Ce contenu n'est pas disponible dans la langue sélectionnée.
Chapter 13. FlowCollector API reference
FlowCollector is the Schema for the network flows collection API, which pilots and configures the underlying deployments.
13.1. FlowCollector API specifications
- Description
-
FlowCollector
is the schema for the network flows collection API, which pilots and configures the underlying deployments. - Type
-
object
Property | Type | Description |
---|---|---|
|
| APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and might reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |
|
| Kind is a string value representing the REST resource this object represents. Servers might infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
|
| Standard object’s metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata |
|
|
Defines the desired state of the FlowCollector resource. *: the mention of "unsupported" or "deprecated" for a feature throughout this document means that this feature is not officially supported by Red Hat. It might have been, for example, contributed by the community and accepted without a formal agreement for maintenance. The product maintainers might provide some support for these features as a best effort only. |
13.1.1. .metadata
- Description
- Standard object’s metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
- Type
-
object
13.1.2. .spec
- Description
Defines the desired state of the FlowCollector resource.
*: the mention of "unsupported" or "deprecated" for a feature throughout this document means that this feature is not officially supported by Red Hat. It might have been, for example, contributed by the community and accepted without a formal agreement for maintenance. The product maintainers might provide some support for these features as a best effort only.
- Type
-
object
Property | Type | Description |
---|---|---|
|
| Agent configuration for flows extraction. |
|
|
|
|
|
-
- Kafka can provide better scalability, resiliency, and high availability (for more details, see https://www.redhat.com/en/topics/integration/what-is-apache-kafka). |
|
|
|
|
|
Kafka configuration, allowing to use Kafka as a broker as part of the flow collection pipeline. Available when the |
|
|
|
|
| Namespace where Network Observability pods are deployed. |
|
|
|
|
|
|
|
|
|
13.1.3. .spec.agent
- Description
- Agent configuration for flows extraction.
- Type
-
object
Property | Type | Description |
---|---|---|
|
|
|
|
|
|
13.1.4. .spec.agent.ebpf
- Description
-
ebpf
describes the settings related to the eBPF-based flow reporter whenspec.agent.type
is set toeBPF
. - Type
-
object
Property | Type | Description |
---|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
List of additional features to enable. They are all disabled by default. Enabling additional features might have performance impacts. Possible values are:
-
-
-
- |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Privileged mode for the eBPF Agent container. When ignored or set to |
|
|
|
|
| Sampling rate of the flow reporter. 100 means one flow on 100 is sent. 0 or 1 means all flows are sampled. |
13.1.5. .spec.agent.ebpf.advanced
- Description
-
advanced
allows setting some aspects of the internal configuration of the eBPF agent. This section is aimed mostly for debugging and fine-grained performance optimizations, such asGOGC
andGOMAXPROCS
env vars. Set these values at your own risk. - Type
-
object
Property | Type | Description |
---|---|---|
|
|
|
|
| scheduling controls how the pods are scheduled on nodes. |
13.1.6. .spec.agent.ebpf.advanced.scheduling
- Description
- scheduling controls how the pods are scheduled on nodes.
- Type
-
object
Property | Type | Description |
---|---|---|
|
| If specified, the pod’s scheduling constraints. For documentation, refer to https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling. |
|
|
|
|
| If specified, indicates the pod’s priority. For documentation, refer to https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/#how-to-use-priority-and-preemption. If not specified, default priority is used, or zero if there is no default. |
|
|
|
13.1.7. .spec.agent.ebpf.advanced.scheduling.affinity
- Description
- If specified, the pod’s scheduling constraints. For documentation, refer to https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling.
- Type
-
object
13.1.8. .spec.agent.ebpf.advanced.scheduling.tolerations
- Description
-
tolerations
is a list of tolerations that allow the pod to schedule onto nodes with matching taints. For documentation, refer to https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling. - Type
-
array
13.1.9. .spec.agent.ebpf.flowFilter
- Description
-
flowFilter
defines the eBPF agent configuration regarding flow filtering. - Type
-
object
Property | Type | Description |
---|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Set |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
13.1.10. .spec.agent.ebpf.metrics
- Description
-
metrics
defines the eBPF agent configuration regarding metrics. - Type
-
object
Property | Type | Description |
---|---|---|
|
|
|
|
|
Set |
|
| Metrics server endpoint configuration for the Prometheus scraper. |
13.1.11. .spec.agent.ebpf.metrics.server
- Description
- Metrics server endpoint configuration for the Prometheus scraper.
- Type
-
object
Property | Type | Description |
---|---|---|
|
| The metrics server HTTP port. |
|
| TLS configuration. |
13.1.12. .spec.agent.ebpf.metrics.server.tls
- Description
- TLS configuration.
- Type
-
object
- Required
-
type
-
Property | Type | Description |
---|---|---|
|
|
|
|
|
TLS configuration when |
|
|
Reference to the CA file when |
|
|
Select the type of TLS configuration:
- |
13.1.13. .spec.agent.ebpf.metrics.server.tls.provided
- Description
-
TLS configuration when
type
is set toProvided
. - Type
-
object
Property | Type | Description |
---|---|---|
|
|
|
|
|
|
|
| Name of the config map or secret containing certificates. |
|
| Namespace of the config map or secret containing certificates. If omitted, the default is to use the same namespace as where Network Observability is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. |
|
|
Type for the certificate reference: |
13.1.14. .spec.agent.ebpf.metrics.server.tls.providedCaFile
- Description
-
Reference to the CA file when
type
is set toProvided
. - Type
-
object
Property | Type | Description |
---|---|---|
|
| File name within the config map or secret. |
|
| Name of the config map or secret containing the file. |
|
| Namespace of the config map or secret containing the file. If omitted, the default is to use the same namespace as where Network Observability is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. |
|
|
Type for the file reference: |
13.1.15. .spec.agent.ebpf.resources
- Description
-
resources
are the compute resources required by this container. For more information, see https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - Type
-
object
Property | Type | Description |
---|---|---|
|
| Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ |
|
| Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. Requests cannot exceed Limits. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ |
13.1.16. .spec.consolePlugin
- Description
-
consolePlugin
defines the settings related to the OpenShift Container Platform Console plugin, when available. - Type
-
object
Property | Type | Description |
---|---|---|
|
|
|
|
|
|
|
| Enables the console plugin deployment. |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
13.1.17. .spec.consolePlugin.advanced
- Description
-
advanced
allows setting some aspects of the internal configuration of the console plugin. This section is aimed mostly for debugging and fine-grained performance optimizations, such asGOGC
andGOMAXPROCS
env vars. Set these values at your own risk. - Type
-
object
Property | Type | Description |
---|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
13.1.18. .spec.consolePlugin.advanced.scheduling
- Description
-
scheduling
controls how the pods are scheduled on nodes. - Type
-
object
Property | Type | Description |
---|---|---|
|
| If specified, the pod’s scheduling constraints. For documentation, refer to https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling. |
|
|
|
|
| If specified, indicates the pod’s priority. For documentation, refer to https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/#how-to-use-priority-and-preemption. If not specified, default priority is used, or zero if there is no default. |
|
|
|
13.1.19. .spec.consolePlugin.advanced.scheduling.affinity
- Description
- If specified, the pod’s scheduling constraints. For documentation, refer to https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling.
- Type
-
object
13.1.20. .spec.consolePlugin.advanced.scheduling.tolerations
- Description
-
tolerations
is a list of tolerations that allow the pod to schedule onto nodes with matching taints. For documentation, refer to https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling. - Type
-
array
13.1.21. .spec.consolePlugin.autoscaler
- Description
-
autoscaler
spec of a horizontal pod autoscaler to set up for the plugin Deployment. Refer to HorizontalPodAutoscaler documentation (autoscaling/v2). - Type
-
object
13.1.22. .spec.consolePlugin.portNaming
- Description
-
portNaming
defines the configuration of the port-to-service name translation - Type
-
object
Property | Type | Description |
---|---|---|
|
| Enable the console plugin port-to-service name translation |
|
|
|
13.1.23. .spec.consolePlugin.quickFilters
- Description
-
quickFilters
configures quick filter presets for the Console plugin - Type
-
array
13.1.24. .spec.consolePlugin.quickFilters[]
- Description
-
QuickFilter
defines preset configuration for Console’s quick filters - Type
-
object
- Required
-
filter
-
name
-
Property | Type | Description |
---|---|---|
|
|
|
|
|
|
|
| Name of the filter, that is displayed in the Console |
13.1.25. .spec.consolePlugin.resources
- Description
-
resources
, in terms of compute resources, required by this container. For more information, see https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - Type
-
object
Property | Type | Description |
---|---|---|
|
| Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ |
|
| Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. Requests cannot exceed Limits. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ |
13.1.26. .spec.exporters
- Description
-
exporters
define additional optional exporters for custom consumption or storage. - Type
-
array
13.1.27. .spec.exporters[]
- Description
-
FlowCollectorExporter
defines an additional exporter to send enriched flows to. - Type
-
object
- Required
-
type
-
Property | Type | Description |
---|---|---|
|
| IPFIX configuration, such as the IP address and port to send enriched IPFIX flows to. |
|
| Kafka configuration, such as the address and topic, to send enriched flows to. |
|
| OpenTelemetry configuration, such as the IP address and port to send enriched logs or metrics to. |
|
|
|
13.1.28. .spec.exporters[].ipfix
- Description
- IPFIX configuration, such as the IP address and port to send enriched IPFIX flows to.
- Type
-
object
- Required
-
targetHost
-
targetPort
-
Property | Type | Description |
---|---|---|
|
| Address of the IPFIX external receiver. |
|
| Port for the IPFIX external receiver. |
|
|
Transport protocol ( |
13.1.29. .spec.exporters[].kafka
- Description
- Kafka configuration, such as the address and topic, to send enriched flows to.
- Type
-
object
- Required
-
address
-
topic
-
Property | Type | Description |
---|---|---|
|
| Address of the Kafka server |
|
| SASL authentication configuration. [Unsupported (*)]. |
|
| TLS client configuration. When using TLS, verify that the address matches the Kafka port used for TLS, generally 9093. |
|
| Kafka topic to use. It must exist. Network Observability does not create it. |
13.1.30. .spec.exporters[].kafka.sasl
- Description
- SASL authentication configuration. [Unsupported (*)].
- Type
-
object
Property | Type | Description |
---|---|---|
|
| Reference to the secret or config map containing the client ID |
|
| Reference to the secret or config map containing the client secret |
|
|
Type of SASL authentication to use, or |
13.1.31. .spec.exporters[].kafka.sasl.clientIDReference
- Description
- Reference to the secret or config map containing the client ID
- Type
-
object
Property | Type | Description |
---|---|---|
|
| File name within the config map or secret. |
|
| Name of the config map or secret containing the file. |
|
| Namespace of the config map or secret containing the file. If omitted, the default is to use the same namespace as where Network Observability is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. |
|
|
Type for the file reference: |
13.1.32. .spec.exporters[].kafka.sasl.clientSecretReference
- Description
- Reference to the secret or config map containing the client secret
- Type
-
object
Property | Type | Description |
---|---|---|
|
| File name within the config map or secret. |
|
| Name of the config map or secret containing the file. |
|
| Namespace of the config map or secret containing the file. If omitted, the default is to use the same namespace as where Network Observability is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. |
|
|
Type for the file reference: |
13.1.33. .spec.exporters[].kafka.tls
- Description
- TLS client configuration. When using TLS, verify that the address matches the Kafka port used for TLS, generally 9093.
- Type
-
object
Property | Type | Description |
---|---|---|
|
|
|
|
| Enable TLS |
|
|
|
|
|
|
13.1.34. .spec.exporters[].kafka.tls.caCert
- Description
-
caCert
defines the reference of the certificate for the Certificate Authority. - Type
-
object
Property | Type | Description |
---|---|---|
|
|
|
|
|
|
|
| Name of the config map or secret containing certificates. |
|
| Namespace of the config map or secret containing certificates. If omitted, the default is to use the same namespace as where Network Observability is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. |
|
|
Type for the certificate reference: |
13.1.35. .spec.exporters[].kafka.tls.userCert
- Description
-
userCert
defines the user certificate reference and is used for mTLS. When you use one-way TLS, you can ignore this property. - Type
-
object
Property | Type | Description |
---|---|---|
|
|
|
|
|
|
|
| Name of the config map or secret containing certificates. |
|
| Namespace of the config map or secret containing certificates. If omitted, the default is to use the same namespace as where Network Observability is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. |
|
|
Type for the certificate reference: |
13.1.36. .spec.exporters[].openTelemetry
- Description
- OpenTelemetry configuration, such as the IP address and port to send enriched logs or metrics to.
- Type
-
object
- Required
-
targetHost
-
targetPort
-
Property | Type | Description |
---|---|---|
|
| Custom fields mapping to an OpenTelemetry conformant format. By default, Network Observability format proposal is used: https://github.com/rhobs/observability-data-model/blob/main/network-observability.md#format-proposal . As there is currently no accepted standard for L3 or L4 enriched network logs, you can freely override it with your own. |
|
| Headers to add to messages (optional) |
|
| OpenTelemetry configuration for logs. |
|
| OpenTelemetry configuration for metrics. |
|
|
Protocol of the OpenTelemetry connection. The available options are |
|
| Address of the OpenTelemetry receiver. |
|
| Port for the OpenTelemetry receiver. |
|
| TLS client configuration. |
13.1.37. .spec.exporters[].openTelemetry.fieldsMapping
- Description
- Custom fields mapping to an OpenTelemetry conformant format. By default, Network Observability format proposal is used: https://github.com/rhobs/observability-data-model/blob/main/network-observability.md#format-proposal . As there is currently no accepted standard for L3 or L4 enriched network logs, you can freely override it with your own.
- Type
-
array
13.1.38. .spec.exporters[].openTelemetry.fieldsMapping[]
- Description
- Type
-
object
Property | Type | Description |
---|---|---|
|
| |
|
| |
|
|
13.1.39. .spec.exporters[].openTelemetry.logs
- Description
- OpenTelemetry configuration for logs.
- Type
-
object
Property | Type | Description |
---|---|---|
|
|
Set |
13.1.40. .spec.exporters[].openTelemetry.metrics
- Description
- OpenTelemetry configuration for metrics.
- Type
-
object
Property | Type | Description |
---|---|---|
|
|
Set |
|
| Specify how often metrics are sent to a collector. |
13.1.41. .spec.exporters[].openTelemetry.tls
- Description
- TLS client configuration.
- Type
-
object
Property | Type | Description |
---|---|---|
|
|
|
|
| Enable TLS |
|
|
|
|
|
|
13.1.42. .spec.exporters[].openTelemetry.tls.caCert
- Description
-
caCert
defines the reference of the certificate for the Certificate Authority. - Type
-
object
Property | Type | Description |
---|---|---|
|
|
|
|
|
|
|
| Name of the config map or secret containing certificates. |
|
| Namespace of the config map or secret containing certificates. If omitted, the default is to use the same namespace as where Network Observability is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. |
|
|
Type for the certificate reference: |
13.1.43. .spec.exporters[].openTelemetry.tls.userCert
- Description
-
userCert
defines the user certificate reference and is used for mTLS. When you use one-way TLS, you can ignore this property. - Type
-
object
Property | Type | Description |
---|---|---|
|
|
|
|
|
|
|
| Name of the config map or secret containing certificates. |
|
| Namespace of the config map or secret containing certificates. If omitted, the default is to use the same namespace as where Network Observability is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. |
|
|
Type for the certificate reference: |
13.1.44. .spec.kafka
- Description
-
Kafka configuration, allowing to use Kafka as a broker as part of the flow collection pipeline. Available when the
spec.deploymentModel
isKafka
. - Type
-
object
- Required
-
address
-
topic
-
Property | Type | Description |
---|---|---|
|
| Address of the Kafka server |
|
| SASL authentication configuration. [Unsupported (*)]. |
|
| TLS client configuration. When using TLS, verify that the address matches the Kafka port used for TLS, generally 9093. |
|
| Kafka topic to use. It must exist. Network Observability does not create it. |
13.1.45. .spec.kafka.sasl
- Description
- SASL authentication configuration. [Unsupported (*)].
