CFP: Correlate policy verdicts to network policies

[sypakine]

Cilium Feature Proposal

Desired Feature

Policy verdict correlation

When a policy verdict event is produced for a flow, correlate the set of network policies that result in that verdict.

Example output for a flow:

{
  "flow": {
    "time": "2023-06-22T17:23:02.204172941Z",
    "verdict": "FORWARDED",
    "ethernet": {
      "source": "9e:b2:fc:ca:4b:7a",
      "destination": "a6:35:14:0d:02:64"
    },
    "IP": {
      "source": "10.128.0.22",
      "destination": "10.48.1.17",
      "ipVersion": "IPv4"
    },
    "l4": {
      "TCP": {
        "source_port": 80,
        "destination_port": 55555,
        "flags": {
          "SYN": true,
          "ACK": true
        }
      }
    },
    "source": {
      "identity": 2,
      "labels": [
        "reserved:world"
      ]
    },
    "destination": {
      "ID": 3798,
      "identity": 31051,
      "namespace": "default",
      "labels": [
        "k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=default",
        "k8s:io.cilium.k8s.policy.cluster=default",
        "k8s:io.cilium.k8s.policy.serviceaccount=default",
        "k8s:io.kubernetes.pod.namespace=default"
      ],
      "pod_name": "client-7494b5866d-w69gw",
      "workloads": [
        {
          "name": "client",
          "kind": "Deployment"
        }
      ]
    },
    "Type": "L3_L4",
    "node_name": "gke-cluster-default-pool-025d71ba-q92f",
    "event_type": {
      "type": 5
    },
    "source_service": {
      "name": "service",
      "namespace": "default"
    },
    "traffic_direction": "INGRESS",
    "policy_match_type": 4,
    "policies":[                                 #<--- new field
      {
         "kind":"NetworkPolicy",
         "name":"allow-all",
         "namespace":"default"
      },
      {
         "kind":"CiliumClusterwideNetworkPolicy",
         "name":"allow-all",
      },
    ], 
    "is_reply": false,
    "Summary": "TCP Flags: SYN, ACK"
  },
  "node_name": "gke-cluster-default-pool-025d71ba-q92f",
  "time": "2023-06-22T17:23:02.204172941Z"
}

Proposed Solution

Proposal is outlined in the following Google Doc:

https://docs.google.com/document/d/1puY1kAwZ7QK4Kfpn3kDjo3tCh5OzgOIkxL3rQzosVFI/edit#

[gandro]

Thanks for the CFP. I think the high-level motivation makes sense.

Overall, I'd like to understand the meaning of a "correlated policy", since CFP is also very short on the actual implementation of the "correlator". What are the condition for a policy to be correlated? An entry in the policy map? A matching L7 rule? The actual criteria here defines how expensive correlation is. If we only correlate on policy map entries, then that's cheaper than having an exact L7 policy match, but it's also less precise, since all L7 polices share a policy map entry, but not all of them will necessary have allowed the flow.

[michi-covalent]

i reviewed the CFP. the high level motivations make sense 🚀. @sypakine could you take another look at the google docs? there are some questions / comments there 🙏

[xmulligan]

@sypakine would you mind adding the CFP to the design repo? https://github.com/cilium/design-cfps

[xmulligan]

@sypakine do you want me to add it to the repo instead?