Skip to content

Commit d2789e8

Browse files
jotakjotak
committed
NETOBSERV-2503: use TLS by default in Service mode
1 parent d2ac113 commit d2789e8

File tree

156 files changed

+21615
-12269
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

156 files changed

+21615
-12269
lines changed

‎api/flowcollector/v1beta2/flowcollector_types.go‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -27,9 +27,10 @@ import (
2727
type FlowCollectorDeploymentModel string
2828

2929
const (
30-
DeploymentModelDirect FlowCollectorDeploymentModel = "Direct"
31-
DeploymentModelKafka FlowCollectorDeploymentModel = "Kafka"
32-
DeploymentModelService FlowCollectorDeploymentModel = "Service"
30+
DeploymentModelDirect FlowCollectorDeploymentModel = "Direct"
31+
DeploymentModelKafka FlowCollectorDeploymentModel = "Kafka"
32+
DeploymentModelServiceNoTLS FlowCollectorDeploymentModel = "Service-NoTLS"
33+
DeploymentModelServiceTLS FlowCollectorDeploymentModel = "Service-TLS"
3334
)
3435

3536
// Please notice that the FlowCollectorSpec's properties MUST redefine one of the default
@@ -70,14 +71,15 @@ type FlowCollectorSpec struct {
7071
ConsolePlugin FlowCollectorConsolePlugin `json:"consolePlugin,omitempty"`
7172

7273
// `deploymentModel` defines the desired type of deployment for flow processing. Possible values are:<br>
73-
// - `Direct` (default) to make the flow processor listen directly from the agents using the host network, backed by a DaemonSet. Only recommended on small clusters, below 15 nodes.<br>
74-
// - `Service` to make the flow processor listen as a Kubernetes Service, backed by a scalable Deployment.<br>
74+
// - `Service-TLS` (default) to make the flow processor listen as a Kubernetes Service, backed by a scalable Deployment.<br>
75+
// - `Service-NoTLS` to make the flow processor listen as a Kubernetes Service, backed by a scalable Deployment. Version without TLS.<br>
7576
// - `Kafka` to make flows sent to a Kafka pipeline before consumption by the processor.<br>
77+
// - `Direct` to make the flow processor listen directly from the agents using the host network, backed by a DaemonSet. Only recommended on small clusters, below 15 nodes.<br>
7678
// Kafka can provide better scalability, resiliency, and high availability (for more details, see https://www.redhat.com/en/topics/integration/what-is-apache-kafka).<br>
7779
// `Direct` is not recommended on large clusters as it is less memory efficient.
7880
// +unionDiscriminator
79-
// +kubebuilder:validation:Enum:="Direct";"Service";"Kafka"
80-
// +kubebuilder:default:=Direct
81+
// +kubebuilder:validation:Enum:="Service-TLS";"Service-NoTLS";"Direct";"Kafka"
82+
// +kubebuilder:default:=Service-TLS
8183
DeploymentModel FlowCollectorDeploymentModel `json:"deploymentModel,omitempty"`
8284

8385
// Kafka configuration, allowing to use Kafka as a broker as part of the flow collection pipeline. Available when the `spec.deploymentModel` is `Kafka`.

‎api/flowcollector/v1beta2/flowcollector_validation_webhook.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -276,7 +276,7 @@ func (v *validator) validateFLPLogTypes() {
276276
if !v.fc.UseLoki() {
277277
v.errors = append(v.errors, errors.New("enabling conversation tracking without Loki is not allowed, as it generates extra processing for no benefit"))
278278
}
279-
if v.fc.DeploymentModel == DeploymentModelService {
279+
if v.fc.UseServiceNetwork() {
280280
v.errors = append(v.errors, errors.New("cannot enable conversation tracking when spec.deploymentModel is Service: you must disable it, or change the deployment model"))
281281
}
282282
}

‎api/flowcollector/v1beta2/flowcollector_validation_webhook_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -516,7 +516,7 @@ func TestValidateConntrack(t *testing.T) {
516516
Name: "cluster",
517517
},
518518
Spec: FlowCollectorSpec{
519-
DeploymentModel: DeploymentModelService,
519+
DeploymentModel: DeploymentModelServiceNoTLS,
520520
Processor: FlowCollectorFLP{
521521
LogTypes: ptr.To(LogTypeConversations),
522522
},

‎api/flowcollector/v1beta2/helper.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,11 @@ func (spec *FlowCollectorSpec) UseHostNetwork() bool {
6767
return spec.DeploymentModel == DeploymentModelDirect
6868
}
6969

