Skip to content

Commit fe559cc

Browse files
mikemckiernanmikemckiernan
committed
OSDOCS-1865: Flows tracking and monitoring
Feedback from Ricky, Ross, and Jason. Add a verification step to echo back the configuration. Add mention that collecting flows data affects performance. PR comments from Brandi and replace YAML forest with a table since that is the team-preferred method. Prefer abbreviations.
1 parent 2231c6e commit fe559cc

File tree

5 files changed

+219
-0
lines changed

5 files changed

+219
-0
lines changed

‎_topic_map.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -962,6 +962,8 @@ Topics:
962962
File: enabling-multicast
963963
- Name: Disabling multicast for a project
964964
File: disabling-multicast
965+
- Name: Tracking network flows
966+
File: tracking-network-flows
965967
- Name: Configuring hybrid networking
966968
File: configuring-hybrid-networking
967969
- Name: Configuring Routes

‎modules/nw-network-flows-create.adoc

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/ovn_kubernetes_network_provider/tracking-network-flows.adoc
4+
5+
[id="nw-network-flows-create_{context}"]
6+
= Adding destinations for network flows collectors
7+
8+
As a cluster administator, you can configure the Cluster Network Operator (CNO) to send network flows metadata about the pod network to a network flows collector.
9+
10+
.Prerequisites
11+
12+
* You installed the OpenShift CLI (`oc`).
13+
* You are logged in to the cluster with a user with `cluster-admin` privileges.
14+
* You have a network flows collector and know the IP address and port that it listens on.
15+
16+
.Procedure
17+
18+
. Create a patch file that specifies the network flows collector type and the IP address and port information of the collectors:
19+
+
20+
[source,terminal]
21+
----
22+
spec:
23+
exportNetworkFlows:
24+
netFlow:
25+
collectors:
26+
- 192.168.1.99:2056
27+
----
28+
29+
. Configure the CNO with the network flows collectors:
30+
+
31+
[source,terminal]
32+
----
33+
$ oc patch network.operator cluster --type merge -p "$(cat <file_name>.yaml)"
34+
----
35+
+
36+
.Example output
37+
[source,terminal]
38+
----
39+
network.operator.openshift.io/cluster patched
40+
----
41+
42+
.Verification
43+
44+
Verification is not typically necessary. You can run the following command to confirm that Open vSwitch (OVS) on each node is configured to send network flows records to one or more collectors.
45+
46+
. View the Operator configuration to confirm that the `exportNetworkFlows` field is configured:
47+
+
48+
[source,terminal]
49+
----
50+
$ oc get network.operator cluster -o jsonpath="{.spec.exportNetworkFlows}"
51+
----
52+
+
53+
.Example output
54+
[source,terminal]
55+
----
56+
{"netFlow":{"collectors":["192.168.1.99:2056"]}}
57+
----
58+
59+
. View the network flows configuration in OVS from each node:
60+
+
61+
[source,terminal]
62+
----
63+
$ for pod in $(oc get pods -n openshift-ovn-kubernetes -l app=ovnkube-node -o jsonpath='{[email protected][*]}{.metadata.name}{"\n"}{end}');
64+
do ;
65+
echo;
66+
echo $pod;
67+
oc -n openshift-ovn-kubernetes exec -c ovnkube-node $pod \
68+
-- bash -c 'for type in ipfix sflow netflow ; do ovs-vsctl find $type ; done';
69+
done
70+
----
71+
+
72+
.Example output
73+
[source,terminal]
74+
----
75+
ovnkube-node-xrn4p
76+
_uuid : a4d2aaca-5023-4f3d-9400-7275f92611f9
77+
active_timeout : 60
78+
add_id_to_interface : false
79+
engine_id : []
80+
engine_type : []
81+
external_ids : {}
82+
targets : ["192.168.1.99:2056"]
83+
84+
ovnkube-node-z4vq9
85+
_uuid : 61d02fdb-9228-4993-8ff5-b27f01a29bd6
86+
active_timeout : 60
87+
add_id_to_interface : false
88+
engine_id : []
89+
engine_type : []
90+
external_ids : {}
91+
targets : ["192.168.1.99:2056"]-
92+
93+
...
94+
----

