Problem

While testing field aggregation with source.namespace, destination.namespace, and L4/L7 protocol fields, I discovered that flows were not aggregating correctly. When a field mask included multiple oneof variants (e.g., l4.TCP.destination_port and l4.UDP.destination_port), the field mask Copy() method would create spurious empty structures for ALL specified variants, not just the active one.

This caused TCP flows to incorrectly include empty UDP structures in their aggregation keys, preventing proper aggregation even when the actual flow data was identical.

Solution

1st commit:
Modified FieldMask.Copy() to detect oneof fields using protobuf reflection (fd.ContainingOneof()) and only copy the active variant by checking WhichOneof(). This ensures that only the actual protocol present in the source flow is copied to the destination, preventing spurious structures.
This enables users to specify fine-grained oneof variant fields (e.g., l4.TCP.destination_port, l4.UDP.destination_port) in field masks for flow aggregation and export without creating incorrect aggregation keys.

Addition in 2nd commit:
Enrich Aggregated hubble flow logs with timestamp to have temporal context.
Aggregation only keeps and aggregates on the fields specified in the fieldAggregate.
There is no way to preserve a timestamp, and specifying time in fieldAggretate defeats aggregation.

The solution is to preserve the 1st occurring timestamp in the processedFlow after the aggregation key is generated.
The aggregation logic is not affected and temporal context is preserved.

Testing

• Added unit tests in fieldmask_test.go demonstrating the fix works for L4 (TCP/UDP/SCTP/ICMP) and L7 (HTTP/DNS) oneof variants
• Added integration test in aggregator_test.go showing TCP+HTTP flows now correctly aggregate when the field mask includes both TCP/UDP and HTTP/DNS paths
• All existing tests continue to pass

Manual Testing Steps:

Manual Verrification:
BYO CNI Cilium Cluster

• helm upgrade cilium cilium/cilium --version 1.19-dev
• Build local images and update cluster
• Deploy a workload that produces alot of pings to itself
• Test aggreagtion via various combinations or below.

   --set "hubble.export.dynamic.config.content[1].aggregationInterval=25s" \
   --set "hubble.export.dynamic.config.content[1].fieldMask={time,source.namespace,source.pod_name,destination.namespace,destination.pod_name,l4,IP,node_name,is_reply,verdict,drop_reason_desc}" \
   --set "hubble.export.dynamic.config.content[1].fieldAggregate={l4.TCP.destination_port,l4.UDP.destination_port,l7.http.code,l7.dns.rcode,source.workloads,destination.workloads}" \
   --set "hubble.export.dynamic.config.content[1].name=fmfix" \
   --set "hubble.export.dynamic.config.content[1].filePath=/var/run/cilium/hubble/events-fmfix.log" \
   --set "hubble.export.dynamic.config.content[1].includeFilters[0].source_pod[0]=default/" \
   --set "hubble.export.dynamic.config.content[1].includeFilters[1].destination_pod[0]=default/"

• Verification of cilium-flowlog-config ConfigMap
• Verification of logs in multiple files via node-shell
  • var/run/cilium/hubble
  • check that file names match CM
  • check for aggregation counts
  • check for config reloads
  • check setting to 0s disables aggregation

Both UDP and TCP are logged:

{"flow":{"time":"2026-01-22T16:47:11.987497620Z","l4":{"TCP":{"destination_port":40876}},"source":{"workloads":[{"name":"kapinger-bad","kind":"Deployment"}]},"destination":{"workloads":[{"name":"kapinger-good","kind":"Deployment"}]},"l7":{},"aggregate":{"egress_flow_count":3}},"time":"2026-01-22T16:47:11.987497620Z"}
{"flow":{"time":"2026-01-22T16:47:14.677500407Z","l4":{"UDP":{"destination_port":42749}},"source":{"workloads":[{"name":"coredns","kind":"Deployment"}]},"destination":{"workloads":[{"name":"kapinger-good","kind":"Deployment"}]},"l7":{},"aggregate":{"egress_flow_count":1}},"time":"2026-01-22T16:47:14.677500407Z"}

FieldMask Changes:

New ability to mask nested oneof fields.
No other changes in FM functionality.

Hubble Export FieldMask - Introduce functionality to specify multiple 'oneof' variants like l4.TCP/l4.UDP
Hubble Export Aggregation - Enrich aggregated flow logs with timestamp to preserve temporal context