- Type
-
object
Property | Type | Description |
---|---|---|
|
| Reference to the secret or config map containing the client ID |
|
| Reference to the secret or config map containing the client secret |
|
|
Type of SASL authentication to use, or |
13.1.46. .spec.kafka.sasl.clientIDReference
- Description
- Reference to the secret or config map containing the client ID
- Type
-
object
Property | Type | Description |
---|---|---|
|
| File name within the config map or secret. |
|
| Name of the config map or secret containing the file. |
|
| Namespace of the config map or secret containing the file. If omitted, the default is to use the same namespace as where Network Observability is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. |
|
|
Type for the file reference: |
13.1.47. .spec.kafka.sasl.clientSecretReference
- Description
- Reference to the secret or config map containing the client secret
- Type
-
object
Property | Type | Description |
---|---|---|
|
| File name within the config map or secret. |
|
| Name of the config map or secret containing the file. |
|
| Namespace of the config map or secret containing the file. If omitted, the default is to use the same namespace as where Network Observability is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. |
|
|
Type for the file reference: |
13.1.48. .spec.kafka.tls
- Description
- TLS client configuration. When using TLS, verify that the address matches the Kafka port used for TLS, generally 9093.
- Type
-
object
Property | Type | Description |
---|---|---|
|
|
|
|
| Enable TLS |
|
|
|
|
|
|
13.1.49. .spec.kafka.tls.caCert
- Description
-
caCert
defines the reference of the certificate for the Certificate Authority. - Type
-
object
Property | Type | Description |
---|---|---|
|
|
|
|
|
|
|
| Name of the config map or secret containing certificates. |
|
| Namespace of the config map or secret containing certificates. If omitted, the default is to use the same namespace as where Network Observability is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. |
|
|
Type for the certificate reference: |
13.1.50. .spec.kafka.tls.userCert
- Description
-
userCert
defines the user certificate reference and is used for mTLS. When you use one-way TLS, you can ignore this property. - Type
-
object
Property | Type | Description |
---|---|---|
|
|
|
|
|
|
|
| Name of the config map or secret containing certificates. |
|
| Namespace of the config map or secret containing certificates. If omitted, the default is to use the same namespace as where Network Observability is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. |
|
|
Type for the certificate reference: |
13.1.51. .spec.loki
- Description
-
loki
, the flow store, client settings. - Type
-
object
- Required
-
mode
-
Property | Type | Description |
---|---|---|
|
|
|
|
|
Set |
|
|
Loki configuration for |
|
|
Loki configuration for |
|
|
Loki configuration for |
|
|
- Use
- Use
- Use
- Use |
|
|
Loki configuration for |
|
|
|
|
|
|
|
|
|
|
|
|
13.1.52. .spec.loki.advanced
- Description
-
advanced
allows setting some aspects of the internal configuration of the Loki clients. This section is aimed mostly for debugging and fine-grained performance optimizations. - Type
-
object
Property | Type | Description |
---|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
13.1.53. .spec.loki.lokiStack
- Description
-
Loki configuration for
LokiStack
mode. This is useful for an easy Loki Operator configuration. It is ignored for other modes. - Type
-
object
- Required
-
name
-
Property | Type | Description |
---|---|---|
|
| Name of an existing LokiStack resource to use. |
|
|
Namespace where this |
13.1.54. .spec.loki.manual
- Description
-
Loki configuration for
Manual
mode. This is the most flexible configuration. It is ignored for other modes. - Type
-
object
Property | Type | Description |
---|---|---|
|
|
-
-
-
When using the Loki Operator, this must be set to |
|
|
|
|
|
|
|
| TLS client configuration for Loki status URL. |
|
|
|
|
|
|
|
| TLS client configuration for Loki URL. |
13.1.55. .spec.loki.manual.statusTls
- Description
- TLS client configuration for Loki status URL.
- Type
-
object
Property | Type | Description |
---|---|---|
|
|
|
|
| Enable TLS |
|
|
|
|
|
|
13.1.56. .spec.loki.manual.statusTls.caCert
- Description
-
caCert
defines the reference of the certificate for the Certificate Authority. - Type
-
object
Property | Type | Description |
---|---|---|
|
|
|
|
|
|
|
| Name of the config map or secret containing certificates. |
|
| Namespace of the config map or secret containing certificates. If omitted, the default is to use the same namespace as where Network Observability is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. |
|
|
Type for the certificate reference: |
13.1.57. .spec.loki.manual.statusTls.userCert
- Description
-
userCert
defines the user certificate reference and is used for mTLS. When you use one-way TLS, you can ignore this property. - Type
-
object
Property | Type | Description |
---|---|---|
|
|
|
|
|
|
|
| Name of the config map or secret containing certificates. |
|
| Namespace of the config map or secret containing certificates. If omitted, the default is to use the same namespace as where Network Observability is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. |
|
|
Type for the certificate reference: |
13.1.58. .spec.loki.manual.tls
- Description
- TLS client configuration for Loki URL.