70+
func (spec *FlowCollectorSpec) UseServiceNetwork() bool {
71+
return spec.DeploymentModel == DeploymentModelServiceNoTLS ||
72+
spec.DeploymentModel == DeploymentModelServiceTLS
73+
}
74+
7075
func (spec *FlowCollectorEBPF) IsAgentFeatureEnabled(feature AgentFeature) bool {
7176
for _, f := range spec.Features {
7277
if f == feature {

‎bundle/manifests/flows.netobserv.io_flowcollectors.yaml‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3217,17 +3217,19 @@ spec:
32173217
type: boolean
32183218
type: object
32193219
deploymentModel:
3220-
default: Direct
3220+
default: Service-TLS
32213221
description: |-
32223222
`deploymentModel` defines the desired type of deployment for flow processing. Possible values are:<br>
3223-
- `Direct` (default) to make the flow processor listen directly from the agents using the host network, backed by a DaemonSet. Only recommended on small clusters, below 15 nodes.<br>
3224-
- `Service` to make the flow processor listen as a Kubernetes Service, backed by a scalable Deployment.<br>
3223+
- `Service-TLS` (default) to make the flow processor listen as a Kubernetes Service, backed by a scalable Deployment.<br>
3224+
- `Service-NoTLS` to make the flow processor listen as a Kubernetes Service, backed by a scalable Deployment. Version without TLS.<br>
32253225
- `Kafka` to make flows sent to a Kafka pipeline before consumption by the processor.<br>
3226+
- `Direct` to make the flow processor listen directly from the agents using the host network, backed by a DaemonSet. Only recommended on small clusters, below 15 nodes.<br>
32263227
Kafka can provide better scalability, resiliency, and high availability (for more details, see https://www.redhat.com/en/topics/integration/what-is-apache-kafka).<br>
32273228
`Direct` is not recommended on large clusters as it is less memory efficient.
32283229
enum:
3230+
- Service-TLS
3231+
- Service-NoTLS
32293232
- Direct
3230-
- Service
32313233
- Kafka
32323234
type: string
32333235
exporters:

‎config/crd/bases/flows.netobserv.io_flowcollectors.yaml‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3011,17 +3011,19 @@ spec:
30113011
type: boolean
30123012
type: object
30133013
deploymentModel:
3014-
default: Direct
3014+
default: Service-TLS
30153015
description: |-
30163016
`deploymentModel` defines the desired type of deployment for flow processing. Possible values are:<br>
3017-
- `Direct` (default) to make the flow processor listen directly from the agents using the host network, backed by a DaemonSet. Only recommended on small clusters, below 15 nodes.<br>
3018-
- `Service` to make the flow processor listen as a Kubernetes Service, backed by a scalable Deployment.<br>
3017+
- `Service-TLS` (default) to make the flow processor listen as a Kubernetes Service, backed by a scalable Deployment.<br>
3018+
- `Service-NoTLS` to make the flow processor listen as a Kubernetes Service, backed by a scalable Deployment. Version without TLS.<br>
30193019
- `Kafka` to make flows sent to a Kafka pipeline before consumption by the processor.<br>
3020+
- `Direct` to make the flow processor listen directly from the agents using the host network, backed by a DaemonSet. Only recommended on small clusters, below 15 nodes.<br>
30203021
Kafka can provide better scalability, resiliency, and high availability (for more details, see https://www.redhat.com/en/topics/integration/what-is-apache-kafka).<br>
30213022
`Direct` is not recommended on large clusters as it is less memory efficient.
30223023
enum:
3024+
- Service-TLS
3025+
- Service-NoTLS
30233026
- Direct
3024-
- Service
30253027
- Kafka
30263028
type: string
30273029
exporters:

‎docs/FlowCollector.md‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -112,14 +112,15 @@ for these features as a best effort only.
112112
<td>enum</td>
113113
<td>
114114
`deploymentModel` defines the desired type of deployment for flow processing. Possible values are:<br>
115-
- `Direct` (default) to make the flow processor listen directly from the agents using the host network, backed by a DaemonSet. Only recommended on small clusters, below 15 nodes.<br>
116-
- `Service` to make the flow processor listen as a Kubernetes Service, backed by a scalable Deployment.<br>
115+
- `Service-TLS` (default) to make the flow processor listen as a Kubernetes Service, backed by a scalable Deployment.<br>
116+
- `Service-NoTLS` to make the flow processor listen as a Kubernetes Service, backed by a scalable Deployment. Version without TLS.<br>
117117
- `Kafka` to make flows sent to a Kafka pipeline before consumption by the processor.<br>
118+
- `Direct` to make the flow processor listen directly from the agents using the host network, backed by a DaemonSet. Only recommended on small clusters, below 15 nodes.<br>
118119
Kafka can provide better scalability, resiliency, and high availability (for more details, see https://www.redhat.com/en/topics/integration/what-is-apache-kafka).<br>
119120
`Direct` is not recommended on large clusters as it is less memory efficient.<br/>
120121
<br/>
121-
<i>Enum</i>: Direct, Service, Kafka<br/>
122-
<i>Default</i>: Direct<br/>
122+
<i>Enum</i>: Service-TLS, Service-NoTLS, Direct, Kafka<br/>
123+
<i>Default</i>: Service-TLS<br/>
123124
</td>
124125
<td>false</td>
125126
</tr><tr>

