Chapter 24. Network Observer Configuration Reference

24.1. External access
Copy link

24.1.1. Ingress
Copy link

Expand

Path	Type	Default	Description
`ingress.enabled`	bool	`false`	Enable Kubernetes Ingress resource
`ingress.className`	string	`""`	IngressClass name (e.g., `nginx`, `traefik`)
`ingress.annotations`	map	`{}`	Annotations for Ingress resource
`ingress.hosts`	array	`[]`	Host configurations
`ingress.hosts[].host`	string	-	Hostname
`ingress.hosts[].paths`	array	-	Path configurations
`ingress.hosts[].paths[].path`	string	-	URL path
`ingress.hosts[].paths[].pathType`	string	-	`Prefix`, `Exact`, or `ImplementationSpecific`
`ingress.tls`	array	`[]`	TLS configurations
`ingress.tls[].secretName`	string	-	TLS certificate Secret name
`ingress.tls[].hosts`	array	-	Hostnames for this certificate

Notes:

Backend always uses HTTPS (re-encryption required)
Controller must support TLS backend

24.1.2. Route (OpenShift)
Copy link

Expand

Path	Type	Default	Description
`route.enabled`	bool	`false`	Enable OpenShift Route resource
`route.host`	string	`""`	Explicit hostname
`route.subdomain`	string	`""`	Subdomain for automatic FQDN
`route.annotations`	map	`{}`	Route annotations
`route.labels`	map	`{}`	Route labels

Notes:

Automatically uses reencrypt TLS termination
Use host OR subdomain, not both
OpenShift only

24.2. Authentication
Copy link

Expand

Path	Type	Default	Description
`auth.strategy`	string	`"basic"`	Authentication strategy: `basic`, `openshift`, `none`

24.2.1. Basic Authentication
Copy link

Expand

Path	Type	Default	Description
`auth.basic.create`	bool	`true`	Auto-generate htpasswd Secret with random password
`auth.basic.secretName`	string	`""`	Existing htpasswd Secret name (requires `htpasswd` key)

Generated credentials:

Username: skupper
Password: Random 16-character string (stored in Secret)

24.2.2. OpenShift OAuth
Copy link

Expand

Path	Type	Default	Description
`auth.openshift.createCookieSecret`	bool	`true`	Auto-generate session cookie secret
`auth.openshift.cookieSecretName`	string	`""`	Existing cookie Secret name
`auth.openshift.serviceAccount.create`	bool	`true`	Create ServiceAccount for OAuth
`auth.openshift.serviceAccount.nameOverride`	string	`""`	Custom ServiceAccount name

Requirements:

OpenShift cluster
RBAC permissions for delegated authentication

24.3. TLS Certificates
Copy link

Expand

Path	Type	Default	Description
`tls.skupperIssued`	bool	`true`	Use Skupper controller CA (default)
`tls.openshiftIssued`	bool	`false`	Use OpenShift Service CA
`tls.secretName`	string	`""`	Existing TLS Secret name

Priority: secretName > openshiftIssued > skupperIssued

Methods:

Skupper-issued: Auto-provisioned by controller, uses same CA as inter-site links
OpenShift Service CA: Platform-issued, automatic rotation
External: Manual management, Secret type kubernetes.io/tls

24.4. Router Connection
Copy link

Expand

Path	Type	Default	Description
`router.endpoint`	string	`"amqps://skupper-router-local"`	AMQP endpoint URL
`router.certificate.create`	bool	`true`	Auto-create client certificate
`router.certificate.nameOverride`	string	`""`	Custom certificate name

Notes:

Endpoint must use amqps:// scheme
Client certificate provisioned by Skupper controller
Certificate mounted at /etc/messaging/

24.5. Network Observer Tuning
Copy link

Expand

Path	Type	Default	Description
`extraArgs`	array	`[]`	Command-line flags for observer container

Available flags:

Expand

Flag	Type	Default	Description
`-enable-console`	bool	`true`	Enable web console UI
`-flow-record-ttl`	duration	`15m`	Flow record retention time
`-cors-allow-all`	bool	`false`	Allow all CORS origins (dev only)
`-vanflow-logging-profile`	string	`silent`	Vanflow logging: `silent`, `minimal`, `moderate`, `all`

Example:

extraArgs:
  - -flow-record-ttl=1h
  - -vanflow-logging-profile=minimal

24.6. Prometheus Configuration
Copy link

The Prometheus container supports custom configuration and tuning options.

