Description
The KFL2 documentation page (v2/kfl2.md) is missing coverage for several protocols and changes that have been added to the KFL2 engine recently:
New protocols missing from docs
MongoDB — 12 new filter variables:
mongodb (bool), mongodb_command, mongodb_database, mongodb_collection, mongodb_opcode, mongodb_request_size, mongodb_response_size, mongodb_total_size, mongodb_success (bool), mongodb_error_code, mongodb_error_message, mongodb_error_code_name
MySQL — 11 new filter variables:
mysql (bool), mysql_command, mysql_query, mysql_database, mysql_statement_id, mysql_request_size, mysql_response_size, mysql_total_size, mysql_success (bool), mysql_error_code, mysql_error_message
gRPC — 3 new filter variables (sub-protocol of HTTP/2):
grpc (bool), grpc_method, grpc_status
Other changes missing from docs
elapsed_time semantic change: now means response-request latency (not age since timestamp)
tls is now an alias for capture_source == "ebpf_tls"
src.name / dst.name — worker-enriched summary peer name
src.namespace / dst.namespace — namespace with service fallback
What needs to happen
- Add MongoDB, MySQL, and gRPC sections to the variable reference table in
v2/kfl2.md
- Add
mongodb, mysql, and grpc to the protocol detection flags table
- Update the
elapsed_time description to reflect the new semantics
- Add example queries for each new protocol
- Update
tls description to note it's an alias for eBPF TLS capture source
Why Is This Needed?
Users relying on the docs for KFL2 query writing cannot discover or use these new protocol filters. The docs are the primary reference for building filters in Kubeshark.
Description
The KFL2 documentation page (
v2/kfl2.md) is missing coverage for several protocols and changes that have been added to the KFL2 engine recently:New protocols missing from docs
MongoDB — 12 new filter variables:
mongodb(bool),mongodb_command,mongodb_database,mongodb_collection,mongodb_opcode,mongodb_request_size,mongodb_response_size,mongodb_total_size,mongodb_success(bool),mongodb_error_code,mongodb_error_message,mongodb_error_code_nameMySQL — 11 new filter variables:
mysql(bool),mysql_command,mysql_query,mysql_database,mysql_statement_id,mysql_request_size,mysql_response_size,mysql_total_size,mysql_success(bool),mysql_error_code,mysql_error_messagegRPC — 3 new filter variables (sub-protocol of HTTP/2):
grpc(bool),grpc_method,grpc_statusOther changes missing from docs
elapsed_timesemantic change: now means response-request latency (not age since timestamp)tlsis now an alias forcapture_source == "ebpf_tls"src.name/dst.name— worker-enriched summary peer namesrc.namespace/dst.namespace— namespace with service fallbackWhat needs to happen
v2/kfl2.mdmongodb,mysql, andgrpcto the protocol detection flags tableelapsed_timedescription to reflect the new semanticstlsdescription to note it's an alias for eBPF TLS capture sourceWhy Is This Needed?
Users relying on the docs for KFL2 query writing cannot discover or use these new protocol filters. The docs are the primary reference for building filters in Kubeshark.