You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
live table filter: [SrcK8S_Zone:us-west-1b] press enter to match multiple regular expressions at once
27
27
----
28
+
. Use the *PageUp* and *PageDown* keys to toggle between *None*, *Resource*, *Zone*, *Host*, *Owner* and *all of the above*.
28
29
. To stop capturing, press kbd:[Ctrl+C]. The data that was captured is written to two separate files in an `./output` directory located in the same path used to install the CLI.
29
30
. View the captured data in the `./output/flow/<capture_date_time>.json` JSON file, which contains JSON arrays of the captured data.
= Creating a network policy for Network Observability
9
-
You might need to create a network policy to secure ingress traffic to the `netobserv` namespace. In the web console, you can create a network policy using the form view.
9
+
If you want to further customize the network policies for the `netobserv` and `netobserv-privileged` namespaces, you must disable the managed installation of the policy from the `FlowCollector` CR, and create your own. You can use the network policy resources that are enabled from the `FlowCollector` CR as a starting point for the procedure that follows:
= Configuring an ingress network policy by using the FlowCollector custom resource
9
+
You can configure the `FlowCollector` custom resource (CR) to deploy an ingress network policy for Network Observability by setting the `spec.NetworkPolicy.enable` specification to `true`. By default, the specification is `false`.
10
+
11
+
If you have installed Loki, Kafka or any exporter in a different namespace that also has a network policy, you must ensure that the Network Observability components can communicate with them. Consider the following about your setup:
12
+
13
+
* Connection to Loki (as defined in the `FlowCollector` CR `spec.loki` parameter)
14
+
* Connection to Kafka (as defined in the `FlowCollector` CR `spec.kafka` parameter)
15
+
* Connection to any exporter (as defined in FlowCollector CR `spec.exporters` parameter)
16
+
* If you are using Loki and including it in the policy target, connection to an external object storage (as defined in your `LokiStack` related secret)
17
+
18
+
.Procedure
19
+
. . In the web console, go to *Operators* -> *Installed Operators* page.
20
+
. Under the *Provided APIs* heading for *Network Observability*, select *Flow Collector*.
21
+
. Select *cluster* then select the *YAML* tab.
22
+
. Configure the `FlowCollector` CR. A sample configuration is as follows:
You can send network flows to Kafka, IPFIX, or both at the same time. Any processor or storage that supports Kafka or IPFIX input, such as Splunk, Elasticsearch, or Fluentd, can consume the enriched network flow data.
9
+
You can send network flows to Kafka, IPFIX, the Red{nbsp}Hat build of OpenTelemetry, or all three at the same time. For Kafka or IPFIX, any processor or storage that supports those inputs, such as Splunk, Elasticsearch, or Fluentd, can consume the enriched network flow data. For OpenTelemetry, network flow data and metrics can be exported to a compatible OpenTelemetry endpoint, such as Red{nbsp}Hat build of OpenTelemetry, Jaeger, or Prometheus.
10
10
11
11
.Prerequisites
12
-
* Your Kafka or IPFIX collector endpoint(s) are available from Network Observability `flowlogs-pipeline` pods.
12
+
* Your Kafka, IPFIX, or OpenTelemetry collector endpoints are available from Network Observability `flowlogs-pipeline` pods.
<1> The Network Observability Operator exports all flows to the configured Kafka topic.
44
-
<2> You can encrypt all communications to and from Kafka with SSL/TLS or mTLS. When enabled, the Kafka CA certificate must be available as a ConfigMap or a Secret, both in the namespace where the `flowlogs-pipeline` processor component is deployed (default: netobserv). It must be referenced with `spec.exporters.tls.caCert`. When using mTLS, client secrets must be available in these namespaces as well (they can be generated for instance using the AMQ Streams User Operator) and referenced with `spec.exporters.tls.userCert`.
45
-
<3> You can export flows to IPFIX instead of or in conjunction with exporting flows to Kafka.
57
+
<1> You can export flows to IPFIX, OpenTelemetry, and Kafka individually or concurrently.
58
+
<2> The Network Observability Operator exports all flows to the configured Kafka topic.
59
+
<3> You can encrypt all communications to and from Kafka with SSL/TLS or mTLS. When enabled, the Kafka CA certificate must be available as a ConfigMap or a Secret, both in the namespace where the `flowlogs-pipeline` processor component is deployed (default: netobserv). It must be referenced with `spec.exporters.tls.caCert`. When using mTLS, client secrets must be available in these namespaces as well (they can be generated for instance using the AMQ Streams User Operator) and referenced with `spec.exporters.tls.userCert`.
46
60
<4> You have the option to specify transport. The default value is `tcp` but you can also specify `udp`.
47
-
. After configuration, network flows data can be sent to an available output in a JSON format. For more information, see _Network flows format reference_.
61
+
<5> The protocol of OpenTelemetry connection. The available options are `http` and `grpc`.
62
+
<6> OpenTelemetry configuration for exporting logs, which are the same as the logs created for Loki.
63
+
<7> OpenTelemetry configuration for exporting metrics, which are the same as the metrics created for Prometheus. These configurations are specified in the `spec.processor.metrics.includeList` parameter of the `FlowCollector` custom resource, along with any custom metrics you defined using the `FlowMetrics` custom resource.
64
+
<8> The time interval that metrics are sent to the OpenTelemetry collector.
65
+
<9> *Optional*:Network Observability network flows formats get automatically renamed to an OpenTelemetry compliant format. The `fieldsMapping` specification gives you the ability to customize the OpenTelemetry format output. For example in the YAML sample, `SrcAddr` is the Network Observability input field, and it is being renamed `source.address` in OpenTelemetry output. You can see both Network Observability and OpenTelemetry formats in the "Network flows format reference".
66
+
67
+
After configuration, network flows data can be sent to an available output in a JSON format. For more information, see "Network flows format reference".
0 commit comments