Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow more generic use of the IPFIX exporter #632

Open
jotak opened this issue Mar 14, 2024 · 0 comments
Open

Allow more generic use of the IPFIX exporter #632

jotak opened this issue Mar 14, 2024 · 0 comments

Comments

@jotak
Copy link
Member

jotak commented Mar 14, 2024

Currently the IPFIX exporter in FLP is very tied to the Agent/protobuf input and could crash when used in a different context, due to the assumptions done when casting elements from GenericMap.

It is also tied to the configuration defined in the operator, for instance assuming k8s fields are prefixed with "SrcK8S_" or "DstK8S_", which shouldn't be hard-coded.

It should be made more generic.


Here's an example that today doesn't work:

  1. Start a first FLP that reads from IPFIX and write to stdout, using this stdout.yaml:
pipeline:
  - name: ingest
  - name: write
    follows: ingest
parameters:
  - name: ingest
    ingest:
      type: collector
      collector:
        hostName: 0.0.0.0
        port: 2057
  - name: write
    write:
      type: stdout
./flowlogs-pipeline --config ./stdout.yaml
  1. Start a second FLP that reads from (agent) IPFIX and rewrite as IPFIX, using this ipfix-relay.yaml
pipeline:
  - name: ingest
  - name: write
    follows: ingest
parameters:
  - name: ingest
    ingest:
      type: collector
      collector:
        hostName: 0.0.0.0
        port: 2055
  - name: write
    write:
      type: ipfix
      ipfix:
        targetHost: 0.0.0.0
        targetPort: 2057
        transport: udp
        enterpriseID: 0
metricsSettings:
  port: 9091
./flowlogs-pipeline --config ./ipfix-relay.yaml --health.port 8081
  1. Start the agent:
export EXPORT="ipfix+udp"
export FLOWS_TARGET_HOST="0.0.0.0"
export FLOWS_TARGET_PORT="2055"
sudo -E bin/netobserv-ebpf-agent

=>

You'll get errors like:

panic: interface conversion: interface {} is uint64, not int64

goroutine 84 [running]:
github.com/netobserv/flowlogs-pipeline/pkg/pipeline/write.setStandardIEValue(0xc00043a800?, 0xc00035a460?)
	/w/flowlogs-pipeline/pkg/pipeline/write/write_ipfix.go:325 +0x1054
github.com/netobserv/flowlogs-pipeline/pkg/pipeline/write.setEntities(0x7f74a0af5400?, 0x0, 0x0?)
	/w/flowlogs-pipeline/pkg/pipeline/write/write_ipfix.go:403 +0x74
github.com/netobserv/flowlogs-pipeline/pkg/pipeline/write.(*writeIpfix).sendDataRecord(0xc000125380, 0xc0003c0090?, 0x0)
	/w/flowlogs-pipeline/pkg/pipeline/write/write_ipfix.go:424 +0xfa
github.com/netobserv/flowlogs-pipeline/pkg/pipeline/write.(*writeIpfix).Write(0xc00065ceb0?, 0x494a0f?)
	/w/flowlogs-pipeline/pkg/pipeline/write/write_ipfix.go:460 +0x20d

.. because of the assumptions about types in GenericMap

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant