You can confirm this by entering the commands in Listing 10.
262
261
263
-
```
262
+
```bash
264
263
oc project 49ers
265
-
pod=$(oc get --no-headers pods | awk '{print $1;}') # get pod name
264
+
pod=$(oc get --no-headers pods | awk '{print $1;}') # get pod name
266
265
oc describe pod/$pod # should see two interfaces mentioned in Annotations
267
266
```
268
267
@@ -289,7 +288,7 @@ First, install the eBPF Manager Operator from **Operators > OperatorHub**. This
289
288
290
289
Then install Network Observability and configure the FlowCollector resource in Listing 11. Because this is a Developer Preview feature, delete the FlowCollector instance if you already have one and create a new instance, rather than edit an existing one.
0 commit comments