Remove redundant log in fillPodInfo/fillServiceInfo and update deny connection store. #5592

yuntanghsu · 2023-10-17T23:31:42Z

Remove redundant logs in fillPodInfo/fillServiceInfo to avoid Flow
Exporter from flooding logs.
Add Mark field for deny connections. We were missing this field
previously, resulting in trying to fill service information for
non-service IPs.
Update the DestinationServiceAddress for deny connections when we can
find this information in PacketIn.
Update e2e/unit tests to verify that the Service-relateds field are
filled correctly.

Fixes #5573

test/e2e/flowaggregator_test.go

pkg/agent/controller/networkpolicy/packetin.go

pkg/agent/flowexporter/connections/connections.go

pkg/agent/flowexporter/connections/deny_connections_test.go

test/e2e/flowaggregator_test.go

pkg/agent/controller/networkpolicy/packetin.go

pkg/agent/flowexporter/connections/connections.go

pkg/agent/flowexporter/connections/conntrack_connections.go

pkg/agent/flowexporter/connections/deny_connections.go

test/e2e/bandwidth_test.go

antoninbas · 2023-10-31T23:39:13Z

test/e2e/flowaggregator_test.go

-func testHelper(t *testing.T, data *TestData, podAIPs, podBIPs, podCIPs, podDIPs, podEIPs *PodIPs, isIPv6 bool) {
-	svcB, svcC, err := createPerftestServices(data, isIPv6)
+func testHelper(t *testing.T, data *TestData, isIPv6 bool) {
+	svcB, svcC, svcD, svcE, err := createPerftestServices(data, isIPv6)


should we also move createPerftestServices to TestFlowAggregator, and maybe simplify the code by creating one Service for each Pod indiscriminately?

I think it should be kept in testHelper as the services need to be created based on the isIPv6 condition?

it doesn't have to be done in this PR necessarily, but it would be better to create the Services once, in TestFlowAggregator. The IPFamilies field in the ServiceSpec is a list, and based on what the cluster supports, it can be set to [IPv4], [IPv4, IPv6], or [IPv6]. Then the test can access the service using the correct IP. What do you think?

It should be a good idea as IPFamilies is a list. Since CreateServiceWithAnnotations is used by many functions, I think it might be better to open another PR to make this change.

I opened another PR to change the type of IPFamily. #5690

test/e2e/flowaggregator_test.go

tnqn · 2023-11-01T09:49:58Z

pkg/agent/controller/networkpolicy/packetin.go

+	if dstSvcAddress != nil {
+		denyConn.DestinationServiceAddress = *dstSvcAddress
+	}
+	if dstSvcPort != 0 {
+		denyConn.DestinationServicePort = dstSvcPort
+	}


I don't get this. How do we know this is ServiceAddress and ServicePort? Every tracked connection can have these two fields.

I think these represent the Original Direction IPv4 Destination Address and Original Direction Transport Layer Source Port. If they do not belong to a service (by checking the CTMark), we won't fill the service information.
I think we do the same strategy for the connection in the conntrack table?

antrea/pkg/agent/flowexporter/connections/conntrack_linux.go

Line 144 in 181671f

DestinationServiceAddress: conn.TupleOrig.IP.DestinationAddress,

Then this is perhaps a naming thing, is there any reason why we don't call them OriginalDestinationAddress and OriginalDestinationPort? They mean the ServiceAddress and ServicePort when this is a Service connection.

I don't know the reason why we name it DestinationServiceAddress/DestinationServicePort. I agree with you that it should be filled only when it is a service connection. I think we can either rename it or fill this field only when CTMark belongs to a service. Changes for the latter one will be easier as we don't need to rename these two fields for all the packages. What do you think?

@yuntanghsu I don't think you addressed this? Did you discuss it with Quan offline or did you plan to have a follow up PR?

No, I don't. I was waiting for @tnqn 's opinion. If we need to rename it, I think it's better to open another PR to address this issue. Otherwise, we can fill these two fields only when the CTMark belongs to a service in this PR.

