Chapter 7. Network observability per-tenant model

Procedure

1. Edit the FlowCollector custom resource by running the following command:

   $ oc edit flowcollector cluster

2. Configure the spec.processor.slicesConfig field to define which namespaces are permitted to use slices:

   apiVersion: flows.netobserv.io/v1beta2
   kind: FlowCollector
   metadata:
     name: cluster
   spec:
     processor:
       slicesConfig:
         enable: true
         collectionMode: AllowList
         namespacesAllowList:
          - /openshift-.*|netobserv.*/

   where:

   spec.processor.sliceConfig.enable

   Specifies if the FlowCollectorSlice feature is enabled. If not, all resources of kind FlowCollectorSlice are ignored.

   spec.processor.sliceConfig.collectionMode

   Specifies how the FlowCollectorSlice custom resources impacts the flow collection process. When set to AlwaysCollect, all flows are collected regardless of the presence of FlowCollectorSlice. When set to AllowList, only the flows related to namespaces where a FlowCollectorSlice resource is present, or configured via the global namespacesAllowList, are collected.

   spec.processor.sliceConfig.namespacesAllowList

   Specifies a list of namespaces for which flows are always collected, regardless of the presence of FlowCollectorSlice in those namespaces.

   Note

   The namespacesAllowList field supports regular expressions, such as /openshift-.*/ to capture multiple namespaces, or strict equality, such as netobserv, to match a specific namespace.

3. Save the changes and exit the editor.

Procedure

1. Create a YAML file named flowCollectorSlice.yaml:

   apiVersion: flows.netobserv.io/v1alpha1
   kind: FlowCollectorSlice
   metadata:
     name: flowcollectorslice-sample
     namespace: my-app
   spec:
     sampling: 1
     subnetLabels:
       - name: EXT:Database
         cidrs:
           - 192.168.50.0/24

2. Apply the configuration by running the following command:

   $ oc apply -f flowCollectorSlice.yaml

Verification

1. In the OpenShift Container Platform console, navigate to Observe Network Traffic.
2. Ensure flows to 192.168.50.0/24 subnet are observed with the EXT:Database label.