NETOBSERV-2221: (follow-up) make default metrics, show % ipsec traffic

jotak · jotak · commit 4ccbc91f3e44 · 2025-05-28T16:34:49.000+02:00
diff --git a/apis/flowcollector/v1beta1/flowcollector_types.go b/apis/flowcollector/v1beta1/flowcollector_types.go
@@ -483,7 +483,7 @@ const (
 type FLPAlert string
 
 // Metric name. More information in https://github.com/netobserv/network-observability-operator/blob/main/docs/Metrics.md.
-// +kubebuilder:validation:Enum:="namespace_egress_bytes_total";"namespace_egress_packets_total";"namespace_ingress_bytes_total";"namespace_ingress_packets_total";"namespace_flows_total";"node_egress_bytes_total";"node_egress_packets_total";"node_ingress_bytes_total";"node_ingress_packets_total";"node_flows_total";"workload_egress_bytes_total";"workload_egress_packets_total";"workload_ingress_bytes_total";"workload_ingress_packets_total";"workload_flows_total";"namespace_drop_bytes_total";"namespace_drop_packets_total";"node_drop_bytes_total";"node_drop_packets_total";"workload_drop_bytes_total";"workload_drop_packets_total";"namespace_rtt_seconds";"node_rtt_seconds";"workload_rtt_seconds";"namespace_dns_latency_seconds";"node_dns_latency_seconds";"workload_dns_latency_seconds";"node_ipsec_flows_total"
+// +kubebuilder:validation:Enum:="namespace_egress_bytes_total";"namespace_egress_packets_total";"namespace_ingress_bytes_total";"namespace_ingress_packets_total";"namespace_flows_total";"node_egress_bytes_total";"node_egress_packets_total";"node_ingress_bytes_total";"node_ingress_packets_total";"node_flows_total";"workload_egress_bytes_total";"workload_egress_packets_total";"workload_ingress_bytes_total";"workload_ingress_packets_total";"workload_flows_total";"namespace_drop_bytes_total";"namespace_drop_packets_total";"node_drop_bytes_total";"node_drop_packets_total";"workload_drop_bytes_total";"workload_drop_packets_total";"namespace_rtt_seconds";"node_rtt_seconds";"workload_rtt_seconds";"namespace_dns_latency_seconds";"node_dns_latency_seconds";"workload_dns_latency_seconds";"node_ipsec_flows_total";"cross_nodes_ingress_flows_total"
 type FLPMetric string
 
 // `FLPMetrics` define the desired FLP configuration regarding metrics
diff --git a/apis/flowcollector/v1beta2/flowcollector_types.go b/apis/flowcollector/v1beta2/flowcollector_types.go
@@ -570,7 +570,7 @@ const (
 )
 
 // Metric name. More information in https://github.com/netobserv/network-observability-operator/blob/main/docs/Metrics.md.
-// +kubebuilder:validation:Enum:="namespace_egress_bytes_total";"namespace_egress_packets_total";"namespace_ingress_bytes_total";"namespace_ingress_packets_total";"namespace_flows_total";"node_egress_bytes_total";"node_egress_packets_total";"node_ingress_bytes_total";"node_ingress_packets_total";"node_flows_total";"workload_egress_bytes_total";"workload_egress_packets_total";"workload_ingress_bytes_total";"workload_ingress_packets_total";"workload_flows_total";"namespace_drop_bytes_total";"namespace_drop_packets_total";"node_drop_bytes_total";"node_drop_packets_total";"workload_drop_bytes_total";"workload_drop_packets_total";"namespace_rtt_seconds";"node_rtt_seconds";"workload_rtt_seconds";"namespace_dns_latency_seconds";"node_dns_latency_seconds";"workload_dns_latency_seconds";"node_network_policy_events_total";"namespace_network_policy_events_total";"workload_network_policy_events_total";"node_ipsec_flows_total"
+// +kubebuilder:validation:Enum:="namespace_egress_bytes_total";"namespace_egress_packets_total";"namespace_ingress_bytes_total";"namespace_ingress_packets_total";"namespace_flows_total";"node_egress_bytes_total";"node_egress_packets_total";"node_ingress_bytes_total";"node_ingress_packets_total";"node_flows_total";"workload_egress_bytes_total";"workload_egress_packets_total";"workload_ingress_bytes_total";"workload_ingress_packets_total";"workload_flows_total";"namespace_drop_bytes_total";"namespace_drop_packets_total";"node_drop_bytes_total";"node_drop_packets_total";"workload_drop_bytes_total";"workload_drop_packets_total";"namespace_rtt_seconds";"node_rtt_seconds";"workload_rtt_seconds";"namespace_dns_latency_seconds";"node_dns_latency_seconds";"workload_dns_latency_seconds";"node_network_policy_events_total";"namespace_network_policy_events_total";"workload_network_policy_events_total";"node_ipsec_flows_total";"cross_nodes_ingress_flows_total"
 type FLPMetric string
 