‎go.mod‎

Lines changed: 18 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ require (
1010
github.com/google/go-cmp v0.7.0
1111
github.com/grafana/loki/operator/apis/loki v0.0.0-20241021105923-5e970e50b166
1212
github.com/netobserv/flowlogs-pipeline v1.10.0-community
13-
github.com/netobserv/netobserv-ebpf-agent v1.10.0-community
13+
github.com/netobserv/netobserv-ebpf-agent v1.10.0-community.0.20251125162210-4be10c36721e
1414
github.com/onsi/ginkgo/v2 v2.27.2
1515
github.com/onsi/gomega v1.38.2
1616
github.com/openshift/api v0.0.0-20250707164913-2cd5821c9080
@@ -80,32 +80,32 @@ require (
8080
github.com/stoewer/go-strcase v1.3.1 // indirect
8181
github.com/stretchr/objx v0.5.2 // indirect
8282
github.com/x448/float16 v0.8.4 // indirect
83-
go.opentelemetry.io/auto/sdk v1.1.0 // indirect
83+
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
8484
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.62.0 // indirect
85-
go.opentelemetry.io/otel v1.37.0 // indirect
85+
go.opentelemetry.io/otel v1.38.0 // indirect
8686
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0 // indirect
8787
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0 // indirect
88-
go.opentelemetry.io/otel/metric v1.37.0 // indirect
89-
go.opentelemetry.io/otel/sdk v1.37.0 // indirect
90-
go.opentelemetry.io/otel/trace v1.37.0 // indirect
88+
go.opentelemetry.io/otel/metric v1.38.0 // indirect
89+
go.opentelemetry.io/otel/sdk v1.38.0 // indirect
90+
go.opentelemetry.io/otel/trace v1.38.0 // indirect
9191
go.opentelemetry.io/proto/otlp v1.7.0 // indirect
9292
go.uber.org/multierr v1.11.0 // indirect
9393
go.yaml.in/yaml/v2 v2.4.3 // indirect
9494
go.yaml.in/yaml/v3 v3.0.4 // indirect
9595
golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b // indirect
96-
golang.org/x/mod v0.28.0 // indirect
97-
golang.org/x/net v0.46.0 // indirect
96+
golang.org/x/mod v0.29.0 // indirect
97+
golang.org/x/net v0.47.0 // indirect
9898
golang.org/x/oauth2 v0.32.0 // indirect
99-
golang.org/x/sync v0.17.0 // indirect
100-
golang.org/x/sys v0.37.0 // indirect
101-
golang.org/x/term v0.36.0 // indirect
102-
golang.org/x/text v0.30.0 // indirect
99+
golang.org/x/sync v0.18.0 // indirect
100+
golang.org/x/sys v0.38.0 // indirect
101+
golang.org/x/term v0.37.0 // indirect
102+
golang.org/x/text v0.31.0 // indirect
103103
golang.org/x/time v0.12.0 // indirect
104-
golang.org/x/tools v0.37.0 // indirect
104+
golang.org/x/tools v0.38.0 // indirect
105105
gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect
106-
google.golang.org/genproto/googleapis/api v0.0.0-20250804133106-a7a43d27e69b // indirect
107-
google.golang.org/genproto/googleapis/rpc v0.0.0-20250804133106-a7a43d27e69b // indirect
108-
google.golang.org/grpc v1.76.0 // indirect
106+
google.golang.org/genproto/googleapis/api v0.0.0-20251022142026-3a174f9686a8 // indirect
107+
google.golang.org/genproto/googleapis/rpc v0.0.0-20251022142026-3a174f9686a8 // indirect
108+
google.golang.org/grpc v1.77.0 // indirect
109109
google.golang.org/protobuf v1.36.10 // indirect
110110
gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
111111
gopkg.in/inf.v0 v0.9.1 // indirect
@@ -119,3 +119,5 @@ require (
119119
sigs.k8s.io/randfill v1.0.0 // indirect
120120
sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
121121
)
122+
123+
replace github.com/netobserv/flowlogs-pipeline => github.com/jotak/flowlogs-pipeline v0.0.0-20251201132339-09e5c7677a99

0 commit comments

Comments
 (0)