- Type
-
object
Property | Type | Description |
---|---|---|
|
|
|
|
| Enable TLS |
|
|
|
|
|
|
13.1.59. .spec.loki.manual.tls.caCert
- Description
-
caCert
defines the reference of the certificate for the Certificate Authority. - Type
-
object
Property | Type | Description |
---|---|---|
|
|
|
|
|
|
|
| Name of the config map or secret containing certificates. |
|
| Namespace of the config map or secret containing certificates. If omitted, the default is to use the same namespace as where Network Observability is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. |
|
|
Type for the certificate reference: |
13.1.60. .spec.loki.manual.tls.userCert
- Description
-
userCert
defines the user certificate reference and is used for mTLS. When you use one-way TLS, you can ignore this property. - Type
-
object
Property | Type | Description |
---|---|---|
|
|
|
|
|
|
|
| Name of the config map or secret containing certificates. |
|
| Namespace of the config map or secret containing certificates. If omitted, the default is to use the same namespace as where Network Observability is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. |
|
|
Type for the certificate reference: |
13.1.61. .spec.loki.microservices
- Description
-
Loki configuration for
Microservices
mode. Use this option when Loki is installed using the microservices deployment mode (https://grafana.com/docs/loki/latest/fundamentals/architecture/deployment-modes/#microservices-mode). It is ignored for other modes. - Type
-
object
Property | Type | Description |
---|---|---|
|
|
|
|
|
|
|
|
|
|
| TLS client configuration for Loki URL. |
13.1.62. .spec.loki.microservices.tls
- Description
- TLS client configuration for Loki URL.
- Type
-
object
Property | Type | Description |
---|---|---|
|
|
|
|
| Enable TLS |
|
|
|
|
|
|
13.1.63. .spec.loki.microservices.tls.caCert
- Description
-
caCert
defines the reference of the certificate for the Certificate Authority. - Type
-
object
Property | Type | Description |
---|---|---|
|
|
|
|
|
|
|
| Name of the config map or secret containing certificates. |
|
| Namespace of the config map or secret containing certificates. If omitted, the default is to use the same namespace as where Network Observability is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. |
|
|
Type for the certificate reference: |
13.1.64. .spec.loki.microservices.tls.userCert
- Description
-
userCert
defines the user certificate reference and is used for mTLS. When you use one-way TLS, you can ignore this property. - Type
-
object
Property | Type | Description |
---|---|---|
|
|
|
|
|
|
|
| Name of the config map or secret containing certificates. |
|
| Namespace of the config map or secret containing certificates. If omitted, the default is to use the same namespace as where Network Observability is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. |
|
|
Type for the certificate reference: |
13.1.65. .spec.loki.monolithic
- Description
-
Loki configuration for
Monolithic
mode. Use this option when Loki is installed using the monolithic deployment mode (https://grafana.com/docs/loki/latest/fundamentals/architecture/deployment-modes/#monolithic-mode). It is ignored for other modes. - Type
-
object
Property | Type | Description |
---|---|---|
|
|
|
|
| TLS client configuration for Loki URL. |
|
|
|
13.1.66. .spec.loki.monolithic.tls
- Description
- TLS client configuration for Loki URL.