24.6.1. Configuration File
Copy link

Expand

Path	Type	Default	Description
`prometheus.config`	string	embedded	Complete `prometheus.yml` content

Default scrape config:

scrape_configs:
  - job_name: 'network-observer'
    static_configs:
      - targets: ['localhost:8080']

24.6.2. Command-Line Flags
Copy link

Expand

Path	Type	Default	Description
`prometheus.extraArgs`	array	`[]`	Additional Prometheus flags

Common flags:

--storage.tsdb.retention.time=<duration>
--storage.tsdb.retention.size=<bytes>
--query.max-samples=<int>

Example:

prometheus:
  extraArgs:
    - --storage.tsdb.retention.time=15d
    - --storage.tsdb.retention.size=10GB

24.6.3. Extra Volumes and Mounts
Copy link

Expand

Path	Type	Default	Description
`prometheus.extraVolumes`	array	`[]`	Additional volumes (Kubernetes volume spec)
`prometheus.extraVolumeMounts`	array	`[]`	Volume mount points (Kubernetes volumeMount spec)

Example:

prometheus:
  extraVolumes:
    - name: extra-config
      configMap:
        name: prometheus-rules
  extraVolumeMounts:
    - name: extra-config
      mountPath: /etc/prometheus/rules

24.7. Data Persistence
Copy link

By default, Prometheus uses ephemeral storage (emptyDir). For persistent time-series data, enable a PersistentVolumeClaim.

24.7.1. Persistence Options
Copy link

Expand

Path	Type	Default	Description
`prometheus.persistence.enabled`	bool	`false`	Enable persistent storage
`prometheus.persistence.storageClass`	string	`""`	StorageClass name (empty = default)
`prometheus.persistence.size`	string	`8Gi`	PVC size
`prometheus.persistence.accessModes`	array	`["ReadWriteOnce"]`	PVC access modes

Behavior:

Disabled: Uses emptyDir (ephemeral)
Enabled: Creates PVC, uses Recreate deployment strategy

Prerequisites

A StorageClass that can provision PersistentVolumes, or a default StorageClass configured in your cluster

Procedure

Configure persistence in your values file:

prometheus:
  persistence:
    enabled: true
    storageClass: ""   # Use default StorageClass
    size: 8Gi
    accessModes:
      - ReadWriteOnce

Install or upgrade the chart with your values:

helm upgrade --install skupper-network-observer oci://quay.io/skupper/helm/network-observer --version {{skupper_cli_version}} -f values.yaml

Verify the PersistentVolumeClaim is bound:

kubectl get pvc

Example output:

NAME                                    STATUS   VOLUME                                     CAPACITY   ACCESS MODES   STORAGECLASS   AGE
skupper-network-observer-prometheus-0   Bound    pvc-a1b2c3d4-e5f6-7890-abcd-ef1234567890   8Gi        RWO            standard       2m

Important

When persistence is enabled, the Deployment uses a Recreate update strategy to ensure the single read-write volume can attach cleanly during pod updates.

24.8. Container Resources
Copy link

Resource requests and limits can be configured for each container in the Pod.

24.8.1. Network Observer Container
Copy link

Expand

Path	Type	Default	Description
`containerResources.networkObserver.requests.cpu`	string	-	CPU request
`containerResources.networkObserver.requests.memory`	string	-	Memory request
`containerResources.networkObserver.limits.cpu`	string	-	CPU limit
`containerResources.networkObserver.limits.memory`	string	-	Memory limit

24.8.2. Prometheus Container
Copy link

Expand

Path	Type	Default	Description
`containerResources.prometheus.requests.cpu`	string	-	CPU request
`containerResources.prometheus.requests.memory`	string	-	Memory request
`containerResources.prometheus.limits.cpu`	string	-	CPU limit
`containerResources.prometheus.limits.memory`	string	-	Memory limit

24.8.3. Proxy Container
Copy link

Expand

Path	Type	Default	Description
`containerResources.proxy.requests.cpu`	string	-	CPU request
`containerResources.proxy.requests.memory`	string	-	Memory request
`containerResources.proxy.limits.cpu`	string	-	CPU limit
`containerResources.proxy.limits.memory`	string	-	Memory limit

Example:

containerResources:
  networkObserver:
    requests:
      cpu: 200m
      memory: 512Mi
    limits:
      cpu: 1000m
      memory: 1Gi
  prometheus:
    requests:
      cpu: 500m
      memory: 1Gi
    limits:
      cpu: 2000m
      memory: 4Gi
  proxy:
    requests:
      cpu: 50m
      memory: 64Mi
    limits:
      cpu: 200m
      memory: 256Mi

24.9. Container Images
Copy link

24.9.1. Network Observer Image
Copy link

Expand

Path	Type	Default	Description
`image.repository`	string	`quay.io/skupper/network-observer`	Image repository
`image.tag`	string	chart appVersion	Image tag
`image.pullPolicy`	string	`Always`	Pull policy

24.9.2. Prometheus Image
Copy link

Expand

Path	Type	Default	Description
`prometheus.repository`	string	`quay.io/prometheus/prometheus`	Image repository
`prometheus.tag`	string	`v3.11.3`	Image tag
`prometheus.pullPolicy`	string	`IfNotPresent`	Pull policy

24.9.3. NGINX Proxy Image
Copy link

Used when auth.strategy is basic or none:

Expand

Path	Type	Default	Description
`nginx.repository`	string	`mirror.gcr.io/nginxinc/nginx-unprivileged`	Image repository
`nginx.tag`	string	`1.31.0-alpine`	Image tag
`nginx.pullPolicy`	string	`IfNotPresent`	Pull policy
`nginx.command`	array	`[]`	Override default command

24.9.4. OpenShift OAuth Proxy Image
Copy link

Used when auth.strategy is openshift:

Expand

Path	Type	Default	Description
`openshiftOauthProxy.repository`	string	`quay.io/openshift/origin-oauth-proxy`	Image repository
`openshiftOauthProxy.tag`	string	`4.22.0`	Image tag
`openshiftOauthProxy.pullPolicy`	string	`IfNotPresent`	Pull policy

24.10. Labels and Annotations
Copy link

Expand

Path	Type	Default	Description
`commonLabels`	map	`{}`	Labels on all resources
`commonAnnotations`	map	`{}`	Annotations on all resources
`podLabels`	map	`{}`	Labels on Pod resources only
`podAnnotations`	map	`{}`	Annotations on Pod resources only

Standard labels (always present):

app.kubernetes.io/name: network-observer
app.kubernetes.io/instance: <name>
app.kubernetes.io/version: <version>
app.kubernetes.io/managed-by: Helm or network-observer-operator

Example:

commonLabels:
  environment: production
  team: platform-engineering
  cost-center: "12345"

commonAnnotations:
  owner: "platform-team@company.com"
  docs: "https://wiki.company.com/network-observer"

podLabels:
  app.kubernetes.io/tier: monitoring

podAnnotations:
  prometheus.io/scrape: "false"

24.11. Service
Copy link

Expand

Path	Type	Default	Description
`service.type`	string	`ClusterIP`	Service type: `ClusterIP`, `LoadBalancer`, `NodePort`
`service.port`	int	`443`	External port

Notes:

targetPort always https (8443)
Metrics service always ClusterIP on port 9000

24.12. Security
Copy link

24.12.1. Pod Security Context
Copy link

Expand

Path	Type	Default	Description
`podSecurityContext.seccompProfile.type`	string	`RuntimeDefault`	Seccomp profile

24.12.2. Container Security Contexts
Copy link

Available for: securityContext, prometheus.securityContext, nginx.securityContext, openshiftOauthProxy.securityContext

Expand

Path	Type	Default	Description
`.allowPrivilegeEscalation`	bool	`false`	Allow privilege escalation
`.capabilities.drop`	array	`["ALL"]`	Capabilities to drop

24.13. Advanced Options
Copy link

24.13.1. Name Overrides
Copy link

Expand

Path	Type	Default	Description
`nameOverride`	string	`""`	Override chart name
`fullnameOverride`	string	`""`	Override full resource name

24.13.2. Skip Management Labels
Copy link

Expand

Path	Type	Default	Description
`skipManagementLabels`	bool	`false`	Skip Skupper management labels

24.14. Metrics Endpoint
Copy link

The Network Observer serves Prometheus metrics on a dedicated HTTP listener, separate from the main API endpoint.

Listener Configuration:

Address: :9000 (container-wide)
Path: /metrics
Protocol: HTTP (no TLS/auth)

Service:

Name: <name>-metrics
Type: ClusterIP
Port: 9000 9000

Security: Cluster-internal only. Do not expose publicly.

24.14.1. Metrics Service
Copy link

The chart creates a second ClusterIP Service named <release-name>-metrics that targets the metrics listener on port 9000.

Expand

Property	Value
Listener address	`:9000`
Service name	`<release-name>-metrics`
Service port	`9000`
Metrics path	`/metrics`

24.14.2. Scraping Metrics
Copy link

Configure your Prometheus instance or monitoring operator to scrape the metrics endpoint.

ServiceMonitor example (Prometheus Operator):

apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: skupper-network-observer
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: network-observer
  endpoints:
    - port: metrics
      path: /metrics

Static scrape configuration:

scrape_configs:
  - job_name: 'network-observer'
    static_configs:
      - targets: ['skupper-network-observer-metrics.default.svc:9000']

Security note: The metrics Service is ClusterIP by default and does not include the TLS proxy or authentication that protects the main console endpoint. Do not expose this Service publicly without additional access controls if your metrics contain sensitive data.

24.15. Validation and Troubleshooting
Copy link

24.15.1. Verify Services
Copy link

Check that both Services are created:

kubectl get svc -l app.kubernetes.io/name=network-observer

Example output:

NAME                              TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)    AGE
skupper-network-observer          ClusterIP   10.96.123.45    <none>        443/TCP    5m
skupper-network-observer-metrics  ClusterIP   10.96.123.46    <none>        9000/TCP   5m

24.15.2. Test Metrics Endpoint
Copy link

From a pod in the same namespace:

kubectl run -it --rm curl --image=curlimages/curl --restart=Never -- curl -sS http://skupper-network-observer-metrics:9000/metrics

Example output:

# HELP skupper_network_observer_info Network Observer build information
# TYPE skupper_network_observer_info gauge
skupper_network_observer_info{version="2.2.0"} 1
...

24.15.3. Check Observer Logs
Copy link

Look for the metrics listener startup message:

kubectl logs deployment/skupper-network-observer -c network-observer

Example output:

2025/03/15 10:23:45 Starting metrics server on :9000
2025/03/15 10:23:45 Starting API server on 127.0.0.1:8080

24.15.4. Verify Prometheus Configuration
Copy link

If the embedded Prometheus shows no data, check the ConfigMap:

kubectl get configmap skupper-network-observer-prometheus-config -o yaml

Ensure the prometheus.yml content is valid and the scrape target matches the observer’s API listener (localhost:8080).

24.15.5. PersistentVolumeClaim Issues
Copy link

If the pod remains in Pending state with persistence enabled:

kubectl describe pvc skupper-network-observer-prometheus-0

Look for events indicating StorageClass issues, volume provisioning failures, or capacity constraints.