 // `FLPMetrics` define the desired FLP configuration regarding metrics
diff --git a/bundle/manifests/flows.netobserv.io_flowcollectors.yaml b/bundle/manifests/flows.netobserv.io_flowcollectors.yaml
@@ -2415,6 +2415,7 @@ spec:
                           - node_dns_latency_seconds
                           - workload_dns_latency_seconds
                           - node_ipsec_flows_total
+                          - cross_nodes_ingress_flows_total
                           type: string
                         type: array
                       server:
@@ -8689,6 +8690,7 @@ spec:
                           - namespace_network_policy_events_total
                           - workload_network_policy_events_total
                           - node_ipsec_flows_total
+                          - cross_nodes_ingress_flows_total
                           type: string
                         type: array
                       server:
diff --git a/config/crd/bases/flows.netobserv.io_flowcollectors.yaml b/config/crd/bases/flows.netobserv.io_flowcollectors.yaml
@@ -2207,6 +2207,7 @@ spec:
                               - node_dns_latency_seconds
                               - workload_dns_latency_seconds
                               - node_ipsec_flows_total
+                              - cross_nodes_ingress_flows_total
                             type: string
                           type: array
                         server:
@@ -8006,6 +8007,7 @@ spec:
                               - namespace_network_policy_events_total
                               - workload_network_policy_events_total
                               - node_ipsec_flows_total
+                              - cross_nodes_ingress_flows_total
                             type: string
                           type: array
                         server:
diff --git a/controllers/flp/flp_controller_flowmetrics_test.go b/controllers/flp/flp_controller_flowmetrics_test.go
@@ -126,7 +126,7 @@ func ControllerFlowMetricsSpecs() {
 					return err
 				}
 				return metrics
-			}, timeout, interval).Should(HaveLen(5)) // only default metrics
+			}, timeout, interval).Should(HaveLen(6)) // only default metrics
 		})
 	})
 
diff --git a/controllers/flp/flp_pipeline_builder_test.go b/controllers/flp/flp_pipeline_builder_test.go
@@ -105,6 +105,7 @@ func TestMergeMetricsConfiguration_Default(t *testing.T) {
 	cfs, _ := validatePipelineConfig(t, scm, dcm)
 	names := getSortedMetricsNames(cfs.Parameters[5].Encode.Prom.Metrics)
 	assert.Equal([]string{
+		"cross_nodes_ingress_flows_total",
 		"namespace_flows_total",
 		"node_egress_bytes_total",
 		"node_ingress_bytes_total",
@@ -127,6 +128,7 @@ func TestMergeMetricsConfiguration_DefaultWithFeatures(t *testing.T) {
 	cfs, _ := validatePipelineConfig(t, scm, dcm)
 	names := getSortedMetricsNames(cfs.Parameters[5].Encode.Prom.Metrics)
 	assert.Equal([]string{
+		"cross_nodes_ingress_flows_total",
 		"namespace_dns_latency_seconds",
 		"namespace_drop_packets_total",
 		"namespace_flows_total",
diff --git a/controllers/flp/metrics_api_test.go b/controllers/flp/metrics_api_test.go
@@ -79,6 +79,7 @@ func TestFlowMetricToFLP(t *testing.T) {
 	assert.NoError(err)
 	names := getSortedMetricsNames(items)
 	assert.Equal([]string{
+		"cross_nodes_ingress_flows_total",
 		"m_1",
 		"m_2",
 		"namespace_flows_total",
diff --git a/docs/Metrics.md b/docs/Metrics.md
@@ -32,6 +32,7 @@ Available names are: (names followed by `*` are enabled by default; names follow
 - `workload_ingress_bytes_total` `*`
 - `workload_ingress_packets_total`
 - `workload_flows_total`
+- `cross_nodes_ingress_flows_total` `*`
 
 When the `PacketDrop` feature is enabled in `spec.agent.ebpf.features` (with privileged mode), additional metrics are available:
 - `namespace_drop_bytes_total`
@@ -57,7 +58,7 @@ When the `NetworkEvents` feature is enabled in `spec.agent.ebpf.features`,
 - `workload_network_policy_events_total`
 
 When the `IPSec` feature is enabled in `spec.agent.ebpf.features`,
-- `node_ipsec_flows_total`
+- `node_ipsec_flows_total` `*`
 
 ## Custom metrics using the FlowMetrics API
 
diff --git a/helm/templates/flows.netobserv.io_flowcollectors.yaml b/helm/templates/flows.netobserv.io_flowcollectors.yaml
@@ -2221,6 +2221,7 @@ spec:
                               - node_dns_latency_seconds
                               - workload_dns_latency_seconds
                               - node_ipsec_flows_total
+                              - cross_nodes_ingress_flows_total
                             type: string
                           type: array
                         server:
@@ -8020,6 +8021,7 @@ spec:
                               - namespace_network_policy_events_total
                               - workload_network_policy_events_total
                               - node_ipsec_flows_total
+                              - cross_nodes_ingress_flows_total
                             type: string
                           type: array
                         server:
diff --git a/pkg/dashboards/dashboard_test.go b/pkg/dashboards/dashboard_test.go
@@ -23,7 +23,7 @@ func TestCreateFlowMetricsDashboard_All(t *testing.T) {
 
 	assert.Equal([]string{"Overview", "Traffic rates", "TCP latencies", "Byte and packet drops", "DNS", "Network Policy", "IPsec"}, d.Titles())
 
-	assert.Len(d.Rows[0].Panels, 18)
+	assert.Len(d.Rows[0].Panels, 19)
 	assert.Len(d.Rows[1].Panels, 20)
 
 	p := d.FindPanel("Top egress traffic per node")
diff --git a/pkg/metrics/predefined_charts.go b/pkg/metrics/predefined_charts.go
@@ -248,7 +248,19 @@ func netpolCharts(group string) []metricslatest.Chart {
 
 func ipsecStatusChart(group string) []metricslatest.Chart {
 	sectionName := "IPsec"
-	charts := chartVariantsFor(&metricslatest.Chart{
+	charts := []metricslatest.Chart{{
+		Type:          metricslatest.ChartTypeSingleStat,
+		SectionName:   "",
+		DashboardName: mainDashboard,
+		Title:         "IPsec encrypted traffic",
+		Unit:          metricslatest.UnitPercent,
+		Queries: []metricslatest.Query{
+			{
+				PromQL: "sum(rate(netobserv_node_ipsec_flows_total[2m])) / sum(rate(netobserv_cross_nodes_ingress_flows_total[2m]))",
+			},
+		},
+	}}
+	charts = append(charts, chartVariantsFor(&metricslatest.Chart{
 		Type:          metricslatest.ChartTypeLine,
 		SectionName:   sectionName,
 		DashboardName: mainDashboard,
@@ -257,7 +269,7 @@ func ipsecStatusChart(group string) []metricslatest.Chart {
 			PromQL: `sum(rate($METRIC[2m]))by(IPSecStatus)`,
 			Legend: "{{ IPSecStatus }}",
 		}},
-	}, group, "")
+	}, group, "")...)
 	return charts
 
 }
diff --git a/pkg/metrics/predefined_metrics.go b/pkg/metrics/predefined_metrics.go
@@ -45,6 +45,8 @@ var (
 		"namespace_rtt_seconds",
 		"namespace_dns_latency_seconds",
 		"namespace_network_policy_events_total",
+		"node_ipsec_flows_total",
+		"cross_nodes_ingress_flows_total",
 	}
 	// More metrics enabled when Loki is disabled, to avoid loss of information
 	DefaultIncludeListLokiDisabled = []string{
@@ -61,6 +63,8 @@ var (
 		"workload_rtt_seconds",
 		"workload_dns_latency_seconds",
 		"namespace_network_policy_events_total",
+		"node_ipsec_flows_total",
+		"cross_nodes_ingress_flows_total",
 	}
 	// Pre-deprecation default IgnoreTags list (1.4) - used before switching to whitelist approach,
 	// to make sure there is no unintended new metrics being collected
@@ -214,6 +218,21 @@ func init() {
 			tags: []string{group, "ipsec"},
 		})
 	}
+	// Cross-nodes metric
+	predefinedMetrics = append(predefinedMetrics, taggedMetricDefinition{
+		FlowMetricSpec: metricslatest.FlowMetricSpec{
+			MetricName: "cross_nodes_ingress_flows_total",
+			Type:       metricslatest.CounterMetric,
+			Labels:     mapLabels[tagNodes],
+			Direction:  metricslatest.Ingress,
+			Filters: []metricslatest.MetricFilter{
+				// Strict ingress + SrcK8S_HostName present means cross-nodes
+				{Field: "FlowDirection", Value: "0"},
+				{Field: "SrcK8S_HostName", MatchType: metricslatest.MatchPresence},
+			},
+		},
+		tags: []string{tagNodes, "ipsec"},
+	})
 }
 
 func isIgnored(def *taggedMetricDefinition, ignoreTags []string) bool {
diff --git a/pkg/metrics/predefined_metrics_test.go b/pkg/metrics/predefined_metrics_test.go
@@ -36,6 +36,7 @@ func TestIncludeExclude(t *testing.T) {
 		"workload_dns_latency_seconds",
 		"workload_network_policy_events_total",
 		"workload_ipsec_flows_total",
+		"cross_nodes_ingress_flows_total",
 	}, *res)
 
 	// IgnoreTags set, Include list set => keep include list

Original file line number	Diff line number	Diff line change
`@@ -570,7 +570,7 @@ const (`
`570`	`570`	`)`
`571`	`571`
`572`	`572`	`// Metric name. More information in https://github.com/netobserv/network-observability-operator/blob/main/docs/Metrics.md.`
`573`		-// +kubebuilder:validation:Enum:="namespace_egress_bytes_total";"namespace_egress_packets_total";"namespace_ingress_bytes_total";"namespace_ingress_packets_total";"namespace_flows_total";"node_egress_bytes_total";"node_egress_packets_total";"node_ingress_bytes_total";"node_ingress_packets_total";"node_flows_total";"workload_egress_bytes_total";"workload_egress_packets_total";"workload_ingress_bytes_total";"workload_ingress_packets_total";"workload_flows_total";"namespace_drop_bytes_total";"namespace_drop_packets_total";"node_drop_bytes_total";"node_drop_packets_total";"workload_drop_bytes_total";"workload_drop_packets_total";"namespace_rtt_seconds";"node_rtt_seconds";"workload_rtt_seconds";"namespace_dns_latency_seconds";"node_dns_latency_seconds";"workload_dns_latency_seconds";"node_network_policy_events_total";"namespace_network_policy_events_total";"workload_network_policy_events_total";"node_ipsec_flows_total"
	`573`	+// +kubebuilder:validation:Enum:="namespace_egress_bytes_total";"namespace_egress_packets_total";"namespace_ingress_bytes_total";"namespace_ingress_packets_total";"namespace_flows_total";"node_egress_bytes_total";"node_egress_packets_total";"node_ingress_bytes_total";"node_ingress_packets_total";"node_flows_total";"workload_egress_bytes_total";"workload_egress_packets_total";"workload_ingress_bytes_total";"workload_ingress_packets_total";"workload_flows_total";"namespace_drop_bytes_total";"namespace_drop_packets_total";"node_drop_bytes_total";"node_drop_packets_total";"workload_drop_bytes_total";"workload_drop_packets_total";"namespace_rtt_seconds";"node_rtt_seconds";"workload_rtt_seconds";"namespace_dns_latency_seconds";"node_dns_latency_seconds";"workload_dns_latency_seconds";"node_network_policy_events_total";"namespace_network_policy_events_total";"workload_network_policy_events_total";"node_ipsec_flows_total";"cross_nodes_ingress_flows_total"
`574`	`574`	`type FLPMetric string`
`575`	`575`
`576`	`576`	// `FLPMetrics` define the desired FLP configuration regarding metrics
Original file line number	Diff line number	Diff line change
`@@ -126,7 +126,7 @@ func ControllerFlowMetricsSpecs() {`
`126`	`126`	`return err`
`127`	`127`	`}`
`128`	`128`	`return metrics`
`129`		`- }, timeout, interval).Should(HaveLen(5)) // only default metrics`
	`129`	`+ }, timeout, interval).Should(HaveLen(6)) // only default metrics`
`130`	`130`	`})`
`131`	`131`	`})`
`132`	`132`