Loading...

XML

Word

Printable

Details

Type: Story
Resolution: Done
Priority: Normal
Fix Version/s: netobserv-1.5
Affects Version/s: netobserv-1.4-candidate
Component/s: eBPF
Labels:
- pre-merge-tested

Blocked:
False
Blocked Reason:
None
Ready:
False
Epic Link:
dns-tracking-1.5
Feature Link:
OCPSTRAT-965 - DNS tracking improvements
Release Note Text:
Modified DNS tracking ebpf logic from release 1.4 to be able to support DNS over TCP, the new approach doesn't need to set privileged however to get an accurate latency its recommended to configure ebpf sampling with value of 1

Sprint:
NetObserv - Sprint 240, NetObserv - Sprint 241, NetObserv - Sprint 242, NetObserv - Sprint 243, NetObserv - Sprint 244

SFDC Cases Links:
SFDC Cases Counter:

Description

.Configure a pod with following spec, notice dnsConfig option to enable openshift-dns server to use TCP:

apiVersion: v1
kind: Pod
metadata:
  name: dnsutils
  namespace: dns-traffic
spec:
  securityContext:
    runAsNonRoot: true
    seccompProfile:
      type: RuntimeDefault
  dnsConfig:
    options:
      - name: "use-vc"
  containers:
    - name: utils
      image: tutum/dnsutils
      command: ["/bin/sh", "-ec", "while :; do dig www.google.com +tcp ; sleep 5 ; done"]
      restartPolicy: Never
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop: ["ALL"]

DNS flows generated out of this Pod is not enriched by DNS Info by agent.

on UI, make sure you select "Show Duplicates" and NS as destination where above pod is running