Back to a single Service mode

jotak · jotak · commit be1847a6ec1b · 2025-12-05T17:56:23.000+01:00
Always use TLS, except if SERVER_NOTLS env is set on FLP
diff --git a/api/flowcollector/v1beta2/flowcollector_types.go b/api/flowcollector/v1beta2/flowcollector_types.go
@@ -27,10 +27,9 @@ import (
 type FlowCollectorDeploymentModel string
 
 const (
-	DeploymentModelDirect       FlowCollectorDeploymentModel = "Direct"
-	DeploymentModelKafka        FlowCollectorDeploymentModel = "Kafka"
-	DeploymentModelServiceNoTLS FlowCollectorDeploymentModel = "Service-NoTLS"
-	DeploymentModelServiceTLS   FlowCollectorDeploymentModel = "Service-TLS"
+	DeploymentModelDirect  FlowCollectorDeploymentModel = "Direct"
+	DeploymentModelKafka   FlowCollectorDeploymentModel = "Kafka"
+	DeploymentModelService FlowCollectorDeploymentModel = "Service"
 )
 
 // Please notice that the FlowCollectorSpec's properties MUST redefine one of the default
@@ -71,15 +70,14 @@ type FlowCollectorSpec struct {
 	ConsolePlugin FlowCollectorConsolePlugin `json:"consolePlugin,omitempty"`
 
 	// `deploymentModel` defines the desired type of deployment for flow processing. Possible values are:<br>
-	// - `Service-TLS` (default) to make the flow processor listen as a Kubernetes Service, backed by a scalable Deployment.<br>
-	// - `Service-NoTLS` to make the flow processor listen as a Kubernetes Service, backed by a scalable Deployment. Version without TLS.<br>
+	// - `Service` (default) to make the flow processor listen as a Kubernetes Service, backed by a scalable Deployment.<br>
 	// - `Kafka` to make flows sent to a Kafka pipeline before consumption by the processor.<br>
 	// - `Direct` to make the flow processor listen directly from the agents using the host network, backed by a DaemonSet. Only recommended on small clusters, below 15 nodes.<br>
 	// Kafka can provide better scalability, resiliency, and high availability (for more details, see https://www.redhat.com/en/topics/integration/what-is-apache-kafka).<br>
 	// `Direct` is not recommended on large clusters as it is less memory efficient.
 	// +unionDiscriminator
-	// +kubebuilder:validation:Enum:="Service-TLS";"Service-NoTLS";"Direct";"Kafka"
-	// +kubebuilder:default:=Service-TLS
+	// +kubebuilder:validation:Enum:="Service";"Direct";"Kafka"
+	// +kubebuilder:default:=Service
 	DeploymentModel FlowCollectorDeploymentModel `json:"deploymentModel,omitempty"`
 
 	// Kafka configuration, allowing to use Kafka as a broker as part of the flow collection pipeline. Available when the `spec.deploymentModel` is `Kafka`.
diff --git a/api/flowcollector/v1beta2/flowcollector_validation_webhook.go b/api/flowcollector/v1beta2/flowcollector_validation_webhook.go
@@ -276,7 +276,7 @@ func (v *validator) validateFLPLogTypes() {
 		if !v.fc.UseLoki() {
 			v.errors = append(v.errors, errors.New("enabling conversation tracking without Loki is not allowed, as it generates extra processing for no benefit"))
 		}
-		if v.fc.UseServiceNetwork() {
+		if v.fc.DeploymentModel == DeploymentModelService {
 			v.errors = append(v.errors, errors.New("cannot enable conversation tracking when spec.deploymentModel is Service: you must disable it, or change the deployment model"))
 		}
 	}
diff --git a/api/flowcollector/v1beta2/flowcollector_validation_webhook_test.go b/api/flowcollector/v1beta2/flowcollector_validation_webhook_test.go
@@ -516,7 +516,7 @@ func TestValidateConntrack(t *testing.T) {
 					Name: "cluster",
 				},
 				Spec: FlowCollectorSpec{
-					DeploymentModel: DeploymentModelServiceNoTLS,
+					DeploymentModel: DeploymentModelService,
 					Processor: FlowCollectorFLP{
 						LogTypes: ptr.To(LogTypeConversations),
 					},
diff --git a/api/flowcollector/v1beta2/helper.go b/api/flowcollector/v1beta2/helper.go
@@ -55,10 +55,7 @@ func (spec *FlowCollectorSpec) UseConsolePlugin() bool {
 
