feature: add alternate method to parse namespace traffic - #53
feature: add alternate method to parse namespace traffic#53manueleiria wants to merge 11 commits into
Conversation
destination-specific traffic
davidgiga1993
left a comment
davidgiga1993
left a comment
There was a problem hiding this comment.
Thanks for your contribution!
Has this been written using AI? Because the code has a lot of unusual patterns in it.
Also there are a lot of issues with separations of concerns. Getting the actual metrics and interface data should be in separate classes, and not in the Source itself.
| if self._debug_namespace_detection: | ||
| self.log.info(f"✅ Address {addr_str} matched namespace {namespace}") | ||
| return namespace | ||
| except: |
There was a problem hiding this comment.
What is this for? Either remove or comment when this happens
| # If no namespace match found, check if we have any namespace data at all | ||
| if not self._namespace_ips: | ||
| if self._debug_namespace_detection: | ||
| self.log.warning(f"❌ No namespace IPs available for address {addr_str} - runtime detection may have failed") |
There was a problem hiding this comment.
Please no emojis to follow the other log patterns
| connections.append(conn) | ||
|
|
||
| except Exception as e: | ||
| self.log.debug(f"Error reading TCP from PID {pid}: {e}") |
There was a problem hiding this comment.
Isn't this an actual error?
| # Common service port patterns and their typical traffic volumes | ||
| # These are rough estimates based on typical service behavior | ||
|
|
||
| # Web traffic (HTTP/HTTPS) |
There was a problem hiding this comment.
This code makes a LOT of assumptions about the type of traffic flowing.
For example a web download would or large db traffic would completely break the estimation. I'm not sure if this makes sense in a general library
2 participants
Pollect currently depends on BCC in order to use K8SNamespaceTrafficSource, but there seems to be an issue with it and the current version of AL2023 for Kubernetes 1.33. I was able to try a different solution that doesn't use kprobes that provides basic network traffic monitoring without the detailed per-process tracking that BPF provides.