hubble: Display proxy redirects in policy verdict events #17411
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Before this commit, Hubble was ignoring proxy redirection information
from the policy-verdict events it received from the datapath. For
example, a cilium monitor event such as:
Policy verdict log: flow 0x0 local EP ID 1531, remote ID 35429, proto 17, egress, action redirect, match L3-L4, 10.240.0.62:37282 -> 10.240.0.63:53 udp
would be displayed in hubble observe as:
Sep 15 17:23:11.960: cilium-test/client-6488dcf5d4-f9kfl:37282 -> kube-system/coredns-d4866bcb7-zh5jv:53 L3-L4 FORWARDED (UDP)
This commit adds a new verdict REDIRECTED to signal such event. Such
events now appear as:
default/pod-to-external-fqdn-allow-google-cnp-5ff4986c89-n87h2:58314 -> kube-system/coredns-755cd654d4-j4vzh:53 UNKNOWN 5 (UDP)
A subsequent patch to the Hubble command line will display value 5 as
"REDIRECTED".
Signed-off-by: Paul Chaignon <paul@cilium.io>
pchaigno
added
kind/bug
glibsm
approved these changes
Sep 15, 2021
|
test-me-please Job 'Cilium-PR-K8s-1.19-kernel-5.4' failed and has not been observed before, so may be related to your PR: Click to show.Test NameFailure OutputIf it is a flake, comment |
aanm
approved these changes
Sep 17, 2021
pchaigno
added a commit
to cilium/hubble
that referenced
this pull request
Sep 17, 2021
To pull in cilium/cilium#17411 which defines Verdict_REDIRECTED. Signed-off-by: Paul Chaignon <paul@cilium.io>
pchaigno
added a commit
to cilium/hubble
that referenced
this pull request
Sep 20, 2021
To pull in cilium/cilium#17411 which defines Verdict_REDIRECTED. Signed-off-by: Paul Chaignon <paul@cilium.io>
rolinh
pushed a commit
to cilium/hubble
that referenced
this pull request
Sep 20, 2021
To pull in cilium/cilium#17411 which defines Verdict_REDIRECTED. Signed-off-by: Paul Chaignon <paul@cilium.io>
This was referenced Sep 27, 2021
maintainer-s-little-helper
bot
moved this from Needs backport from master
to Backport pending to v1.10
in 1.10.5
maintainer-s-little-helper
bot
moved this from Backport pending to v1.10
to Backport done to v1.10
in 1.10.5
maintainer-s-little-helper
bot
moved this from Backport pending to v1.10
to Backport done to v1.10
in 1.10.5
errordeveloper
added a commit
to cilium/hubble-otel
that referenced
this pull request
Nov 10, 2021
This is required to avoid `unknown Cilium policy verdict event` spans that happen due to addition of new REDIRECTED verdict (see cilium/cilium#17411). New version of Hubble hasn't been released yet, but the change has been backported to v0.8 branch (cilium/hubble#639).
errordeveloper
added a commit
to cilium/hubble-otel
that referenced
this pull request
Nov 10, 2021
This is required to avoid `unknown Cilium policy verdict event` spans that happen due to addition of new REDIRECTED verdict (see cilium/cilium#17411). New version of Hubble hasn't been released yet, but the change has been backported to v0.8 branch (cilium/hubble#639).
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Before this commit, Hubble was ignoring proxy redirection information from the policy-verdict events it received from the datapath. For example, a
cilium monitorevent such as:would be displayed in
hubble observeas:This pull request adds a new verdict
REDIRECTEDto signal such event. Such events now appear as:A subsequent patch to the Hubble command line will display value 5 as
REDIRECTED.