Skip to content

feat(monitor): add api observability support for http/https/gRPC network traffic#2495

Draft
charankamal20 wants to merge 2 commits intokubearmor:mainfrom
charankamal20:feat/api-observability
Draft

feat(monitor): add api observability support for http/https/gRPC network traffic#2495
charankamal20 wants to merge 2 commits intokubearmor:mainfrom
charankamal20:feat/api-observability

Conversation

@charankamal20
Copy link

@charankamal20 charankamal20 commented Mar 10, 2026

Purpose of PR?:
This PR adds support for network traffic observability with eBPF.

Changes Made:

  1. Added a module in BPF - KubeArmor/BPF/apiobserver/, for protocol parsing and data event capture.
  2. Added a new stream in feeder to export API Events. Protos imported from Sentryflow repository.
  3. Added new module in Kubearmor src to handle api events, KubeArmor/apiObserver/
  4. Added dedicated doc for userspace and eBPF code.
  5. Added new flag in config to enable api observability (enableAPIObserver)

Below protocols are supported for network observabliity:

  • HTTP/1.x
  • HTTP2 (Requires more work and testing)
  • gRPC (Requires more work and testing)
  • HTTPS
  • HTTPS with language support(golang, node, python)

Additional information for reviewer? :
Please find documentation for approach in:

Currently tested with:

  1. Sock Shop demo with Locust load generator - HTTP traffic
  2. Online Boutique (Google microservices) demo - HTTP1/HTTP2/gRPC traffic
  3. Manual testing for edge cases, Test Doc

Some sample event structures:

  1. HTTP1
  "metadata": {
    "timestamp": 1773095627488964400,
    "node_name": "ck",
    "receiver_name": "KubeArmor"
  },
  "source": {
    "name": "10.42.0.31",
    "ip": "10.42.0.31",
    "port": 43188
  },
  "destination": {
    "name": "10.43.38.164",
    "ip": "10.43.38.164",
    "port": 80
  },
  "request": {
    "headers": {
      "connection": "close",
      "host": "catalogue"
    },
    "method": "GET",
    "path": "/catalogue/3395a43e-2d88-40de-b95f-e00e1502085b"
  },
  "response": {
    "headers": {
      "connection": "close",
      "content-length": "286",
      "content-type": "application/json; charset=utf-8",
      "date": "Mon, 09 Mar 2026 22:33:47 GMT"
    },
    "body": "{\"id\":\"3395a43e-2d88-40de-b95f-e00e1502085b\",\"name\":\"Colourful\",\"description\":\"proident occaecat irure et excepteur labore minim nisi amet irure\",\"imageUrl\":[\"/catalogue/images/colourful_socks.jpg\",\"/catalogue/images/colourful_socks.jpg\"],\"price\":18,\"count\":438,\"tag\":[\"brown\",\"blue\"]}\n",
    "status_code": 200
  },
  "protocol": "HTTP1.x",
  "latency_ns": 19000000
}
  1. HTTP2/gRPC (WIP)
{
  "metadata": {
    "timestamp": 1773129176490448100,
    "node_name": "ck",
    "receiver_name": "KubeArmor"
  },
  "source": {
    "name": "10.42.0.14",
    "ip": "10.42.0.14",
    "port": 41988
  },
  "destination": {
    "name": "10.43.136.173",
    "ip": "10.43.136.173",
    "port": 7000
  },
  "request": {
    "headers": {
      "content-type": "application/grpc+proto",
      "date": "Tue, 10 Mar 2026 07:52:55 GMT",
      "grpc-accept-encoding": "identity,deflate,gzip",
      "grpc-encoding": "identity",
      "grpc-message": "OK",
      "grpc-status": "0"
    },
    "body": "\u0000\u0000\u0000\u0000\u0000",
    "method": "POST"
  },
  "response": {
    "headers": {
      "grpc-message": "OK",
      "grpc-status": "0"
    },
    "body": "\u0000\u0000\u0000\u0000\n\u0003EUR\n\u0003USD\n\u0003JPY\n\u0003BGN\n\u0003CZK\n\u0003DKK\n\u0003GBP\n\u0003HUF\n\u0003PLN\n\u0003RON\n\u0003SEK\n\u0003CHF\n\u0003ISK\n\u0003NOK\n\u0003HRK\n\u0003RUB\n\u0003TRY\n\u0003AUD\n\u0003BRL\n\u0003CAD\n\u0003CNY\n\u0003HKD\n\u0003IDR\n\u0003ILS\n\u0003INR\n\u0003KRW\n\u0003MXN\n\u0003MYR\n\u0003NZD\n\u0003PHP\n\u0003SGD\n\u0003THB\n\u0003ZAR"
  },
  "protocol": "HTTP2",
  "latency_ns": 1000000
}

Checklist:

  • Bug fix. Fixes #
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • This change requires a documentation update
  • PR Title follows the convention of <type>(<scope>): <subject>
  • Commit has unit tests
  • Commit has integration tests

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant