NETOBSERV-2045: Create packets xlation blog for netobserv #3

msherif1234 · 2025-01-03T17:05:45Z

Adding Packets translation blog

skrthomas

Thanks for the blog. Looks really good and easy to use/read. Left you a few style/consistency comments per my usual copy editing. :)

skrthomas · 2025-01-03T19:29:35Z

content/posts/2025-01-03-packets-xlation-enrichment.md

+
+## How eBPF Can Help
+
+eBPF allows you to execute custom programs in the Linux kernel, making it an ideal tool for network observability.


Suggested change

eBPF allows you to execute custom programs in the Linux kernel, making it an ideal tool for network observability.

You can execute custom programs using/with eBPF in the Linux kernel, making it an ideal tool for network observability. Notable benefits of using eBPF include the following:

- Granular Observability: Directly see which pod served a request.

- Low Overhead: Operates in the kernel with minimal impact on performance.

- Dynamic Updates: Respond to changes in Kubernetes without requiring application restarts.

- Simplified Architecture: No need for sidecars or intrusive network plugins.

Suggest rephrasing like this to keep this centered on what the user can do and less technology-centric.

Also suggest incorporating that list from the end of this section to here because I think its more valuable up front with the intro than as a summary item, but I leave that up to you.

skrthomas · 2025-01-03T19:33:00Z

content/posts/2025-01-03-packets-xlation-enrichment.md

+Attach eBPF Programs:
+Use eBPF programs to hook into kernel networking events, such as kprobe on functions like `nf_nat_manip_pkt`.
+
+Enrich Flow Logs:


Should these be numbered 🤔 it seems to me like they're sequential steps in the process. Also, I think all these words don't need to be capitalized.

Suggested change

Attach eBPF Programs:

Use eBPF programs to hook into kernel networking events, such as kprobe on functions like `nf_nat_manip_pkt`.

Enrich Flow Logs:

1. Attach the eBPF programs:

Use the eBPF programs to hook into kernel networking events, such as kprobe on functions like `nf_nat_manip_pkt`.

2. Enrich flow logs:

skrthomas · 2025-01-03T19:35:38Z

content/posts/2025-01-03-packets-xlation-enrichment.md

+Use eBPF programs to hook into kernel networking events, such as kprobe on functions like `nf_nat_manip_pkt`.
+
+Enrich Flow Logs:
+As network packets are processed, augment flow logs with metadata about the translated endpoint. This can include:


Question, does the augmentation happen as the network packets are processed? Or is it something the user manually has to refresh. The wording here makes it seem like the user needs to augment the flow logs with metadata, and if that's the case, maybe a "you can" before the augment would be a good clarification.

that is what ebpf code will do user doesn't need to do anything

skrthomas · 2025-01-03T19:38:20Z

content/posts/2025-01-03-packets-xlation-enrichment.md

+Benefits of Using eBPF
+
+Granular Observability: Directly see which pod served a request.
+
+Low Overhead: Operates in the kernel with minimal impact on performance.
+
+Dynamic Updates: Respond to changes in Kubernetes without requiring application restarts.
+
+Simplified Architecture: No need for sidecars or intrusive network plugins.


Hmmmm....I wonder about relocating this to the introduction of the How ePBF Helps section. I'll make another comment with this suggestion and see what you think.

skrthomas · 2025-01-03T19:45:32Z

content/posts/2025-01-03-packets-xlation-enrichment.md

+
+## How to enable Packet Translation enrichment feature
+
+ To enable packet translation enrichment feature, need to create a flow collector with the following feature enabled


Suggested change

To enable packet translation enrichment feature, need to create a flow collector with the following feature enabled

To enable packet translation enrichment feature, create a `FlowCollector` resource with the following feature enabled

You can have "create" as an imperative without saying "need to". Additionally, FlowCollector should be in backticks since its the API

skrthomas · 2025-01-03T19:50:18Z

content/posts/2025-01-03-packets-xlation-enrichment.md

+
+## Example
+
+ To demonstrate this feature, let's configure a `CluesterIP` kubernetes service using the following example yaml


Suggested change

To demonstrate this feature, let's configure a `CluesterIP` kubernetes service using the following example yaml

Let's configure a `CluesterIP` Kubernetes service to try this feature!