Yes, I thought you were going to update the PR to go with the second option (omit fields if we cannot identify the packet as belonging to Service traffic). That's assuming that we don't use these fields for anything else.

Actually, I found that we won't see the values for these two fields in the FlowAggregator or the ClickHouse if it is a non-service traffic. We reset these two fields before we export the records if DestinationServicePortName is an empty string (non-service connection or we can't find the service info).

antrea/pkg/agent/flowexporter/exporter/exporter.go

Line 522 in 4a52bca

case "destinationClusterIPv4":

antrea/pkg/agent/flowexporter/exporter/exporter.go

Line 538 in 4a52bca

case "destinationServicePort":

I think the current logic is:

We temporarily fill OriginalDestinationAddress and OriginalDestinationPort to DestinationServiceAddress and DestinationServicePort

We use these two values to check if we can find service info. If we find the info, we fill DestinationServicePortName

If DestinationServicePortName is an empty string, we reset DestinationServiceAddress and DestinationServicePort because it is a non-service traffic or we can't find the service information.

Do you think we still need to omit it when we do Poll() or when we have packet from PacketIn?

I talked to Yun-Tang offline. We think it makes more sense to rename the fields to OriginalDestinationAddress and OriginalDestinationPort. He will do it in a follow-up PR.

pkg/agent/flowexporter/connections/connections.go

Signed-off-by: Yun-Tang Hsu <hsuy@vmware.com>

test/e2e/flowaggregator_test.go

Signed-off-by: Yun-Tang Hsu <hsuy@vmware.com>

tnqn

LGTM

antoninbas · 2023-11-13T20:00:11Z

/test-all

…onnection store. (antrea-io#5592) 1. Remove redundant logs in fillPodInfo/fillServiceInfo to avoid Flow Exporter from flooding logs. 2. Add Mark field for deny connections. We were missing this field previously, resulting in trying to fill service information for non-service IPs. 3. Update the DestinationServiceAddress for deny connections when we can find this information in PacketIn. 4. Update e2e/unit tests to verify that the Service-relateds field are filled correctly. Fixes antrea-io#5573 Signed-off-by: Yun-Tang Hsu <hsuy@vmware.com>

…onnection store. (#5592) 1. Remove redundant logs in fillPodInfo/fillServiceInfo to avoid Flow Exporter from flooding logs. 2. Add Mark field for deny connections. We were missing this field previously, resulting in trying to fill service information for non-service IPs. 3. Update the DestinationServiceAddress for deny connections when we can find this information in PacketIn. 4. Update e2e/unit tests to verify that the Service-relateds field are filled correctly. Fixes #5573 Signed-off-by: Yun-Tang Hsu <hsuy@vmware.com>

yuntanghsu marked this pull request as draft October 18, 2023 01:11

yuntanghsu force-pushed the rm_log branch 2 times, most recently from d0eb624 to e5ed605 Compare October 24, 2023 20:22

yuntanghsu changed the title ~~Remove redundant log in fillPodInfo/fillServiceInfo~~ Remove redundant log in fillPodInfo/fillServiceInfo and update deny connection store. Oct 24, 2023

yuntanghsu marked this pull request as ready for review October 24, 2023 20:24

yuntanghsu requested a review from dreamtalen October 25, 2023 22:34

elton-furtado requested review from tnqn and antoninbas October 26, 2023 19:05

dreamtalen reviewed Oct 26, 2023

View reviewed changes

yuntanghsu force-pushed the rm_log branch from e5ed605 to 31dbaad Compare October 26, 2023 23:11

antoninbas reviewed Oct 27, 2023

View reviewed changes

yuntanghsu force-pushed the rm_log branch from 6c3ad01 to bbddf99 Compare October 31, 2023 21:22

antoninbas reviewed Oct 31, 2023

View reviewed changes

tnqn reviewed Nov 1, 2023

View reviewed changes

tnqn added action/backport Indicates a PR that requires backports. action/release-note Indicates a PR that should be included in release notes. labels Nov 1, 2023

yuntanghsu added 5 commits November 1, 2023 15:40

Remove redundant log in fillPodInfo/fillServiceInfo

0e75a35

Signed-off-by: Yun-Tang Hsu <hsuy@vmware.com>

add ctmark and dstSvcIp to denied connection

a17d3c6

Signed-off-by: Yun-Tang Hsu <hsuy@vmware.com>

Modify e2e and unit test

4255e25

Signed-off-by: Yun-Tang Hsu <hsuy@vmware.com>

Address comment

45ec706

Signed-off-by: Yun-Tang Hsu <hsuy@vmware.com>

Address review comments

038b556

Signed-off-by: Yun-Tang Hsu <hsuy@vmware.com>

yuntanghsu force-pushed the rm_log branch 2 times, most recently from 5baf97d to 1d0fd4e Compare November 1, 2023 23:17

antoninbas reviewed Nov 2, 2023

View reviewed changes

test/e2e/flowaggregator_test.go Outdated Show resolved Hide resolved

yuntanghsu marked this pull request as draft November 2, 2023 01:34

yuntanghsu force-pushed the rm_log branch 5 times, most recently from 16b2b53 to 10c0cf5 Compare November 2, 2023 18:27

Change net.IP to netip.Addr

2bdb370

Signed-off-by: Yun-Tang Hsu <hsuy@vmware.com>

yuntanghsu force-pushed the rm_log branch from 10c0cf5 to 2bdb370 Compare November 2, 2023 20:00

yuntanghsu marked this pull request as ready for review November 3, 2023 16:32

yuntanghsu requested review from antoninbas and tnqn November 8, 2023 18:44

tnqn approved these changes Nov 9, 2023

View reviewed changes

antoninbas approved these changes Nov 13, 2023

View reviewed changes

antoninbas merged commit d6766cc into antrea-io:main Nov 14, 2023
46 of 55 checks passed

yuntanghsu deleted the rm_log branch November 14, 2023 18:28

This was referenced Nov 14, 2023

[FlowExporter] Need uniform handling for "External-to-Pod" traffic #5706

Open

[Test] "E2e tests on a Kind cluster on Linux for Flow Visibility" job keeps failing #5730

Closed

yuntanghsu mentioned this pull request Jan 22, 2024

Cherry pick of #5592: Remove redundant log in fillPodInfo/fillServiceInfo, #5731: Use labels to enhance records filtering in FA e2e tests, #5770: Improve flow-visibility e2e test on upstream release 1.14 #5900

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Remove redundant log in fillPodInfo/fillServiceInfo and update deny connection store. #5592

Remove redundant log in fillPodInfo/fillServiceInfo and update deny connection store. #5592

yuntanghsu commented Oct 17, 2023 •

edited by antoninbas

antoninbas Oct 31, 2023

yuntanghsu Nov 1, 2023

antoninbas Nov 2, 2023

yuntanghsu Nov 3, 2023

yuntanghsu Nov 10, 2023

tnqn Nov 1, 2023

yuntanghsu Nov 1, 2023

tnqn Nov 2, 2023

yuntanghsu Nov 3, 2023

antoninbas Nov 13, 2023

yuntanghsu Nov 13, 2023 •

edited

antoninbas Nov 13, 2023

yuntanghsu Nov 14, 2023 •

edited

antoninbas Nov 14, 2023 •

edited

tnqn left a comment

antoninbas commented Nov 13, 2023

Remove redundant log in fillPodInfo/fillServiceInfo and update deny connection store. #5592

Remove redundant log in fillPodInfo/fillServiceInfo and update deny connection store. #5592

Conversation

yuntanghsu commented Oct 17, 2023 • edited by antoninbas

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

yuntanghsu Nov 13, 2023 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

yuntanghsu Nov 14, 2023 • edited

Choose a reason for hiding this comment

antoninbas Nov 14, 2023 • edited

Choose a reason for hiding this comment

tnqn left a comment

Choose a reason for hiding this comment

antoninbas commented Nov 13, 2023

yuntanghsu commented Oct 17, 2023 •

edited by antoninbas

yuntanghsu Nov 13, 2023 •

edited

yuntanghsu Nov 14, 2023 •

edited

antoninbas Nov 14, 2023 •

edited