Skip to content

Commit fe83438

Browse files
meretamereta
committed
hubble: Adding an option for enabling L3/L4 net pol enrichment of Hubble Flows
1 parent 207abad commit fe83438

16 files changed

Lines changed: 204 additions & 18 deletions

File tree

‎Documentation/cmdref/cilium-agent.md‎

Lines changed: 1 addition & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Documentation/cmdref/cilium-agent_hive.md‎

Lines changed: 1 addition & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Documentation/cmdref/cilium-agent_hive_dot-graph.md‎

Lines changed: 1 addition & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Documentation/helm-values.rst‎

Lines changed: 4 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎install/kubernetes/cilium/README.md‎

Lines changed: 1 addition & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎install/kubernetes/cilium/templates/cilium-configmap.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -981,6 +981,9 @@ data:
981981
enable-hubble-open-metrics: {{ .Values.hubble.metrics.enableOpenMetrics | quote }}
982982
{{- end }}
983983

984+
{{- if hasKey .Values.hubble.l3l4netpolenrichment "enabled" }}
985+
hubble-l3l4-net-pol-enrichment-enabled: {{ .Values.hubble.l3l4netpolenrichment.enabled | quote }}
986+
{{- end }}
984987
{{- if .Values.hubble.redact }}
985988
{{- if eq .Values.hubble.redact.enabled true }}
986989
# Enables hubble redact capabilities

‎install/kubernetes/cilium/values.schema.json‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2665,6 +2665,13 @@
26652665
},
26662666
"type": "object"
26672667
},
2668+
"l3l4netpolenrichment": {
2669+
"properties": {
2670+
"enabled": {
2671+
"type": "boolean"
2672+
}
2673+
}
2674+
},
26682675
"listenAddress": {
26692676
"type": "string"
26702677
},

‎install/kubernetes/cilium/values.yaml‎

Lines changed: 3 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎install/kubernetes/cilium/values.yaml.tmpl‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1340,6 +1340,9 @@ hubble:
13401340
excludeFilters: []
13411341
# -- Unix domain socket path to listen to when Hubble is enabled.
13421342
socketPath: /var/run/cilium/hubble.sock
1343+
# -- Enable L3/L4 network policy enrichment of Hubble Flows (true by default).
1344+
l3l4netpolenrichment:
1345+
enabled: true
13431346
# -- Enables redacting sensitive information present in Layer 7 flows.
13441347
redact:
13451348
enabled: false

‎pkg/hubble/cell/config.go‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -113,6 +113,8 @@ type config struct {
113113
K8sDropEventsInterval time.Duration `mapstructure:"hubble-drop-events-interval"`
114114
// K8sDropEventsReasons controls which drop reasons to emit events for.
115115
K8sDropEventsReasons []string `mapstructure:"hubble-drop-events-reasons"`
116+
// EnableL3L4PolicyEnrichment controls whether to enable L3/L4 network policy enrichment.
117+
EnableL3L4PolicyEnrichment bool `mapstructure:"hubble-l3l4-net-pol-enrichment-enabled"`
116118
}
117119

118120
var defaultConfig = config{
@@ -154,9 +156,10 @@ var defaultConfig = config{
154156
RedactHttpHeadersDeny: []string{},
155157
RedactKafkaAPIKey: false,
156158
// Hubble k8s v1.Events integration configuration.
157-
EnableK8sDropEvents: false,
158-
K8sDropEventsInterval: 2 * time.Minute,
159-
K8sDropEventsReasons: []string{"auth_required", "policy_denied"},
159+
EnableK8sDropEvents: false,
160+
K8sDropEventsInterval: 2 * time.Minute,
161+
K8sDropEventsReasons: []string{"auth_required", "policy_denied"},
162+
EnableL3L4PolicyEnrichment: true,
160163
}
161164

162165
func (def config) Flags(flags *pflag.FlagSet) {
@@ -205,6 +208,7 @@ func (def config) Flags(flags *pflag.FlagSet) {
205208
flags.Bool("hubble-drop-events", def.EnableK8sDropEvents, "Emit packet drop Events related to pods (alpha)")
206209
flags.Duration("hubble-drop-events-interval", def.K8sDropEventsInterval, "Minimum time between emitting same events")
207210
flags.StringSlice("hubble-drop-events-reasons", def.K8sDropEventsReasons, "Drop reasons to emit events for")
211+
flags.Bool("hubble-l3l4-net-pol-enrichment-enabled", def.EnableL3L4PolicyEnrichment, "Enable L3/L4 network policy enrichment of Hubble Flow logs")
208212
}
209213

210214
func (cfg *config) normalize() {

0 commit comments

Comments
 (0)