 func (spec *FlowCollectorSpec) UseTestConsolePlugin() bool {
 	if spec.ConsolePlugin.Advanced != nil {
-		env := spec.ConsolePlugin.Advanced.Env[constants.EnvTestConsole]
-		// Use ParseBool to allow common variants ("true", "True", "1"...) and ignore non-bools
-		b, err := strconv.ParseBool(env)
-		return err == nil && b
+		return IsEnvEnabled(spec.ConsolePlugin.Advanced.Env, constants.EnvTestConsole)
 	}
 	return false
 }
@@ -67,11 +64,6 @@ func (spec *FlowCollectorSpec) UseHostNetwork() bool {
 	return spec.DeploymentModel == DeploymentModelDirect
 }
 
-func (spec *FlowCollectorSpec) UseServiceNetwork() bool {
-	return spec.DeploymentModel == DeploymentModelServiceNoTLS ||
-		spec.DeploymentModel == DeploymentModelServiceTLS
-}
-
 func (spec *FlowCollectorEBPF) IsAgentFeatureEnabled(feature AgentFeature) bool {
 	for _, f := range spec.Features {
 		if f == feature {
@@ -190,10 +182,7 @@ func (spec *FlowCollectorFLP) GetMetricsPort() int32 {
 
 func (spec *FlowCollectorSpec) HasExperimentalAlertsHealth() bool {
 	if spec.Processor.Advanced != nil {
-		env := spec.Processor.Advanced.Env["EXPERIMENTAL_ALERTS_HEALTH"]
-		// Use ParseBool to allow common variants ("true", "True", "1"...) and ignore non-bools
-		b, err := strconv.ParseBool(env)
-		return err == nil && b
+		return IsEnvEnabled(spec.Processor.Advanced.Env, "EXPERIMENTAL_ALERTS_HEALTH")
 	}
 	return false
 }
@@ -232,3 +221,10 @@ func (spec *FlowCollectorConsolePlugin) IsUnmanagedConsolePluginReplicas() bool
 	}
 	return spec.Autoscaler.IsHPAEnabled()
 }
+
+func IsEnvEnabled(vars map[string]string, key string) bool {
+	env := vars[key]
+	// Use ParseBool to allow common variants ("true", "True", "1"...) and ignore non-bools
+	b, err := strconv.ParseBool(env)
+	return err == nil && b
+}
diff --git a/bundle/manifests/flows.netobserv.io_flowcollectors.yaml b/bundle/manifests/flows.netobserv.io_flowcollectors.yaml
@@ -3217,18 +3217,16 @@ spec:
                     type: boolean
                 type: object
               deploymentModel:
-                default: Service-TLS
+                default: Service
                 description: |-
                   `deploymentModel` defines the desired type of deployment for flow processing. Possible values are:<br>
-                  - `Service-TLS` (default) to make the flow processor listen as a Kubernetes Service, backed by a scalable Deployment.<br>
-                  - `Service-NoTLS` to make the flow processor listen as a Kubernetes Service, backed by a scalable Deployment. Version without TLS.<br>
+                  - `Service` (default) to make the flow processor listen as a Kubernetes Service, backed by a scalable Deployment.<br>
                   - `Kafka` to make flows sent to a Kafka pipeline before consumption by the processor.<br>
                   - `Direct` to make the flow processor listen directly from the agents using the host network, backed by a DaemonSet. Only recommended on small clusters, below 15 nodes.<br>
                   Kafka can provide better scalability, resiliency, and high availability (for more details, see https://www.redhat.com/en/topics/integration/what-is-apache-kafka).<br>
                   `Direct` is not recommended on large clusters as it is less memory efficient.
                 enum:
-                - Service-TLS
-                - Service-NoTLS
+                - Service
                 - Direct
                 - Kafka
                 type: string
diff --git a/config/crd/bases/flows.netobserv.io_flowcollectors.yaml b/config/crd/bases/flows.netobserv.io_flowcollectors.yaml
@@ -3011,18 +3011,16 @@ spec:
                       type: boolean
                   type: object
                 deploymentModel:
-                  default: Service-TLS
+                  default: Service
                   description: |-
                     `deploymentModel` defines the desired type of deployment for flow processing. Possible values are:<br>
-                    - `Service-TLS` (default) to make the flow processor listen as a Kubernetes Service, backed by a scalable Deployment.<br>
-                    - `Service-NoTLS` to make the flow processor listen as a Kubernetes Service, backed by a scalable Deployment. Version without TLS.<br>
+                    - `Service` (default) to make the flow processor listen as a Kubernetes Service, backed by a scalable Deployment.<br>
                     - `Kafka` to make flows sent to a Kafka pipeline before consumption by the processor.<br>
                     - `Direct` to make the flow processor listen directly from the agents using the host network, backed by a DaemonSet. Only recommended on small clusters, below 15 nodes.<br>
                     Kafka can provide better scalability, resiliency, and high availability (for more details, see https://www.redhat.com/en/topics/integration/what-is-apache-kafka).<br>