- Type
-
object
Property | Type | Description |
---|---|---|
|
|
|
|
| Enable TLS |
|
|
|
|
|
|
13.1.67. .spec.loki.monolithic.tls.caCert
- Description
-
caCert
defines the reference of the certificate for the Certificate Authority. - Type
-
object
Property | Type | Description |
---|---|---|
|
|
|
|
|
|
|
| Name of the config map or secret containing certificates. |
|
| Namespace of the config map or secret containing certificates. If omitted, the default is to use the same namespace as where Network Observability is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. |
|
|
Type for the certificate reference: |
13.1.68. .spec.loki.monolithic.tls.userCert
- Description
-
userCert
defines the user certificate reference and is used for mTLS. When you use one-way TLS, you can ignore this property. - Type
-
object
Property | Type | Description |
---|---|---|
|
|
|
|
|
|
|
| Name of the config map or secret containing certificates. |
|
| Namespace of the config map or secret containing certificates. If omitted, the default is to use the same namespace as where Network Observability is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. |
|
|
Type for the certificate reference: |
13.1.69. .spec.networkPolicy
- Description
-
networkPolicy
defines ingress network policy settings for Network Observability components isolation. - Type
-
object
Property | Type | Description |
---|---|---|
|
|
|
|
|
Set |
13.1.70. .spec.processor
- Description
-
processor
defines the settings of the component that receives the flows from the agent, enriches them, generates metrics, and forwards them to the Loki persistence layer and/or any available exporter. - Type
-
object
Property | Type | Description |
---|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
-
-
-
- |
|
|
|
|
|
Set |
|
|
|
|
|
|
13.1.71. .spec.processor.advanced
- Description
-
advanced
allows setting some aspects of the internal configuration of the flow processor. This section is aimed mostly for debugging and fine-grained performance optimizations, such asGOGC
andGOMAXPROCS
env vars. Set these values at your own risk. - Type
-
object
Property | Type | Description |
---|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| Port of the flow collector (host port). By convention, some values are forbidden. It must be greater than 1024 and different from 4500, 4789 and 6081. |
|
|
|
|
| scheduling controls how the pods are scheduled on nodes. |
|
| Define secondary networks to be checked for resources identification. To guarantee a correct identification, indexed values must form an unique identifier across the cluster. If the same index is used by several resources, those resources might be incorrectly labeled. |
13.1.72. .spec.processor.advanced.scheduling
- Description
- scheduling controls how the pods are scheduled on nodes.
- Type
-
object
Property | Type | Description |
---|---|---|
|
| If specified, the pod’s scheduling constraints. For documentation, refer to https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling. |
|
|
|
|
| If specified, indicates the pod’s priority. For documentation, refer to https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/#how-to-use-priority-and-preemption. If not specified, default priority is used, or zero if there is no default. |
|
|
|
13.1.73. .spec.processor.advanced.scheduling.affinity
- Description
- If specified, the pod’s scheduling constraints. For documentation, refer to https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling.
- Type
-
object
13.1.74. .spec.processor.advanced.scheduling.tolerations
- Description
-
tolerations
is a list of tolerations that allow the pod to schedule onto nodes with matching taints. For documentation, refer to https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling. - Type
-
array
13.1.75. .spec.processor.advanced.secondaryNetworks
- Description
- Define secondary networks to be checked for resources identification. To guarantee a correct identification, indexed values must form an unique identifier across the cluster. If the same index is used by several resources, those resources might be incorrectly labeled.
- Type
-
array
13.1.76. .spec.processor.advanced.secondaryNetworks[]
- Description
- Type
-
object
- Required
-
index
-
name
-
Property | Type | Description |
---|---|---|
|
|
|
|
|
|
13.1.77. .spec.processor.kafkaConsumerAutoscaler
- Description
-
kafkaConsumerAutoscaler
is the spec of a horizontal pod autoscaler to set up forflowlogs-pipeline-transformer
, which consumes Kafka messages. This setting is ignored when Kafka is disabled. Refer to HorizontalPodAutoscaler documentation (autoscaling/v2). - Type
-
object
13.1.78. .spec.processor.metrics
- Description
-
Metrics
define the processor configuration regarding metrics - Type
-
object
Property | Type | Description |
---|---|---|
|
|
|
|
|
|
|
| Metrics server endpoint configuration for Prometheus scraper |
13.1.79. .spec.processor.metrics.server
- Description
- Metrics server endpoint configuration for Prometheus scraper
- Type
-
object
Property | Type | Description |
---|---|---|
|
| The metrics server HTTP port. |
|
| TLS configuration. |
13.1.80. .spec.processor.metrics.server.tls
- Description
- TLS configuration.
