Repository navigation
Feature: Add network policy names in hubble #1100
Description
Cilium Feature Proposal
Is your feature request related to a problem?
No, but it would simplify troubleshooting network connections within Kubernetes.
Describe the feature you'd like
When I started using Cilium, I have noticed that the name of the CiliumNetworkPolicy as well as the name of the CiliumClusterwideNetworkPolicy will not be shown in the cilium hubble ui as well as in hubble observe. For me, the observability would be increased when I could comprehend why the traffic was accepted or denied.
(Optional) Describe your proposed solution
Add the network policy name to the hubble ui and hubble observe as value.
Activity
gandro commentedon Jul 6, 2023
Thanks for the request. This requires cilium/cilium#26438 to be implemented on the server-side first
Tim-herbie commentedon Jul 11, 2023
@gandro Thanks for your answer, is there a timeline when this will happen?
kgtw commentedon Nov 26, 2023
@gandro I'd be willing to open a PR for this if nobody else is actively working on it.
feat/policy-names: Add network policy names in hubble UI when they ar…
gandro commentedon Nov 27, 2023
Hi, so in the mean time, we've merged cilium/cilium#27854 - which implements this server-side. You should see the policy name for policy verdict events if you do JSON output, i.e. something like
hubble observe -o json -t policy-verdictagainst Cilium v1.15-pre.I'm not sure if/how we could add the policy name to the textual output without making the output too noisy. Suggestions welcome.
kgtw commentedon Dec 10, 2023
I can confirm that the above command does provide the matching policy names for flows. As for the textual output, I agree that adding the policies would be too noisy.
Perhaps initially we could provide "hints" as to the total number of matching policies, leaving the actual textual representation of the policies to be retrieved via the aforementioned json output.
Example output, introducing
matching:%dWould such output be useful for network operators and those investigating flows at a glance? Perhaps @Tim-herbie you might have some opinion if the json output satisfies your original feature request, then we could simply mark this issue as closed/resolved.
gandro commentedon Dec 11, 2023
Thanks for confirming! Yeah I think adding at least the policy count could be a nice addition
Tim-herbie commentedon Dec 11, 2023
Thank you so far.
@kgtw Informations about how often the policy was used is a nice information.
I understand that the log output is too noisy when the policy name will be displayed. Is it maybe possible to output this by adding a parameter?
And is it now possible to see the policy name also in the UI?
feat/policy-names: Add network policy names in hubble UI when they ar…
feat/policy-names: Add network policy names in hubble UI when they ar…