                     `Direct` is not recommended on large clusters as it is less memory efficient.
                   enum:
-                    - Service-TLS
-                    - Service-NoTLS
+                    - Service
                     - Direct
                     - Kafka
                   type: string
diff --git a/docs/FlowCollector.md b/docs/FlowCollector.md
@@ -112,15 +112,14 @@ for these features as a best effort only.
         <td>enum</td>
         <td>
           `deploymentModel` defines the desired type of deployment for flow processing. Possible values are:<br>
-- `Service-TLS` (default) to make the flow processor listen as a Kubernetes Service, backed by a scalable Deployment.<br>
-- `Service-NoTLS` to make the flow processor listen as a Kubernetes Service, backed by a scalable Deployment. Version without TLS.<br>
+- `Service` (default) to make the flow processor listen as a Kubernetes Service, backed by a scalable Deployment.<br>
 - `Kafka` to make flows sent to a Kafka pipeline before consumption by the processor.<br>
 - `Direct` to make the flow processor listen directly from the agents using the host network, backed by a DaemonSet. Only recommended on small clusters, below 15 nodes.<br>
 Kafka can provide better scalability, resiliency, and high availability (for more details, see https://www.redhat.com/en/topics/integration/what-is-apache-kafka).<br>
 `Direct` is not recommended on large clusters as it is less memory efficient.<br/>
           <br/>
-            <i>Enum</i>: Service-TLS, Service-NoTLS, Direct, Kafka<br/>
-            <i>Default</i>: Service-TLS<br/>
+            <i>Enum</i>: Service, Direct, Kafka<br/>
+            <i>Default</i>: Service<br/>
         </td>
         <td>false</td>
       </tr><tr>
diff --git a/helm/crds/flows.netobserv.io_flowcollectors.yaml b/helm/crds/flows.netobserv.io_flowcollectors.yaml
@@ -3015,18 +3015,16 @@ spec:
                       type: boolean
                   type: object
                 deploymentModel:
-                  default: Service-TLS
+                  default: Service
                   description: |-
                     `deploymentModel` defines the desired type of deployment for flow processing. Possible values are:<br>
-                    - `Service-TLS` (default) to make the flow processor listen as a Kubernetes Service, backed by a scalable Deployment.<br>
-                    - `Service-NoTLS` to make the flow processor listen as a Kubernetes Service, backed by a scalable Deployment. Version without TLS.<br>
+                    - `Service` (default) to make the flow processor listen as a Kubernetes Service, backed by a scalable Deployment.<br>
                     - `Kafka` to make flows sent to a Kafka pipeline before consumption by the processor.<br>
                     - `Direct` to make the flow processor listen directly from the agents using the host network, backed by a DaemonSet. Only recommended on small clusters, below 15 nodes.<br>
                     Kafka can provide better scalability, resiliency, and high availability (for more details, see https://www.redhat.com/en/topics/integration/what-is-apache-kafka).<br>
                     `Direct` is not recommended on large clusters as it is less memory efficient.
                   enum:
-                    - Service-TLS
-                    - Service-NoTLS
+                    - Service
                     - Direct
                     - Kafka
                   type: string
diff --git a/internal/controller/ebpf/agent_controller.go b/internal/controller/ebpf/agent_controller.go
@@ -482,9 +482,9 @@ func (c *AgentController) envConfig(ctx context.Context, coll *flowslatest.FlowC
 				Value: strconv.Itoa(int(*advancedConfig.Port)),
 			})
 		} else {
-			// Send to FLP service...
-			if coll.Spec.DeploymentModel == flowslatest.DeploymentModelServiceTLS {
-				// ... using TLS
+			skipTLS := flowslatest.IsEnvEnabled(advancedConfig.Env, "SERVER_NOTLS")
+			if !skipTLS {
+				// Send to FLP service using TLS
 				tlsCfg := flowslatest.ClientTLS{
 					Enable: true,
 					CACert: flowslatest.CertificateReference{
@@ -496,13 +496,16 @@ func (c *AgentController) envConfig(ctx context.Context, coll *flowslatest.FlowC
 				caPath := c.volumes.AddCACertificate(&tlsCfg, "svc-certs")
 				config = append(config, corev1.EnvVar{Name: envTargetTLSCACertPath, Value: caPath})
 			}
-			config = append(config, corev1.EnvVar{
-				Name:  envFlowsTargetHost,
-				Value: fmt.Sprintf("%s.%s.svc", constants.FLPName, c.Namespace),
-			}, corev1.EnvVar{
-				Name:  envFlowsTargetPort,
-				Value: strconv.Itoa(int(*advancedConfig.Port)),
-			})
+			config = append(config,
+				corev1.EnvVar{
+					Name:  envFlowsTargetHost,
+					Value: fmt.Sprintf("%s.%s.svc", constants.FLPName, c.Namespace),
+				},
+				corev1.EnvVar{
+					Name:  envFlowsTargetPort,
+					Value: strconv.Itoa(int(*advancedConfig.Port)),
+				},
+			)
 		}
 	}
 