- Type
-
object
- Required
-
type
-
Property | Type | Description |
---|---|---|
|
|
|
|
|
TLS configuration when |
|
|
Reference to the CA file when |
|
|
Select the type of TLS configuration:
- |
13.1.81. .spec.processor.metrics.server.tls.provided
- Description
-
TLS configuration when
type
is set toProvided
. - Type
-
object
Property | Type | Description |
---|---|---|
|
|
|
|
|
|
|
| Name of the config map or secret containing certificates. |
|
| Namespace of the config map or secret containing certificates. If omitted, the default is to use the same namespace as where Network Observability is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. |
|
|
Type for the certificate reference: |
13.1.82. .spec.processor.metrics.server.tls.providedCaFile
- Description
-
Reference to the CA file when
type
is set toProvided
. - Type
-
object
Property | Type | Description |
---|---|---|
|
| File name within the config map or secret. |
|
| Name of the config map or secret containing the file. |
|
| Namespace of the config map or secret containing the file. If omitted, the default is to use the same namespace as where Network Observability is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. |
|
|
Type for the file reference: |
13.1.83. .spec.processor.resources
- Description
-
resources
are the compute resources required by this container. For more information, see https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - Type
-
object
Property | Type | Description |
---|---|---|
|
| Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ |
|
| Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. Requests cannot exceed Limits. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ |
13.1.84. .spec.processor.subnetLabels
- Description
-
subnetLabels
allows to define custom labels on subnets and IPs or to enable automatic labelling of recognized subnets in OpenShift Container Platform, which is used to identify cluster external traffic. When a subnet matches the source or destination IP of a flow, a corresponding field is added:SrcSubnetLabel
orDstSubnetLabel
. - Type
-
object
Property | Type | Description |
---|---|---|
|
|
|
|
|
|
13.1.85. .spec.processor.subnetLabels.customLabels
- Description
-
customLabels
allows to customize subnets and IPs labelling, such as to identify cluster-external workloads or web services. If you enableopenShiftAutoDetect
,customLabels
can override the detected subnets in case they overlap. - Type
-
array
13.1.86. .spec.processor.subnetLabels.customLabels[]
- Description
- SubnetLabel allows to label subnets and IPs, such as to identify cluster-external workloads or web services.
- Type
-
object
- Required
-
cidrs
-
name
-
Property | Type | Description |
---|---|---|
|
|
List of CIDRs, such as |
|
| Label name, used to flag matching flows. |
13.1.87. .spec.prometheus
- Description
-
prometheus
defines Prometheus settings, such as querier configuration used to fetch metrics from the Console plugin. - Type
-
object
Property | Type | Description |
---|---|---|
|
| Prometheus querying configuration, such as client settings, used in the Console plugin. |
13.1.88. .spec.prometheus.querier
- Description
- Prometheus querying configuration, such as client settings, used in the Console plugin.
- Type
-
object
- Required
-
mode
-
Property | Type | Description |
---|---|---|
|
|
When |
|
|
Prometheus configuration for |
|
|
- Use
- Use |
|
|
|
13.1.89. .spec.prometheus.querier.manual
- Description
-
Prometheus configuration for
Manual
mode. - Type
-
object
Property | Type | Description |
---|---|---|
|
|
Set |
|
| TLS client configuration for Prometheus URL. |
|
|
|
13.1.90. .spec.prometheus.querier.manual.tls
- Description
- TLS client configuration for Prometheus URL.
- Type
-
object
Property | Type | Description |
---|---|---|
|
|
|
|
| Enable TLS |
|
|
|
|
|
|
13.1.91. .spec.prometheus.querier.manual.tls.caCert
- Description
-
caCert
defines the reference of the certificate for the Certificate Authority. - Type
-
object
Property | Type | Description |
---|---|---|
|
|
|
|
|
|
|
| Name of the config map or secret containing certificates. |
|
| Namespace of the config map or secret containing certificates. If omitted, the default is to use the same namespace as where Network Observability is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. |
|
|
Type for the certificate reference: |
13.1.92. .spec.prometheus.querier.manual.tls.userCert
- Description
-
userCert
defines the user certificate reference and is used for mTLS. When you use one-way TLS, you can ignore this property. - Type
-
object
Property | Type | Description |
---|---|---|
|
|
|
|
|
|
|
| Name of the config map or secret containing certificates. |
|
| Namespace of the config map or secret containing certificates. If omitted, the default is to use the same namespace as where Network Observability is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. |
|
|
Type for the certificate reference: |