Add CiliumFlowLogging configuring Hubble-exporters #26646

AwesomePatrol · 2023-07-05T13:20:58Z

Add CiliumFlowLogging CRD which enables runtime configuration of exporting Hubble events to files to be later consumed by observability stack as logs

Signed-off-by: Aleksander Mistewicz <amistewicz@google.com>

AwesomePatrol · 2023-07-26T12:30:15Z

/test

pkg/k8s/apis/cilium.io/v2alpha1/types.go

squeed · 2023-07-27T08:57:20Z

pkg/k8s/apis/cilium.io/v2alpha1/types.go

+	// Spec defines the desired specification/configuration of the flow logging.
+	//
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="Spec is immutable"


squeed · 2023-07-27T08:58:10Z

pkg/k8s/apis/cilium.io/v2alpha1/types.go

+
+// FlowLoggingSpec defines configuration of a flow logging task.
+//
+// +deepequal-gen=false


why not auto-generate DeepEqual?

It is not needed (in this version it won't handle object updates at all). IIRC there were some issues when I left the default.

pkg/k8s/apis/cilium.io/v2alpha1/types.go

squeed · 2023-07-27T09:02:01Z

pkg/k8s/apis/cilium.io/v2alpha1/types.go

+	//
+	// +kubebuilder:validation:Format=date-time
+	// +kubebuilder:validation:Optional
+	Expiration *metav1.Time `json:"end"`


nit: convention is "expires". Also, the json tag should probably match the field name.

Also, I really like this idea. Are there any other limitations we might want to add? Maximum logged flows? Maxiumum rate? Sample rate?

Rate is limited in the config map. Max logged flows is impossible to track across cilium-agent pod restarts.

I am not sure how a sample rate could be implemented and I think it is best to use TCP flags to narrow down information to connection open/close.

pkg/k8s/apis/cilium.io/v2alpha1/types.go

squeed · 2023-07-27T09:05:01Z

pkg/k8s/watchers/cilium_flow_logging.go

@@ -0,0 +1,123 @@
+// SPDX-License-Identifier: Apache-2.0


In general, we avoid creating new watchers in this package, and prefer using the Resource[T] framework.

I realize this small comment is actually a fair bit of work :-(

ok, I will look into that

squeed · 2023-07-27T09:06:22Z

daemon/cmd/daemon.go

@@ -637,6 +639,8 @@ func newDaemon(ctx context.Context, cleaner *daemonCleanup, params *daemonParams

 	d.cgroupManager = manager.NewCgroupManager()

+	d.hubbleExporterManager = exporter.NewManager(d.ctx)


This should probably be a Cell in the Hive. check out pkg/hive/examples for the basic structure.

Signed-off-by: Aleksander Mistewicz <amistewicz@google.com>

jibi · 2023-08-01T09:51:47Z

Makefile

@@ -219,7 +219,7 @@ GIT_VERSION: force
 -include Makefile.docker

 ##@ API targets
-CRD_OPTIONS ?= "crd:crdVersions=v1"
+CRD_OPTIONS ?= "crd:crdVersions=v1,ignoreUnexportedFields=true"


what are the implication of this option?

See kubernetes-sigs/controller-tools#584 (it was cherry-picked into cilium's fork of controller-tools in cilium/controller-tools#3 and #26918)

It doesn't change other generated CRDs. It makes it possible to use types generated from protos directly without additional translation type.

AwesomePatrol · 2023-08-01T14:12:10Z

pkg/k8s/apis/cilium.io/v2alpha1/flowlogging.go

+	// List of field names that will be kept in the log output.
+	//
+	// +kubebuilder:validation:Optional
+	FieldMask []string `json:"fieldmask"`


typo: fieldMask

AwesomePatrol · 2023-08-01T14:12:21Z

pkg/k8s/apis/cilium.io/v2alpha1/flowlogging.go

+	// disabled when empty.
+	//
+	// +kubebuilder:validation:Optional
+	ExcludeFilters []*flowpb.FlowFilter `json:"exludefilters"`


typo: excludeFilters

github-actions · 2023-09-02T01:43:40Z

This pull request has been automatically marked as stale because it
has not had recent activity. It will be closed if no further activity
occurs. Thank you for your contributions.

github-actions · 2023-09-16T01:44:06Z

This pull request has not seen any activity since it was marked stale.
Closing.

maintainer-s-little-helper bot added the dont-merge/needs-release-note-label The author needs to describe the release impact of these changes. label Jul 5, 2023

AwesomePatrol had a problem deploying to release-base-images July 5, 2023 13:21 — with GitHub Actions Error

github-actions bot added the kind/community-contribution This was a contribution made by a community member. label Jul 5, 2023

AwesomePatrol had a problem deploying to release-base-images July 5, 2023 15:47 — with GitHub Actions Error

AwesomePatrol had a problem deploying to release-base-images July 5, 2023 17:13 — with GitHub Actions Failure

AwesomePatrol force-pushed the flow-logging-crd branch from baca4d4 to 5c46cc2 Compare July 6, 2023 12:27

AwesomePatrol temporarily deployed to release-base-images July 6, 2023 12:27 — with GitHub Actions Inactive

AwesomePatrol force-pushed the flow-logging-crd branch from 5c46cc2 to 4058917 Compare July 6, 2023 14:52

AwesomePatrol temporarily deployed to release-base-images July 6, 2023 14:52 — with GitHub Actions Inactive

This was referenced Jul 19, 2023

Import new version of forked controller-tools #26918

Merged

Add deepcopy plugin #26978

Merged

AwesomePatrol force-pushed the flow-logging-crd branch 5 times, most recently from 4e83ff4 to 002f425 Compare July 26, 2023 11:17

AwesomePatrol added 6 commits July 26, 2023 11:59

Add CiliumFlowLogging CRD

758a526

Signed-off-by: Aleksander Mistewicz <amistewicz@google.com>

Add CiliumFlowLogging watcher

649adce

Signed-off-by: Aleksander Mistewicz <amistewicz@google.com>

Add Hubble Exporter Manager

6eaa7c2

Signed-off-by: Aleksander Mistewicz <amistewicz@google.com>

Add rate limiter to Hubble exporter manager

e9ff5e0

Signed-off-by: Aleksander Mistewicz <amistewicz@google.com>

Queue jobs in cases watcher is faster than Hubble

23523eb

Signed-off-by: Aleksander Mistewicz <amistewicz@google.com>

Use Expiration of type meta/v1/Time instead of End

4ad7efc

Signed-off-by: Aleksander Mistewicz <amistewicz@google.com>

AwesomePatrol force-pushed the flow-logging-crd branch from 002f425 to 4ad7efc Compare July 26, 2023 11:59

AwesomePatrol marked this pull request as ready for review July 26, 2023 13:22

AwesomePatrol requested review from a team as code owners July 26, 2023 13:22

AwesomePatrol requested review from youngnick, derailed, chancez, squeed, jibi and gandro July 26, 2023 13:22

gandro requested a review from michi-covalent July 26, 2023 13:27

squeed reviewed Jul 27, 2023

View reviewed changes

pkg/k8s/apis/cilium.io/v2alpha1/types.go Outdated Show resolved Hide resolved

squeed reviewed Jul 27, 2023

View reviewed changes

pkg/k8s/apis/cilium.io/v2alpha1/types.go Outdated Show resolved Hide resolved

squeed reviewed Jul 27, 2023

View reviewed changes

pkg/k8s/apis/cilium.io/v2alpha1/types.go Outdated Show resolved Hide resolved

squeed reviewed Jul 27, 2023

View reviewed changes

Rename fields in CiliumFlowLogging

2a0e117

Signed-off-by: Aleksander Mistewicz <amistewicz@google.com>

gandro removed their request for review July 27, 2023 15:28

jibi reviewed Aug 1, 2023

View reviewed changes

AwesomePatrol commented Aug 1, 2023

View reviewed changes

AwesomePatrol marked this pull request as draft August 2, 2023 08:06

AwesomePatrol mentioned this pull request Aug 3, 2023

CFP-2023-05-17: Hubble Flow Logs #25508

Closed

github-actions bot added the stale The stale bot thinks this issue is old. Add "pinned" label to prevent this from becoming stale. label Sep 2, 2023

github-actions bot closed this Sep 16, 2023

AwesomePatrol mentioned this pull request Sep 19, 2023

Add CiliumFlowLog CRD #28220

Closed

		@@ -637,6 +639,8 @@ func newDaemon(ctx context.Context, cleaner daemonCleanup, params daemonParams

		d.cgroupManager = manager.NewCgroupManager()

		d.hubbleExporterManager = exporter.NewManager(d.ctx)

Add CiliumFlowLogging configuring Hubble-exporters #26646

Add CiliumFlowLogging configuring Hubble-exporters #26646

Uh oh!

Conversation

AwesomePatrol commented Jul 5, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

AwesomePatrol commented Jul 26, 2023

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Sep 2, 2023

Uh oh!

github-actions bot commented Sep 16, 2023

Uh oh!

Uh oh!

AwesomePatrol commented Jul 5, 2023 •

edited

Loading