Skip to content

Update KFL2 reference for MongoDB, MySQL, and gRPC protocols #96

Description

@alongir

Description

The KFL2 documentation page (v2/kfl2.md) is missing coverage for several protocols and changes that have been added to the KFL2 engine recently:

New protocols missing from docs

MongoDB — 12 new filter variables:

  • mongodb (bool), mongodb_command, mongodb_database, mongodb_collection, mongodb_opcode, mongodb_request_size, mongodb_response_size, mongodb_total_size, mongodb_success (bool), mongodb_error_code, mongodb_error_message, mongodb_error_code_name

MySQL — 11 new filter variables:

  • mysql (bool), mysql_command, mysql_query, mysql_database, mysql_statement_id, mysql_request_size, mysql_response_size, mysql_total_size, mysql_success (bool), mysql_error_code, mysql_error_message

gRPC — 3 new filter variables (sub-protocol of HTTP/2):

  • grpc (bool), grpc_method, grpc_status

Other changes missing from docs

  • elapsed_time semantic change: now means response-request latency (not age since timestamp)
  • tls is now an alias for capture_source == "ebpf_tls"
  • src.name / dst.name — worker-enriched summary peer name
  • src.namespace / dst.namespace — namespace with service fallback

What needs to happen

  1. Add MongoDB, MySQL, and gRPC sections to the variable reference table in v2/kfl2.md
  2. Add mongodb, mysql, and grpc to the protocol detection flags table
  3. Update the elapsed_time description to reflect the new semantics
  4. Add example queries for each new protocol
  5. Update tls description to note it's an alias for eBPF TLS capture source

Why Is This Needed?

Users relying on the docs for KFL2 query writing cannot discover or use these new protocol filters. The docs are the primary reference for building filters in Kubeshark.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions