Uploaded image for project: 'Network Observability'
  1. Network Observability
  2. NETOBSERV-153

Use eBPF to generate network flows

    • ebpf-netflows
    • False
    • False
    • To Do
    • 0% To Do, 0% In Progress, 100% Done
    • XL

      Spikes NETOBSERV-25 and NETOBSERV-54 were done to investigate on our potential use of eBPF. This is a follow-up.

      Currently, the network-observability-operator configures OVS to export net flows in IPFIX format. This is dependent on the CNI (here OVN-kubernetes) and has a non-negligible resource overhead.

      Switching this model to eBPF should make it CNI independent, and with less overhead. The goal of this epic is to generate similar data, ie. network flow logs, still kube-enriched, still stored in Loki, that can be used as a replacement of the OVS export + goflow collector setup.

      The network-observability-operator will be updated to enable the ebpf-based collection pipeline.

      Note: we'll split up the work and address performance optimization in a second epic: NETOBSERV-189

      As a reference, there is some previous research in this document:  https://docs.google.com/document/d/1xxh7Lnhd-yHsjgHllb231AouW4_dnBSEq8MA7L01bv4/edit#

      (In case of any inconsistency between the previous research document and the Jira issues in this EPIC, the Jira issues would prevail).

        1.
        Docs Tracker Sub-task Closed Undefined Unassigned
        2.
        TE Tracker Sub-task Closed Undefined Unassigned
        3.
        QE Tracker Sub-task Closed Undefined Mehul Modi

            mmaciasl@redhat.com Mario Macias (Inactive)
            jtakvori Joel Takvorian
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated:
              Resolved: