Skip to content

Commit 1425eb0

Browse files
msherif1234msherif1234
committed
IPsec support
Signed-off-by: Mohamed Mahmoud <[email protected]>
1 parent 626c5a9 commit 1425eb0

File tree

10 files changed

+53
-3
lines changed

10 files changed

+53
-3
lines changed

‎apis/flowcollector/v1beta1/flowcollector_types.go‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -155,7 +155,8 @@ type FlowCollectorIPFIX struct {
155155
// - `PacketTranslation`, to enrich flows with packets translation information. <br>
156156
// - `EbpfManager`, to enable using EBPF Manager to manage netobserv ebpf programs [Developer Preview].<br>
157157
// - `UDNMapping`, to enable interfaces mappind to udn [Developer Preview]. <br>
158-
// +kubebuilder:validation:Enum:="PacketDrop";"DNSTracking";"FlowRTT";"NetworkEvents";"PacketTranslation";"EbpfManager";"UDNMapping"
158+
// - `IPSEC`, to track flows with IPsec encryption. <br>
159+
// +kubebuilder:validation:Enum:="PacketDrop";"DNSTracking";"FlowRTT";"NetworkEvents";"PacketTranslation";"EbpfManager";"UDNMapping";"IPSEC"
159160
type AgentFeature string
160161

161162
const (
@@ -166,6 +167,7 @@ const (
166167
PacketTranslation AgentFeature = "PacketTranslation"
167168
EbpfManager AgentFeature = "EbpfManager"
168169
UDNMapping AgentFeature = "UDNMapping"
170+
IPSEC AgentFeature = "IPSEC"
169171
)
170172

171173
// Name of an eBPF agent alert.
@@ -365,6 +367,7 @@ type FlowCollectorEBPF struct {
365367
// - `PacketTranslation`: enable enriching flows with packet's translation information. <br>
366368
// - `EbpfManager`: allow using eBPF manager to manage netobserv ebpf programs. <br>
367369
// - `UDNMapping`, to enable interfaces mappind to udn. <br>
370+
// - `IPSEC`, to track flows with IPsec encryption. <br>
368371
// +optional
369372
Features []AgentFeature `json:"features,omitempty"`
370373

‎apis/flowcollector/v1beta2/flowcollector_types.go‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -178,7 +178,8 @@ type FlowCollectorIPFIX struct {
178178
// - `PacketTranslation`, to enrich flows with packets translation information. <br>
179179
// - `EbpfManager`, to enable using EBPF Manager to manage netobserv ebpf programs [Developer Preview].<br>
180180
// - `UDNMapping`, to enable interfaces mappind to udn [Developer Preview]. <br>
181-
// +kubebuilder:validation:Enum:="PacketDrop";"DNSTracking";"FlowRTT";"NetworkEvents";"PacketTranslation";"EbpfManager";"UDNMapping"
181+
// - `IPSEC`, to track flows with IPsec encryption. <br>
182+
// +kubebuilder:validation:Enum:="PacketDrop";"DNSTracking";"FlowRTT";"NetworkEvents";"PacketTranslation";"EbpfManager";"UDNMapping";"IPSEC"
182183
type AgentFeature string
183184

184185
const (
@@ -189,6 +190,7 @@ const (
189190
PacketTranslation AgentFeature = "PacketTranslation"
190191
EbpfManager AgentFeature = "EbpfManager"
191192
UDNMapping AgentFeature = "UDNMapping"
193+
IPSEC AgentFeature = "IPSEC"
192194
)
193195

194196
// Name of an eBPF agent alert.
@@ -391,6 +393,7 @@ type FlowCollectorEBPF struct {
391393
// - `EbpfManager`: allow using eBPF manager to manage netobserv ebpf programs. <br>
392394
// IMPORTANT: This feature is available as a Developer Preview.<br>
393395
// - `UDNMapping`, to enable interfaces mappind to udn. <br>
396+
// - `IPSEC`, to track flows with IPsec encryption. <br>
394397
// This feature requires mounting the kernel debug filesystem, so the eBPF agent pods have to run as privileged.
395398
// It requires using the OVN-Kubernetes network plugin with the Observability feature.
396399
// IMPORTANT: This feature is available as a Developer Preview.<br>

‎bundle/manifests/flows.netobserv.io_flowcollectors.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -138,6 +138,7 @@ spec:
138138
- `PacketTranslation`: enable enriching flows with packet's translation information. <br>
139139
- `EbpfManager`: allow using eBPF manager to manage netobserv ebpf programs. <br>
140140
- `UDNMapping`, to enable interfaces mappind to udn. <br>
141+
- `IPSEC`, to track flows with IPsec encryption. <br>
141142
items:
142143
description: |-
143144
Agent feature, can be one of:<br>
@@ -148,6 +149,7 @@ spec:
148149
- `PacketTranslation`, to enrich flows with packets translation information. <br>
149150
- `EbpfManager`, to enable using EBPF Manager to manage netobserv ebpf programs [Developer Preview].<br>
150151
- `UDNMapping`, to enable interfaces mappind to udn [Developer Preview]. <br>
152+
- `IPSEC`, to track flows with IPsec encryption. <br>
151153
enum:
152154
- PacketDrop
153155
- DNSTracking
@@ -156,6 +158,7 @@ spec:
156158
- PacketTranslation
157159
- EbpfManager
158160
- UDNMapping
161+
- IPSEC
159162
type: string
160163
type: array
161164
flowFilter:
@@ -3963,6 +3966,7 @@ spec:
39633966
- `EbpfManager`: allow using eBPF manager to manage netobserv ebpf programs. <br>
39643967
IMPORTANT: This feature is available as a Developer Preview.<br>
39653968
- `UDNMapping`, to enable interfaces mappind to udn. <br>
3969+
- `IPSEC`, to track flows with IPsec encryption. <br>
39663970
This feature requires mounting the kernel debug filesystem, so the eBPF agent pods have to run as privileged.
39673971
It requires using the OVN-Kubernetes network plugin with the Observability feature.
39683972
IMPORTANT: This feature is available as a Developer Preview.<br>
@@ -3976,6 +3980,7 @@ spec:
39763980
- `PacketTranslation`, to enrich flows with packets translation information. <br>
39773981
- `EbpfManager`, to enable using EBPF Manager to manage netobserv ebpf programs [Developer Preview].<br>
39783982
- `UDNMapping`, to enable interfaces mappind to udn [Developer Preview]. <br>
3983+
- `IPSEC`, to track flows with IPsec encryption. <br>
39793984
enum:
39803985
- PacketDrop
39813986
- DNSTracking
@@ -3984,6 +3989,7 @@ spec:
39843989
- PacketTranslation
39853990
- EbpfManager
39863991
- UDNMapping
3992+
- IPSEC
39873993
type: string
39883994
type: array
39893995
flowFilter:

‎config/crd/bases/flows.netobserv.io_flowcollectors.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -123,6 +123,7 @@ spec:
123123
- `PacketTranslation`: enable enriching flows with packet's translation information. <br>
124124
- `EbpfManager`: allow using eBPF manager to manage netobserv ebpf programs. <br>
125125
- `UDNMapping`, to enable interfaces mappind to udn. <br>
126+
- `IPSEC`, to track flows with IPsec encryption. <br>
126127
items:
127128
description: |-
128129
Agent feature, can be one of:<br>
@@ -133,6 +134,7 @@ spec:
133134
- `PacketTranslation`, to enrich flows with packets translation information. <br>
134135
- `EbpfManager`, to enable using EBPF Manager to manage netobserv ebpf programs [Developer Preview].<br>
135136
- `UDNMapping`, to enable interfaces mappind to udn [Developer Preview]. <br>
137+
- `IPSEC`, to track flows with IPsec encryption. <br>
136138
enum:
137139
- PacketDrop
138140
- DNSTracking
@@ -141,6 +143,7 @@ spec:
141143
- PacketTranslation
142144
- EbpfManager
143145
- UDNMapping
146+
- IPSEC
144147
type: string
145148
type: array
146149
flowFilter:
@@ -3645,6 +3648,7 @@ spec:
36453648
- `EbpfManager`: allow using eBPF manager to manage netobserv ebpf programs. <br>
36463649
IMPORTANT: This feature is available as a Developer Preview.<br>
36473650
- `UDNMapping`, to enable interfaces mappind to udn. <br>
3651+
- `IPSEC`, to track flows with IPsec encryption. <br>
36483652
This feature requires mounting the kernel debug filesystem, so the eBPF agent pods have to run as privileged.
36493653
It requires using the OVN-Kubernetes network plugin with the Observability feature.
36503654
IMPORTANT: This feature is available as a Developer Preview.<br>
@@ -3658,6 +3662,7 @@ spec:
36583662
- `PacketTranslation`, to enrich flows with packets translation information. <br>
36593663
- `EbpfManager`, to enable using EBPF Manager to manage netobserv ebpf programs [Developer Preview].<br>
36603664
- `UDNMapping`, to enable interfaces mappind to udn [Developer Preview]. <br>
3665+
- `IPSEC`, to track flows with IPsec encryption. <br>
36613666
enum:
36623667
- PacketDrop
36633668
- DNSTracking
@@ -3666,6 +3671,7 @@ spec:
36663671
- PacketTranslation
36673672
- EbpfManager
36683673
- UDNMapping
3674+
- IPSEC
36693675
type: string
36703676
type: array
36713677
flowFilter:

‎config/samples/flows_v1beta2_flowcollector.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ spec:
2626
# - "PacketTranslation"
2727
# - "EbpfManager"
2828
# - "UDNMapping"
29+
# - "IPSEC"
2930
interfaces: []
3031
excludeInterfaces: ["lo"]
3132
kafkaBatchSize: 1048576

‎controllers/consoleplugin/config/static-frontend-config.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -657,6 +657,13 @@ columns:
657657
default: false
658658
width: 15
659659
feature: packetTranslation
660+
- id: IPsec
661+
name: Encrypted
662+
field: EncryptedFlow
663+
filter: encrypted
664+
default: true
665+
width: 10
666+
feature: ipsec
660667
filters:
661668
- id: cluster_name
662669
name: Cluster
@@ -1057,6 +1064,9 @@ filters:
10571064
component: autocomplete
10581065
category: destination
10591066
hint: Specify a single port number or name.
1067+
- id: encrypted
1068+
name: encrypted flow
1069+
component: number
10601070
scopes:
10611071
- id: cluster
10621072
name: Cluster
@@ -1415,6 +1425,9 @@ fields:
14151425
- name: K8S_ClusterName
14161426
type: string
14171427
description: Cluster name or identifier
1428+
- name: EncryptedFlow
1429+
type: boolean
1430+
description: encrypted flow
14181431
- name: _RecordType
14191432
type: string
14201433
description: "Type of record: 'flowLog' for regular flow logs, or 'newConnection', 'heartbeat', 'endConnection' for conversation tracking"

‎controllers/consoleplugin/consoleplugin_objects.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -466,6 +466,10 @@ func (b *builder) setFrontendConfig(fconf *cfg.FrontendConfig) error {
466466
fconf.Features = append(fconf.Features, "udnMapping")
467467
}
468468

469+
if helper.IsIPSecEnabled(&b.desired.Agent.EBPF) {
470+
fconf.Features = append(fconf.Features, "ipsec")
471+
}
472+
469473
if b.desired.Agent.EBPF.Advanced != nil {
470474
if v, ok := b.desired.Agent.EBPF.Advanced.Env[ebpf.EnvDedupeJustMark]; ok {
471475
dedupJustMark, err = strconv.ParseBool(v)

‎controllers/ebpf/agent_controller.go‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,7 @@ const (
7070
envEnablePacketTranslation = "ENABLE_PKT_TRANSLATION"
7171
envEnableEbpfMgr = "EBPF_PROGRAM_MANAGER_MODE"
7272
envEnableUDNMapping = "ENABLE_UDN_MAPPING"
73+
envEnableIPsec = "ENABLE_IPSEC_TRACKING"
7374
envListSeparator = ","
7475
)
7576

@@ -752,6 +753,13 @@ func (c *AgentController) setEnvConfig(coll *flowslatest.FlowCollector) []corev1
752753
})
753754
}
754755

756+
if helper.IsIPSecEnabled(&coll.Spec.Agent.EBPF) {
757+
config = append(config, corev1.EnvVar{
758+
Name: envEnableIPsec,
759+
Value: "true",
760+
})
761+
}
762+
755763
if helper.IsEBPFMetricsEnabled(&coll.Spec.Agent.EBPF) {
756764
config = append(config, corev1.EnvVar{
757765
Name: envEnableMetrics,

‎docs/FlowCollector.md‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -294,7 +294,8 @@ If the `spec.agent.ebpf.privileged` parameter is not set, an error is reported.<
294294
the kernel debug filesystem, so the eBPF pod has to run as privileged.
295295
- `PacketTranslation`: enable enriching flows with packet's translation information. <br>
296296
- `EbpfManager`: allow using eBPF manager to manage netobserv ebpf programs. <br>
297-
- `UDNMapping`, to enable interfaces mappind to udn. <br><br/>
297+
- `UDNMapping`, to enable interfaces mappind to udn. <br>
298+
- `IPSEC`, to track flows with IPsec encryption. <br><br/>
298299
</td>
299300
<td>false</td>
300301
</tr><tr>
@@ -6284,6 +6285,7 @@ IMPORTANT: This feature is available as a Developer Preview.<br>
62846285
- `EbpfManager`: allow using eBPF manager to manage netobserv ebpf programs. <br>
62856286
IMPORTANT: This feature is available as a Developer Preview.<br>
62866287
- `UDNMapping`, to enable interfaces mappind to udn. <br>
6288+
- `IPSEC`, to track flows with IPsec encryption. <br>
62876289
This feature requires mounting the kernel debug filesystem, so the eBPF agent pods have to run as privileged.
62886290
It requires using the OVN-Kubernetes network plugin with the Observability feature.
62896291
IMPORTANT: This feature is available as a Developer Preview.<br><br/>

‎pkg/helper/flowcollector.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -138,6 +138,10 @@ func IsUDNMappingEnabled(spec *flowslatest.FlowCollectorEBPF) bool {
138138
return IsAgentFeatureEnabled(spec, flowslatest.UDNMapping)
139139
}
140140

141+
func IsIPSecEnabled(spec *flowslatest.FlowCollectorEBPF) bool {
142+
return IsAgentFeatureEnabled(spec, flowslatest.IPSEC)
143+
}
144+
141145
func IsConntrack(spec *flowslatest.FlowCollectorFLP) bool {
142146
return spec != nil && spec.LogTypes != nil && *spec.LogTypes != flowslatest.LogTypeFlows
143147
}

0 commit comments

Comments
 (0)