diff --git a/internal/controller/ebpf/agent_controller_test.go b/internal/controller/ebpf/agent_controller_test.go
@@ -214,9 +214,9 @@ func TestBpfmanConfig(t *testing.T) {
 	assert.NotNil(t, ds)
 
 	assert.Equal(t, corev1.EnvVar{Name: "EBPF_PROGRAM_MANAGER_MODE", Value: "true"}, ds.Spec.Template.Spec.Containers[0].Env[0])
-	assert.Equal(t, "bpfman-maps", ds.Spec.Template.Spec.Volumes[0].Name)
+	assert.Equal(t, "bpfman-maps", ds.Spec.Template.Spec.Volumes[1].Name)
 	assert.Equal(t, map[string]string{
 		"csi.bpfman.io/maps":    "direct_flows,aggregated_flows,additional_flow_metrics,packet_record,dns_flows,global_counters,filter_map,peer_filter_map,ipsec_ingress_map,ipsec_egress_map",
 		"csi.bpfman.io/program": "netobserv",
-	}, ds.Spec.Template.Spec.Volumes[0].CSI.VolumeAttributes)
+	}, ds.Spec.Template.Spec.Volumes[1].CSI.VolumeAttributes)
 }
diff --git a/internal/controller/flowcollector_controller_minimal_test.go b/internal/controller/flowcollector_controller_minimal_test.go
@@ -57,10 +57,10 @@ func flowCollectorMinimalSpecs() {
 				return k8sClient.Get(ctx, agentKey, &ds)
 			}, timeout, interval).Should(Succeed())
 
