Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Chapter 9. Visualizing external entities

Important

Visualizing external entities is a Technology Preview feature only. Technology Preview features are not supported with Red Hat production service level agreements (SLAs) and might not be functionally complete. Red Hat does not recommend using them in production. These features provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process.

For more information about the support scope of Red Hat Technology Preview features, see Technology Preview Features Support Scope.

Understanding the interactions between your cluster and external entities is essential for incident response and network policy management. With the Visualizing external entities feature, you can view the external IP addresses that interact with your cluster.

You can view external entities in the Network Graph by selecting the External Entities graph node or query external entities by using the API.

Note

Visualizing external entities is an opt-in feature that is disabled by default. To enable this feature, you must enable external IP collection in Central and secured clusters, as described in the following sections.

9.1. Enabling external IP collection in Central
Copy link

There are two environmental variables that control the collection of external IP in Central: ROX_EXTERNAL_IPS and ROX_NETWORK_GRAPH_EXTERNAL_IPS.

You must enable ROX_EXTERNAL_IPS in Central to enable external IP collection and to query external entities by using the API. After that, you can use ROX_NETWORK_GRAPH_EXTERNAL_IPS to display collected external IPs in the Network Graph.

Procedure

  • If you installed RHACS by using the RHACS Operator, insert the following customization in the Central custom resource definition (CRD): 

    spec:
  customize:
    envVars:
      - name: ROX_EXTERNAL_IPS
    1 
    
        value: 'true'
    Copy to Clipboard Toggle word wrap
    1
    Additionally, you can also specify ROX_NETWORK_GRAPH_EXTERNAL_IPS.

  • If you installed RHACS by using Helm, add the following annotations to your values-public.yaml file: 

    customize:
  # Extra environment variables for all containers in all objects.
  envVars:
    ROX_EXTERNAL_IPS: “true”
    1
    Copy to Clipboard Toggle word wrap
    1
    Additionally, you can also specify ROX_NETWORK_GRAPH_EXTERNAL_IPS.

To enable external IP collection in secured clusters, you must individually configure each secured cluster’s runtime configuration.

You can have some clusters with the functionality enabled while others remain disabled. In this case, external IP information is only available for the clusters where you have enabled the feature.

You can use a ConfigMap object to enable the external IP collection in secured clusters.

Procedure

  • Create a ConfigMap object called collector-config with the following content: 

    apiVersion: v1
kind: ConfigMap
metadata:
  name: collector-config
  namespace: stackrox
data:
  runtime_config.yaml: |
    1 
    
    networking:
      externalIps:
        enabled: ENABLED
    2
    Copy to Clipboard Toggle word wrap
    1
    RHACS mounts this file at /etc/stackrox/runtime_config.yaml.
    2
    networking.externalIps.enable was changed to networking.externalIps.enabled in RHACS 4.7. It is an enum and can be set to ENABLED or DISABLED.

When you create or update the ConfigMap object, the collector refreshes the runtime configuration. When you delete the ConfigMap object, the settings revert to the default runtime configuration values. For more information, see Using Collector runtime configuration.

You can get information about the external IP addresses associated with a specific cluster by using the following endpoints:

  • /v1/networkgraph/cluster/{clusterId}/externalentities: This endpoint returns a list of external entities for a given cluster ID. Each entity includes the following information:

    • Name: The name of the external entity.
    • CIDR block: The CIDR block associated with the entity.
    • Default entity: Indicates that the entity is a CIDR-block definition provided by the system.
    • Discovered: If true, indicates that the external IP address does not match any specified CIDR block.
  • /v1/networkgraph/cluster/{clusterId}/externalentities/{entityId}/flows: This endpoint reports the flows to and from an external entity for a given cluster ID and entity ID. Use this endpoint to analyze network traffic patterns and gain insights into the interactions between your cluster and external entities.
  • /v1/networkgraph/cluster/{clusterId}/externalentities/metadata: This endpoint reports statistics about the external flows for a given cluster ID. It reports details about each entity, as well as the number of flows associated with it.

9.4. Known limitations
Copy link

The following are some known limitations of the Visualizing external entities feature:

  • When you enable external IP collection for a cluster, Collector in those clusters report more information to Sensor and to Central. This might create scalability issues if the workload in the cluster communicates with a large number of distinct external peers. It is recommended that you do not enable this feature on clusters with communication patterns involving more than 10,000 distinct external entities.
  • You cannot see external IP addresses if they are part of CIDR blocks.
  • When you enable external IP collection, external IP addresses might appear in a deployment’s network baseline.
Back to top
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2025 Red Hat