Chapter 5. Configuring the Network Observability Operator

Procedure

1. In the web console, navigate to Operators Installed Operators.
2. Under the Provided APIs heading for the NetObserv Operator, select Flow Collector.
3. Select cluster then select the YAML tab. There, you can modify the FlowCollector resource to configure the Network Observability operator.

Procedure

1. In the web console, navigate to Operators Installed Operators.
2. Under the Provided APIs heading for the Network Observability Operator, select Flow Collector.
3. Select the cluster and then click the YAML tab.
4. Modify the FlowCollector resource for OpenShift Container Platform Network Observability Operator to use Kafka, as shown in the following sample YAML:

Procedure

1. In the web console, navigate to Operators Installed Operators.
2. Under the Provided APIs heading for the NetObserv Operator, select Flow Collector.
3. Select cluster and then select the YAML tab.

4. Edit the FlowCollector to configure spec.exporters as follows:

   apiVersion: flows.netobserv.io/v1beta2
   kind: FlowCollector
   metadata:
     name: cluster
   spec:
     exporters:
     - type: Kafka                         1
         kafka:
           address: "kafka-cluster-kafka-bootstrap.netobserv"
           topic: netobserv-flows-export   2
           tls:
             enable: false                 3
     - type: IPFIX                         4
         ipfix:
           targetHost: "ipfix-collector.ipfix.svc.cluster.local"
           targetPort: 4739
           transport: tcp or udp           5
    -  type: OpenTelemetry                 6
         openTelemetry:
           targetHost: my-otelcol-collector-headless.otlp.svc
           targetPort: 4317
           type: grpc                      7
           logs:                           8
             enable: true
           metrics:                        9
             enable: true
             prefix: netobserv
             pushTimeInterval: 20s         10
             expiryTime: 2m
      #    fieldsMapping:                  11
      #      input: SrcAddr
      #      output: source.address

   1 4 6

   You can export flows to IPFIX, OpenTelemetry, and Kafka individually or concurrently.

   2

   The Network Observability Operator exports all flows to the configured Kafka topic.

   3

   You can encrypt all communications to and from Kafka with SSL/TLS or mTLS. When enabled, the Kafka CA certificate must be available as a ConfigMap or a Secret, both in the namespace where the flowlogs-pipeline processor component is deployed (default: netobserv). It must be referenced with spec.exporters.tls.caCert. When using mTLS, client secrets must be available in these namespaces as well (they can be generated for instance using the AMQ Streams User Operator) and referenced with spec.exporters.tls.userCert.

   5

   You have the option to specify transport. The default value is tcp but you can also specify udp.

   7

   The protocol of OpenTelemetry connection. The available options are http and grpc.

   8

   OpenTelemetry configuration for exporting logs, which are the same as the logs created for Loki.

   9

   OpenTelemetry configuration for exporting metrics, which are the same as the metrics created for Prometheus. These configurations are specified in the spec.processor.metrics.includeList parameter of the FlowCollector custom resource, along with any custom metrics you defined using the FlowMetrics custom resource.

   10

   The time interval that metrics are sent to the OpenTelemetry collector.

   11

   Optional:Network Observability network flows formats get automatically renamed to an OpenTelemetry compliant format. The fieldsMapping specification gives you the ability to customize the OpenTelemetry format output. For example in the YAML sample, SrcAddr is the Network Observability input field, and it is being renamed source.address in OpenTelemetry output. You can see both Network Observability and OpenTelemetry formats in the "Network flows format reference".

Procedure

1. Run the following command to patch the flowcollector CR and update the spec.agent.ebpf.sampling value:

   $ oc patch flowcollector cluster --type=json -p "[{"op": "replace", "path": "/spec/agent/ebpf/sampling", "value": <new value>}] -n netobserv"