‎modules/nw-network-flows-delete.adoc

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/ovn_kubernetes_network_provider/tracking-network-flows.adoc
4+
5+
[id="nw-network-flows-delete_{context}"]
6+
= Deleting all destinations for network flows collectors
7+
8+
As a cluster administator, you can configure the Cluster Network Operator (CNO) to stop sending network flows metadata to a network flows collector.
9+
10+
.Prerequisites
11+
12+
* You installed the OpenShift CLI (`oc`).
13+
* You are logged in to the cluster with a user with `cluster-admin` privileges.
14+
15+
.Procedure
16+
17+
. Remove all network flows collectors:
18+
+
19+
[source,terminal]
20+
----
21+
$ oc patch network.operator cluster --type='json' \
22+
-p='[{"op":"remove", "path":"/spec/exportNetworkFlows"}]'
23+
----
24+
+
25+
.Example output
26+
[source,terminal]
27+
----
28+
network.operator.openshift.io/cluster patched
29+
----

‎modules/nw-network-flows-object.adoc

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/ovn_kubernetes_network_provider/tracking-network-flows.adoc
4+
5+
[id="nw-network-flows-object_{context}"]
6+
= Network object configuration for tracking network flows
7+
8+
The fields for configuring network flows collectors in the Cluster Network Operator (CNO) are shown in the following table:
9+
10+
.Network flows configuration
11+
[cols=".^2,.^2,.^6a",options="header"]
12+
|====
13+
|Field|Type|Description
14+
15+
|`metadata.name`
16+
|`string`
17+
|The name of the CNO object. This name is always `cluster`.
18+
19+
|`spec.exportNetworkFlows`
20+
|`object`
21+
|One or more of `netFlow`, `sFlow`, or `ipfix`.
22+
23+
|`spec.exportNetworkFlows.netFlow.collectors`
24+
|`array`
25+
|A list of IP address and network port pairs for up to 10 collectors.
26+
27+
|`spec.exportNetworkFlows.sFlow.collectors`
28+
|`array`
29+
|A list of IP address and network port pairs for up to 10 collectors.
30+
31+
|`spec.exportNetworkFlows.ipfix.collectors`
32+
|`array`
33+
|A list of IP address and network port pairs for up to 10 collectors.
34+
|====
35+
36+
After applying the following manifest to the CNO, the Operator configures Open vSwitch (OVS) on each node in the cluster to send network flows records to the NetFlow collector that is listening at `192.168.1.99:2056`.
37+
38+
.Example configuration for tracking network flows
39+
[source,yaml]
40+
----
41+
apiVersion: operator.openshift.io/v1
42+
kind: Network
43+
metadata:
44+
name: cluster
45+
spec:
46+
exportNetworkFlows:
47+
netFlow:
48+
collectors:
49+
- 192.168.1.99:2056
50+
----

‎networking/ovn_kubernetes_network_provider/tracking-network-flows.adoc

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
[id="tracking-network-flows"]
2+
= Tracking network flows
3+
include::modules/common-attributes.adoc[]
4+
:context: tracking-network-flows
5+
6+
toc::[]
7+
8+
As a cluster administrator, you can collect information about pod network flows from your cluster to assist with the following areas:
9+
10+
* Monitor ingress and egress traffic on the pod network.
11+
12+
* Troubleshoot performance issues.
13+
14+
* Gather data for capacity planning and security audits.
15+
16+
When you enable the collection of the network flows, only the metadata about the traffic is collected.
17+
For example, packet data is not collected, but the protocol, source address, destination address, port numbers, number of bytes, and other packet-level information is collected.
18+
19+
The data is collected in one or more of the following record formats:
20+
21+
* NetFlow
22+
23+
* sFlow
24+
25+
* IPFIX
26+
27+
When you configure the Cluster Network Operator (CNO) with one or more collector IP addresses and port numbers, the Operator configures Open vSwitch (OVS) on each node to send the network flows records to each collector.
28+
29+
You can configure the Operator to send records to more than one type of network flow collector. For example, you can send records to NetFlow collectors and also send records to sFlow collectors.
30+
31+
When OVS sends data to the collectors, each type of collector receives identical records. For example, if you configure two NetFlow collectors, OVS on a node sends identical records to the two collectors. If you also configure two sFlow collectors, the two sFlow collectors receive identical records. However, each collector type has a unique record format.
32+
33+
Collecting the network flows data and sending the records to collectors affects performance. Nodes process packets at a slower rate. If the performance impact is too great, you can delete the destinations for collectors to disable collecting network flows data and restore performance.
34+
35+
include::modules/nw-network-flows-object.adoc[leveloffset=+1]
36+
37+
include::modules/nw-network-flows-create.adoc[leveloffset=+1]
38+
39+
include::modules/nw-network-flows-delete.adoc[leveloffset=+1]
40+
41+
[id="additional-resources_{context}"]
42+
== Additional resources
43+
44+
* xref:../../rest_api/operator_apis/network-operator-openshift-io-v1.adoc#network-operator-openshift-io-v1[Network [operator.openshift.io/v1]]

0 commit comments

Comments
 (0)