-			By("Expecting to create the flowlogs-pipeline DaemonSet")
+			By("Expecting to create the flowlogs-pipeline Deployment")
 			Eventually(func() error {
-				ds := appsv1.DaemonSet{}
-				return k8sClient.Get(ctx, flpKey, &ds)
+				depl := appsv1.Deployment{}
+				return k8sClient.Get(ctx, flpKey, &depl)
 			}, timeout, interval).Should(Succeed())
 
 			By("Expecting to create the console plugin Deployment")
diff --git a/internal/controller/flp/flp_common_objects.go b/internal/controller/flp/flp_common_objects.go
@@ -34,11 +34,11 @@ const (
 )
 
 func newGRPCPipeline(desired *flowslatest.FlowCollectorSpec, volumes *volumes.Builder) config.PipelineBuilderStage {
-	cfg := api.IngestGRPCProto{
-		Port: int(*helper.GetAdvancedProcessorConfig(desired).Port),
-	}
-	if desired.DeploymentModel == flowslatest.DeploymentModelServiceTLS {
-		// Communication from agents uses TLS or mTLS: set up server certificate
+	adv := helper.GetAdvancedProcessorConfig(desired)
+	cfg := api.IngestGRPCProto{Port: int(*adv.Port)}
+	skipTLS := flowslatest.IsEnvEnabled(adv.Env, "SERVER_NOTLS")
+	if desired.DeploymentModel == flowslatest.DeploymentModelService && !skipTLS {
+		// Communication from agents uses TLS: set up server certificate
 		ref := flowslatest.CertificateReference{
 			Type:     flowslatest.RefTypeSecret,
 			Name:     monoCertSecretName,
diff --git a/internal/controller/networkpolicy/np_objects.go b/internal/controller/networkpolicy/np_objects.go
@@ -138,7 +138,7 @@ func buildMainNetworkPolicy(desired *flowslatest.FlowCollector, mgr *manager.Man
 			Protocol: ptr.To(corev1.ProtocolTCP),
 			Port:     ptr.To(intstr.FromInt32(constants.WebhookPort)),
 		}}
-		if desired.Spec.UseServiceNetwork() {
+		if desired.Spec.DeploymentModel == flowslatest.DeploymentModelService {
 			// Can be counter-intuitive, but only the DeploymentModelService mode needs an explicit rule for host-network (agents are still hostnetwork pods)
 			advanced := helper.GetAdvancedProcessorConfig(&desired.Spec)
 			hostNetworkPorts = append(hostNetworkPorts, networkingv1.NetworkPolicyPort{

Original file line number	Diff line number	Diff line change
`@@ -276,7 +276,7 @@ func (v *validator) validateFLPLogTypes() {`
`276`	`276`	`if !v.fc.UseLoki() {`
`277`	`277`	`v.errors = append(v.errors, errors.New("enabling conversation tracking without Loki is not allowed, as it generates extra processing for no benefit"))`
`278`	`278`	`}`
`279`		`- if v.fc.UseServiceNetwork() {`
	`279`	`+ if v.fc.DeploymentModel == DeploymentModelService {`
`280`	`280`	`v.errors = append(v.errors, errors.New("cannot enable conversation tracking when spec.deploymentModel is Service: you must disable it, or change the deployment model"))`
`281`	`281`	`}`
`282`	`282`	`}`