Skip to content

Commit 0fadd4c

Browse files
stevsmitstevsmit
authored
Merge pull request #86079 from stevsmit/OSDOCS-11793
Adds ovnk observ with ovs sampling to docs
2 parents e639d81 + b8fecbe commit 0fadd4c

File tree

4 files changed

+195
-1
lines changed

4 files changed

+195
-1
lines changed

‎modules/nodes-cluster-enabling-features-about.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ The following Technology Preview features are enabled by this feature set:
2929
** Dynamic Resource Allocation API. Enables a new API for requesting and sharing resources between pods and containers. This is an internal feature that most users do not need to interact with. (`DynamicResourceAllocation`)
3030
** Pod security admission enforcement. Enables the restricted enforcement mode for pod security admission. Instead of only logging a warning, pods are rejected if they violate pod security standards. (`OpenShiftPodSecurityAdmission`)
3131
** StatefulSet pod availability upgrading limits. Enables users to define the maximum number of statefulset pods unavailable during updates which reduces application downtime. (`MaxUnavailableStatefulSet`)
32+
** `OVNObservability` resource allows you to verify expected network behavior. Supports the following network APIs: `NetworkPolicy`, `AdminNetworkPolicy`, `BaselineNetworkPolicy`, `UserDefinesdNetwork` isolation, multicast ACLs, and egress firewalls. When enabled, you can view network events in the terminal.
3233
** `gcpLabelsTags`
3334
** `vSphereStaticIPs`
3435
** `routeExternalCertificate`
@@ -78,7 +79,6 @@ The following Technology Preview features are enabled by this feature set:
7879
** `DNSNameResolver`
7980
** `ManagedBootImagesAWS`
8081
** `NetworkSegmentation`
81-
** `OVNObservability`
8282
** `PersistentIPsForVirtualization`
8383
** `ProcMountType`
8484
** `RouteAdvertisements`

‎modules/nw-ovn-kubernetes-observability.adoc

Lines changed: 154 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,154 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/ovn_kubernetes_network_provider/ovn-kubernetes-troubleshooting-sources.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="nw-ovn-kubernetes-observability_{context}"]
7+
= Checking OVN-Kubernetes network traffic with OVS sampling using the CLI
8+
:FeatureName: Checking OVN-Kubernetes network traffic with OVS sampling
9+
include::snippets/technology-preview.adoc[]
10+
11+
OVN-Kubernetes network traffic can be viewed with OVS sampling via the CLI for the following network APIs:
12+
13+
* `NetworkPolicy`
14+
* `AdminNetworkPolicy`
15+
* `BaselineNetworkPolicy`
16+
* `UserDefinesdNetwork` isolation
17+
* `EgressFirewall`
18+
* Multicast ACLs.
19+
20+
Scripts for these networking events are found in the `/usr/bin/ovnkube-observ` path of each OVN-Kubernetes node.
21+
22+
Although both the Network Observability Operator and checking OVN-Kubernetes network traffic with OVS sampling are good for debuggability, the Network Observability Operator is intended for observing network events. Alternatively, checking OVN-Kubernetes network traffic with OVS sampling using the CLI is intended to help with packet tracing; it can also be used while the Network Observability Operator is installed, however that is not a requirement.
23+
24+
Administrators can add the `--add-ovs-collect` option to view network traffic across the node, or pass in additional flags to filter result for specific pods. Additional flags can be found in the "OVN-Kubernetes network traffic with OVS sampling flags" section.
25+
26+
Use the following procedure to view OVN-Kubernetes network traffic using the CLI.
27+
28+
.Prerequisites
29+
30+
* You are logged in to the cluster as a user with `cluster-admin` privileges.
31+
* You have created a source pod and a destination pod and ran traffic between them.
32+
* You have created at least one of the following network APIs: `NetworkPolicy`, `AdminNetworkPolicy`, `BaselineNetworkPolicy`, `UserDefinesdNetwork` isolation, multicast, or egress firewalls.
33+
34+
.Procedure
35+
36+
. To enable the `OVNObservability` with OVS sampling feature, enable `TechPreviewNoUpgrade` feature set in the `FeatureGate` CR named `cluster` by entering the following command:
37+
+
38+
[source,terminal]
39+
----
40+
$ oc patch --type=merge --patch '{"spec": {"featureSet": "TechPreviewNoUpgrade"}}' featuregate/cluster
41+
----
42+
+
43+
.Example output
44+
+
45+
[source,terminal]
46+
----
47+
featuregate.config.openshift.io/cluster patched
48+
----
49+
50+
. Confirm that the `OVNObservability` feature is enabled by entering the following command:
51+
+
52+
[source,terminal]
53+
----
54+
$ oc get featuregate cluster -o yaml
55+
----
56+
+
57+
.Example output
58+
+
59+
[source,yaml]
60+
----
61+
featureGates:
62+
# ...
63+
enabled:
64+
- name: OVNObservability
65+
----
66+
67+
. Obtain a list of the pods inside of the namespace in which you have created one of the relevant network APIs by entering the following command. Note the `NODE` name of the pods, as they are used in the following step.
68+
+
69+
[source,terminal]
70+
----
71+
$ oc get pods -n <namespace> -o wide
72+
----
73+
+
74+
.Example output
75+
+
76+
[source,terminal]
77+
----
78+
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
79+
destination-pod 1/1 Running 0 53s 10.131.0.23 ci-ln-1gqp7b2-72292-bb9dv-worker-a-gtmpc <none> <none>
80+
source-pod 1/1 Running 0 56s 10.131.0.22 ci-ln-1gqp7b2-72292-bb9dv-worker-a-gtmpc <none> <none>
81+
----
82+
83+
. Obtain a list of OVN-Kubernetes pods and locate the pod that shares the same `NODE` as the pods from the previous step by entering the following command:
84+
+
85+
[source,terminal]
86+
----
87+
$ oc get pods -n openshift-ovn-kubernetes -o wide
88+
----
89+
+
90+
.Example output
91+
+
92+
[source,terminal]
93+
----
94+
NAME
95+
... READY STATUS RESTARTS AGE IP NODE NOMINATED NODE
96+
ovnkube-node-jzn5b 8/8 Running 1 (34m ago) 37m 10.0.128.2 ci-ln-1gqp7b2-72292-bb9dv-worker-a-gtmpc <none>
97+
...
98+
----
99+
100+
. Open a bash shell inside of the `ovnkube-node` pod by entering the following command:
101+
+
102+
[source,terminal]
103+
----
104+
$ oc exec -it <pod_name> -n openshift-ovn-kubernetes -- bash
105+
----
106+
107+
. While inside of the `ovnkube-node` pod, you can run the `ovnkube-observ -add-ovs-collector` script to show network events using the OVS collector. For example:
108+
+
109+
[source,terminal]
110+
----
111+
# /usr/bin/ovnkube-observ -add-ovs-collector
112+
----
113+
+
114+
.Example output
115+
+
116+
[source,terminal]
117+
----
118+
...
119+
2024/12/02 19:41:41.327584 OVN-K message: Allowed by default allow from local node policy, direction ingress
120+
2024/12/02 19:41:41.327593 src=10.131.0.2, dst=10.131.0.6
121+
122+
2024/12/02 19:41:41.327692 OVN-K message: Allowed by default allow from local node policy, direction ingress
123+
2024/12/02 19:41:41.327715 src=10.131.0.6, dst=10.131.0.2
124+
...
125+
----
126+
127+
. You can filter the content by type, such as source pods, by entering the following command with the `-filter-src-ip` flag and your pod's IP address. For example:
128+
+
129+
[source,terminal]
130+
----
131+
# /usr/bin/ovnkube-observ -add-ovs-collector -filter-src-ip <pod_ip_address>
132+
----
133+
+
134+
.Example output
135+
+
136+
[source,terminal]
137+
----
138+
...
139+
Found group packets, id 14
140+
2024/12/10 16:27:12.456473 OVN-K message: Allowed by admin network policy allow-egress-group1, direction Egress
141+
2024/12/10 16:27:12.456570 src=10.131.0.22, dst=10.131.0.23
142+
143+
2024/12/10 16:27:14.484421 OVN-K message: Allowed by admin network policy allow-egress-group1, direction Egress
144+
2024/12/10 16:27:14.484428 src=10.131.0.22, dst=10.131.0.23
145+
146+
2024/12/10 16:27:12.457222 OVN-K message: Allowed by network policy test:allow-ingress-from-specific-pod, direction Ingress
147+
2024/12/10 16:27:12.457228 src=10.131.0.22, dst=10.131.0.23
148+
149+
2024/12/10 16:27:12.457288 OVN-K message: Allowed by network policy test:allow-ingress-from-specific-pod, direction Ingress
150+
2024/12/10 16:27:12.457299 src=10.131.0.22, dst=10.131.0.23
151+
...
152+
----
153+
+
154+
For a full list of flags that can be passed in with `/usr/bin/ovnkube-observ`, see "OVN-Kubernetes network traffic with OVS sampling flags".

‎modules/observability-ovs-sampling-flags.adoc

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/ovn_kubernetes_network_provider/ovn-kubernetes-troubleshooting-sources.adoc
4+
5+
:_mod-docs-content-type: REFERENCE
6+
[id="observability-ovs-sampling-flags_{context}"]
7+
= OVN-Kubernetes network traffic with OVS sampling flags
8+
9+
The following flags are available to view OVN-Kubernetes network traffic by using the CLI. Append these flags to the following syntax in your terminal after you have opened a bash shell inside of the `ovnkube-node` pod:
10+
11+
.Command syntax
12+
[source,terminal]
13+
----
14+
# /usr/bin/ovnkube-observ <flag>
15+
----
16+
17+
[options="header",cols="1,3"]
18+
|===
19+
| Flag | Description
20+
21+
| `-h` | Returns a complete list flags that can be used with the `usr/bin/ovnkube-observ` command.
22+
`
23+
|`-add-ovs-collector` | Add OVS collector to enable sampling. Use with caution. Make sure no one else is using observability.
24+
25+
|`-enable-enrichment` | Enrich samples with NBDB data. Defaults to `true`.
26+
27+
|`-filter-dst-ip` | Filter only packets to a given destination IP.
28+
29+
|`-filter-src-ip` | Filters only packets from a given source IP.
30+
31+
|`-log-cookie` | Print raw sample cookie with psample group_id.
32+
33+
|`-output-file` | Output file to write the samples to.
34+
35+
|`-print-full-packet` | Print full received packet. When false, only source and destination IPs are printed with every sample.
36+
37+
|===

‎networking/ovn_kubernetes_network_provider/ovn-kubernetes-troubleshooting-sources.adoc

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,9 @@ include::modules/nw-ovn-kubernetes-change-log-levels.adoc[leveloffset=+2]
2727

2828
include::modules/nw-ovn-kubernetes-pod-connectivity-checks.adoc[leveloffset=+1]
2929

30+
include::modules/nw-ovn-kubernetes-observability.adoc[leveloffset=+1]
31+
include::modules/observability-ovs-sampling-flags.adoc[leveloffset=+2]
32+
3033
[role="_additional-resources"]
3134
[id="additional-resources_ovn-kubernetes-sources-of-troubleshooting-information"]
3235
== Additional resources

0 commit comments

Comments
 (0)