NETOBSERV-330 Provide a way to filter Kubernetes-related flows

[jpinsonneau]

Added Traffic Scope query options:

• Infrastructure
• Applications
• Both

It uses regex (kube-|openshift-).* with matches / does not matches operators on both SrcNamespace and DstNamespace

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please ask for approval from jpinsonneau after the PR has been reviewed.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[jpinsonneau]

I found a bug while implementing this https://issues.redhat.com/browse/NETOBSERV-399

[jotak]

what about traffic from infra to apps, or from apps to infra? I dont' know if it should be included in the "apps" traffic... thoughts? cc @stleerh @eranra
That being said, maybe it's not as easy as it sounds to implement in logQL... not sure

[eranra]

what about traffic from infra to apps, or from apps to infra? I dont' know if it should be included in the "apps" traffic... thoughts? cc @stleerh @eranra That being said, maybe it's not to as easy as implement as it sounds, in logQL... not sure

My thoughts:

If 'infra' is involved (src or dst or both) it should be 'infra'
If 'app' is involved (src or dst or both) and only if 'infra' is not involved ( this includes:: 'app' to 'app', 'app' to internet, and 'internet' to 'app') it should be 'app'

BTW: This applies to services and pods

Hope this helps

[stleerh]

I think anywhere that 'app' appears should be included as "apps" traffic.  Otherwise, you will miss router -> app.

[jotak]

I think anywhere that 'app' appears should be included as "apps" traffic. Otherwise, you will miss router -> app.

Exactly, we're missing ingress traffic coming to the application, that's the main issue with this approach I think

[jpinsonneau]

I think anywhere that 'app' appears should be included as "apps" traffic.  Otherwise, you will miss router -> app.

Ok I'm digging in that direction now and see a lot of noise coming from kubernetes API (default namespace).

Should we filter openshift related content that uses API ? It's a nonsense for me to see it here.

[jpinsonneau]

@stleerh @jotak @eranra I would suggest to add a configurable regex that match ingress namespace. Default value: .*-ingress$

With that we can force these to appear in the application view:

[jotak]

@stleerh @jotak @eranra I would suggest to add a configurable regex that match ingress namespace. Default value: .*-ingress$

Good idea :)

[openshift-ci]

@jpinsonneau: PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[jotak]

thanks @jpinsonneau
/lgtm

[jpinsonneau]

/approved