1. Configure a `CluesterIP` Kubernetes service using the following example yaml:

I think there was an extra whitespace here and also Kubernetes needs a capital K

Additionally, add a colon to introduce the yaml sample, and I'm wondering what you think about numbering here? I think it helps, especially further down the example, to emphasize the steps.

skrthomas · 2025-01-03T19:51:25Z

content/posts/2025-01-03-packets-xlation-enrichment.md

+  type: ClusterIP
+```
+
+check the created service to find the `CluterIP` and `Port`


Suggested change

check the created service to find the `CluterIP` and `Port`

2. Check the created service to find the `CluterIP` and `Port`:

Furthering my numbering suggestion from the previous comment and also adding a colon to introduce the code.

skrthomas · 2025-01-03T19:58:30Z

content/posts/2025-01-03-packets-xlation-enrichment.md

+
+```
+
+Then we can send traffic to this service IP and check the enriched flows on the netobserv console


Suggested change

Then we can send traffic to this service IP and check the enriched flows on the netobserv console

3. Next, you can send traffic to this service IP and check the enriched flows on the network observability console:

suggest you vs we to make it more customer-centric.

I think since we refer to the console here, best to call it network observability since that whole name will be spelled out in the console.

add a colon to introduce the code.

skrthomas · 2025-01-03T20:04:43Z

content/posts/2025-01-03-packets-xlation-enrichment.md

+$ while true; do oc exec -i -n xlat-test client -- curl 172.30.165.151:80 ; sleep 1; done
+```
+
+from Netobserv console let's filter on Traffic destination `Kind` is `Service` in `xlat-test` namespace


Suggested change

from Netobserv console let's filter on Traffic destination `Kind` is `Service` in `xlat-test` namespace

4. From the network observability console **Network Traffic** page, click the *Taffic flows* tab and filter on Traffic destination `Kind` is `Service` in the `xlat-test` namespace:

I suggest clarifying the exact area of the console where they'll need to be working.

skrthomas · 2025-01-03T20:05:38Z

content/posts/2025-01-03-packets-xlation-enrichment.md

+
+<img src="{page.image('packets-xlation-enrichment/pkt-xlat-ip-port.png')}" alt="Service Traffic's Packet Translation enrichment using POD's IP and Port">
+
+The following shows possible packet translation columns options, currently `zoneid` is the only visible column by default


Suggested change

The following shows possible packet translation columns options, currently `zoneid` is the only visible column by default

The following shows possible packet translation columns options. Currently `zoneid` is the only visible column by default:

Amoghrd · 2025-01-03T20:33:11Z

content/posts/2025-01-03-packets-xlation-enrichment.md

+
+## Example
+
+ To demonstrate this feature, let's configure a `CluesterIP` kubernetes service using the following example yaml


extra e in ClusterIP

Amoghrd · 2025-01-03T20:33:52Z

content/posts/2025-01-03-packets-xlation-enrichment.md

+  type: ClusterIP
+```
+
+check the created service to find the `CluterIP` and `Port`


missing s in CluterIP

Amoghrd · 2025-01-03T20:38:50Z

content/posts/2025-01-03-packets-xlation-enrichment.md

+Events:            <none>
+
+$oc get pods -n xlat-test
+oc get pods -n xlat-test


Duplicate line not needed I think

Amoghrd · 2025-01-03T20:51:52Z

LGTM

Signed-off-by: Mohamed Mahmoud <[email protected]>

memodi · 2025-01-08T21:31:29Z

content/posts/2025-01-03-packets-xlation-enrichment.md

+
+- Destination Port
+
+- Conntrack Zone ID


what is zone id?

msherif1234 force-pushed the pkt_xlat_blog branch from 53c165f to 0e1c70d Compare January 3, 2025 20:01

skrthomas reviewed Jan 3, 2025

View reviewed changes

Amoghrd reviewed Jan 3, 2025

View reviewed changes

msherif1234 force-pushed the pkt_xlat_blog branch from 0e1c70d to 0b491ef Compare January 3, 2025 20:36

msherif1234 requested review from skrthomas and Amoghrd January 3, 2025 20:36

Amoghrd reviewed Jan 3, 2025

View reviewed changes

msherif1234 force-pushed the pkt_xlat_blog branch from 0b491ef to c18446a Compare January 3, 2025 20:42

Create packets xlation blog for netobserv

87f38ab

Signed-off-by: Mohamed Mahmoud <[email protected]>

msherif1234 force-pushed the pkt_xlat_blog branch from c18446a to 87f38ab Compare January 6, 2025 14:05

msherif1234 changed the title ~~Create packets xlation blog for netobserv~~ NETOBSERV-2040: Create packets xlation blog for netobserv Jan 8, 2025

msherif1234 changed the title ~~NETOBSERV-2040: Create packets xlation blog for netobserv~~ NETOBSERV-2045: Create packets xlation blog for netobserv Jan 8, 2025

memodi reviewed Jan 8, 2025

View reviewed changes

content/posts/2025-01-03-packets-xlation-enrichment.md

- Destination Port

- Conntrack Zone ID

Copy link

memodi Jan 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

what is zone id?

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

NETOBSERV-2045: Create packets xlation blog for netobserv #3

NETOBSERV-2045: Create packets xlation blog for netobserv #3

msherif1234 commented Jan 3, 2025

skrthomas left a comment

skrthomas Jan 3, 2025

skrthomas Jan 3, 2025

skrthomas Jan 3, 2025

skrthomas Jan 3, 2025

msherif1234 Jan 3, 2025

skrthomas Jan 3, 2025

skrthomas Jan 3, 2025

skrthomas Jan 3, 2025

skrthomas Jan 3, 2025

skrthomas Jan 3, 2025

skrthomas Jan 3, 2025

skrthomas Jan 3, 2025

skrthomas Jan 3, 2025

skrthomas Jan 3, 2025

skrthomas Jan 3, 2025

skrthomas Jan 3, 2025

skrthomas Jan 3, 2025

skrthomas Jan 3, 2025

Amoghrd Jan 3, 2025

Amoghrd Jan 3, 2025

Amoghrd Jan 3, 2025

Amoghrd commented Jan 3, 2025

memodi Jan 8, 2025


		## How eBPF Can Help

		eBPF allows you to execute custom programs in the Linux kernel, making it an ideal tool for network observability.


		## How to enable Packet Translation enrichment feature

		To enable packet translation enrichment feature, need to create a flow collector with the following feature enabled


		## Example

		To demonstrate this feature, let's configure a `CluesterIP` kubernetes service using the following example yaml

- To demonstrate this feature, let's configure a `CluesterIP` kubernetes service using the following example yaml
+Let's configure a `CluesterIP` Kubernetes service to try this feature!
+. Configure a `CluesterIP` Kubernetes service using the following example yaml:

	check the created service to find the `CluterIP` and `Port`
	2. Check the created service to find the `CluterIP` and `Port`:


		```

		Then we can send traffic to this service IP and check the enriched flows on the netobserv console

	Then we can send traffic to this service IP and check the enriched flows on the netobserv console
	3. Next, you can send traffic to this service IP and check the enriched flows on the network observability console:

	from Netobserv console let's filter on Traffic destination `Kind` is `Service` in `xlat-test` namespace
	4. From the network observability console Network Traffic page, click the Taffic flows tab and filter on Traffic destination `Kind` is `Service` in the `xlat-test` namespace:


		<img src="{page.image('packets-xlation-enrichment/pkt-xlat-ip-port.png')}" alt="Service Traffic's Packet Translation enrichment using POD's IP and Port">

		The following shows possible packet translation columns options, currently `zoneid` is the only visible column by default

NETOBSERV-2045: Create packets xlation blog for netobserv #3

Are you sure you want to change the base?

NETOBSERV-2045: Create packets xlation blog for netobserv #3

Conversation

msherif1234 commented Jan 3, 2025

skrthomas left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Amoghrd commented Jan 3, 2025

Choose a reason for hiding this comment