24.1. External accessCopy linkLink copied to clipboard!

24.1.1. IngressCopy linkLink copied to clipboard!

24.1.2. Route (OpenShift)Copy linkLink copied to clipboard!

24.2. AuthenticationCopy linkLink copied to clipboard!

24.2.1. Basic AuthenticationCopy linkLink copied to clipboard!

24.2.2. OpenShift OAuthCopy linkLink copied to clipboard!

24.3. TLS CertificatesCopy linkLink copied to clipboard!

24.4. Router ConnectionCopy linkLink copied to clipboard!

24.5. Network Observer TuningCopy linkLink copied to clipboard!

24.6. Prometheus ConfigurationCopy linkLink copied to clipboard!

24.6.1. Configuration FileCopy linkLink copied to clipboard!

24.6.2. Command-Line FlagsCopy linkLink copied to clipboard!

24.6.3. Extra Volumes and MountsCopy linkLink copied to clipboard!

24.7. Data PersistenceCopy linkLink copied to clipboard!

24.7.1. Persistence OptionsCopy linkLink copied to clipboard!

24.8. Container ResourcesCopy linkLink copied to clipboard!

24.8.1. Network Observer ContainerCopy linkLink copied to clipboard!

24.8.2. Prometheus ContainerCopy linkLink copied to clipboard!

24.8.3. Proxy ContainerCopy linkLink copied to clipboard!

24.9. Container ImagesCopy linkLink copied to clipboard!

24.9.1. Network Observer ImageCopy linkLink copied to clipboard!

24.9.2. Prometheus ImageCopy linkLink copied to clipboard!

24.9.3. NGINX Proxy ImageCopy linkLink copied to clipboard!

24.9.4. OpenShift OAuth Proxy ImageCopy linkLink copied to clipboard!

24.10. Labels and AnnotationsCopy linkLink copied to clipboard!

24.11. ServiceCopy linkLink copied to clipboard!

24.12. SecurityCopy linkLink copied to clipboard!

24.12.1. Pod Security ContextCopy linkLink copied to clipboard!

24.12.2. Container Security ContextsCopy linkLink copied to clipboard!

24.13. Advanced OptionsCopy linkLink copied to clipboard!

24.13.1. Name OverridesCopy linkLink copied to clipboard!

24.13.2. Skip Management LabelsCopy linkLink copied to clipboard!

24.14. Metrics EndpointCopy linkLink copied to clipboard!

24.14.1. Metrics ServiceCopy linkLink copied to clipboard!

24.14.2. Scraping MetricsCopy linkLink copied to clipboard!

24.15. Validation and TroubleshootingCopy linkLink copied to clipboard!

24.15.1. Verify ServicesCopy linkLink copied to clipboard!

24.15.2. Test Metrics EndpointCopy linkLink copied to clipboard!

24.15.3. Check Observer LogsCopy linkLink copied to clipboard!

24.15.4. Verify Prometheus ConfigurationCopy linkLink copied to clipboard!

24.15.5. PersistentVolumeClaim IssuesCopy linkLink copied to clipboard!

Learn

Try, buy, & sell

Communities

About Red Hat

Making open source more inclusive

About Red Hat Documentation

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links

24.1. External access
Copy link

24.1.1. Ingress
Copy link

24.1.2. Route (OpenShift)
Copy link

24.2. Authentication
Copy link

24.2.1. Basic Authentication
Copy link

24.2.2. OpenShift OAuth
Copy link

24.3. TLS Certificates
Copy link

24.4. Router Connection
Copy link

24.5. Network Observer Tuning
Copy link

24.6. Prometheus Configuration
Copy link

24.6.1. Configuration File
Copy link

24.6.2. Command-Line Flags
Copy link

24.6.3. Extra Volumes and Mounts
Copy link

24.7. Data Persistence
Copy link

24.7.1. Persistence Options
Copy link

24.8. Container Resources
Copy link

24.8.1. Network Observer Container
Copy link

24.8.2. Prometheus Container
Copy link

24.8.3. Proxy Container
Copy link

24.9. Container Images
Copy link

24.9.1. Network Observer Image
Copy link

24.9.2. Prometheus Image
Copy link

24.9.3. NGINX Proxy Image
Copy link

24.9.4. OpenShift OAuth Proxy Image
Copy link

24.10. Labels and Annotations
Copy link

24.11. Service
Copy link

24.12. Security
Copy link

24.12.1. Pod Security Context
Copy link

24.12.2. Container Security Contexts
Copy link

24.13. Advanced Options
Copy link

24.13.1. Name Overrides
Copy link

24.13.2. Skip Management Labels
Copy link

24.14. Metrics Endpoint
Copy link

24.14.1. Metrics Service
Copy link

24.14.2. Scraping Metrics
Copy link

24.15. Validation and Troubleshooting
Copy link

24.15.1. Verify Services
Copy link

24.15.2. Test Metrics Endpoint
Copy link

24.15.3. Check Observer Logs
Copy link

24.15.4. Verify Prometheus Configuration
Copy link

24.15.5. PersistentVolumeClaim Issues
Copy link