NETOBSERV-1109 remove reinterpret direction

[jpinsonneau]

Following NETOBSERV-1099 EGRESS / INGRESS metrics are not consistent using reinterpretDirection function.

I suggest to simply remove it to stick with IPFIX definition. The metrics are consistent after that (see netobserv/network-observability-console-plugin#366 (comment)).
Keeping it double the numbers in the Overview section graphs

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from jpinsonneau. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

New images:

• quay.io/netobserv/network-observability-operator:22cd8f4
• quay.io/netobserv/network-observability-operator-bundle:v0.0.0-22cd8f4
• quay.io/netobserv/network-observability-operator-catalog:v0.0.0-22cd8f4

They will expire after two weeks.

To deploy this build:

# Direct deployment, from operator repo
IMAGE=quay.io/netobserv/network-observability-operator:22cd8f4 make deploy

# Or using operator-sdk
operator-sdk run bundle quay.io/netobserv/network-observability-operator-bundle:v0.0.0-22cd8f4

Or as a Catalog Source:

apiVersion: operators.coreos.com/v1alpha1
kind: CatalogSource
metadata:
  name: netobserv-dev
  namespace: openshift-marketplace
spec:
  sourceType: grpc
  image: quay.io/netobserv/network-observability-operator-catalog:v0.0.0-22cd8f4
  displayName: NetObserv development catalog
  publisher: Me
  updateStrategy:
    registryPoll:
      interval: 1m

[msherif1234]

I am fine removing reinterpret logic given the issues seen
/LGTM

[jpinsonneau]

I am fine removing reinterpret logic given the issues seen /LGTM

I think I will wait for @jotak anyways before merging this.
I'm still not convinced by the results I get using concrete download / upload testing (see netobserv/network-observability-console-plugin#366 (comment))

[msherif1234]

I am fine removing reinterpret logic given the issues seen /LGTM

I think I will wait for @jotak anyways before merging this. I'm still not convinced by the results I get using concrete download / upload testing (see netobserv/network-observability-console-plugin#366 (comment))
as long as QE not blocked then that can wait

[jotak]

Did you double-check that the original issue https://issues.redhat.com/browse/NETOBSERV-696 is not being reintroduced with this?
I am not sure why fixing the FlowDirection (ie use reinterpret-direction) would cause troubles, but, that said, I guess I get why it would work now: since reporters are now merged in queries, we're less affected than before by the "unsoundness" of FlowDirection as provided by the agent (ie. direction relative to the interfaces rather than the host).

[jpinsonneau]

Did you double-check that the original issue https://issues.redhat.com/browse/NETOBSERV-696 is not being reintroduced with this?

That brings back the initial issue indeed:

• Without reinterpret:
  
  

• With reinterpret:
  
  

I am not sure why fixing the FlowDirection (ie use reinterpret-direction) would cause troubles

As written in the description, it messes up the upload / download scenarios. Amonts are incorrect. Here is the example for download:

• Without reinterpret (correct numbers):
  
  

• With reinterpret (wrong numbers):
  
  

[jotak]

Trying to reproduce, I do indeed see an issue with the bytes volume reported but I get the same issue with or without this PR, in other words, apparently not related to reinterpret-direction

To try locate the bug, I'm looking at the raw flows stored in loki rather than the computed metrics: the raw flows themselves are wrong, ie. they always show a value smaller to what I'd expect after downloading large volumes.

Example: capture in Loki after downloading a 500MB image (sampling is 1) :

It shows only ~100MB while I would expect 500MB. I see the same issue keeping or removing reinterpret-direction.
My gut feeling would be something wrong in the ebpf agent aggregation logic

[github-actions]

New images:

• quay.io/netobserv/network-observability-operator:22cd8f4
• quay.io/netobserv/network-observability-operator-bundle:v0.0.0-22cd8f4
• quay.io/netobserv/network-observability-operator-catalog:v0.0.0-22cd8f4

They will expire after two weeks.

To deploy this build:

# Direct deployment, from operator repo
IMAGE=quay.io/netobserv/network-observability-operator:22cd8f4 make deploy

# Or using operator-sdk
operator-sdk run bundle quay.io/netobserv/network-observability-operator-bundle:v0.0.0-22cd8f4

Or as a Catalog Source:

apiVersion: operators.coreos.com/v1alpha1
kind: CatalogSource
metadata:
  name: netobserv-dev
  namespace: openshift-marketplace
spec:
  sourceType: grpc
  image: quay.io/netobserv/network-observability-operator-catalog:v0.0.0-22cd8f4
  displayName: NetObserv development catalog
  publisher: Me
  updateStrategy:
    registryPoll:
      interval: 1m

[jpinsonneau]

Closing this in favor of "INNER" alternative