NETOBSERV-2010: manage cardinality for netevents nested labels

controllers/consoleplugin/config/static-frontend-config.yaml

@@ -1265,20 +1265,23 @@ fields:
       - 2: Inner (with the same source and destination node)
   - name: IfDirections
     type: number
+    docType: number[]
     description: |
       Flow directions from the network interface observation point. Can be one of: +
       - 0: Ingress (interface incoming traffic) +
       - 1: Egress (interface outgoing traffic)
   - name: Interfaces
     type: string
+    docType: string[]
     description: Network interfaces
   - name: Flags
     type: string
+    docType: string[]
     description: |
-      Logical OR combination of unique TCP flags comprised in the flow, as per RFC-9293, with additional custom flags to represent the following per-packet combinations: +
-      - SYN+ACK (0x100) +
-      - FIN+ACK (0x200) +
-      - RST+ACK (0x400)
+      List of TCP flags comprised in the flow, as per RFC-9293, with additional custom flags to represent the following per-packet combinations: +
+      - SYN_ACK +
+      - FIN_ACK +
+      - RST_ACK
   - name: Bytes
     type: number
     description: Number of bytes
@@ -1322,7 +1325,15 @@ fields:
     description: TCP Smoothed Round Trip Time (SRTT), in nanoseconds
   - name: NetworkEvents
     type: string
-    description: Network events flow monitoring
+    docType: object[]
+    description: |
+      Network events, such as network policy actions, composed of nested fields: +
+      - Feature (such as "acl" for network policies) +
+      - Type (such as an "AdminNetworkPolicy") +
+      - Namespace (namespace where the event applies, if any) +
+      - Name (name of the resource that triggered the event) +
+      - Action (such as "allow" or "drop") +
+      - Direction (Ingress or Egress)
   - name: ZoneId
     type: number
     description: packet translation zone id

hack/asciidoc-flows-gen.sh

@@ -19,11 +19,15 @@ nbfields=$(yq '.fields | length' $FE_SOURCE)
 lokiLabels=$(cat $LOKI_LABEL_SOURCE)
 cardinalityMap=$(cat $CARDINALITY_SOURCE)
 otelMap=$(cat $OTEL_SOURCE)
+errors=""
 
 for i in $(seq 0 $(( $nbfields-1 )) ); do
   frontEntry=$(yq ".fields | sort_by(.name) | .[$i]" $FE_SOURCE)
   name=$(printf "$frontEntry" | yq ".name")
-  type=$(printf "$frontEntry" | yq ".type")
+  type=$(printf "$frontEntry" | yq ".docType")
+  if [[ "$type" == "null" ]]; then
+    type=$(printf "$frontEntry" | yq ".type")
+  fi
   desc=$(printf "$frontEntry" | yq ".description")
   filter=$(printf "$frontEntry" | yq ".filter")
   if [[ "$filter" == "null" ]]; then
@@ -44,8 +48,7 @@ for i in $(seq 0 $(( $nbfields-1 )) ); do
   fi
   cardWarn=$(printf "$cardinalityMap" | jq -r ".$name")
   if [[ "$cardWarn" == "null" ]]; then
-      echo "missing cardinality for field $name"
-      exit 1
+      errors="$errors\nmissing cardinality for field $name"
   fi
   otel=$(printf "$otelMap" | jq -r ".$name")
   if [[ "$otel" == "null" ]]; then
@@ -60,4 +63,9 @@ for i in $(seq 0 $(( $nbfields-1 )) ); do
   echo -e "| $otel" >> $ADOC
 done
 
+if [[ $errors != "" ]]; then
+  echo -e $errors
+  exit 1
+fi
+
 echo -e '|===' >> $ADOC

pkg/helper/cardinality/cardinality.json

@@ -50,7 +50,20 @@
   "DnsErrno": "fine",
   "TimeFlowRttNs": "avoid",
   "NetworkEvents": "avoid",
+  "NetworkEvents>Feature": "fine",
+  "NetworkEvents>Type": "fine",
+  "NetworkEvents>Namespace": "fine",
+  "NetworkEvents>Name": "fine",
+  "NetworkEvents>Action": "fine",
+  "NetworkEvents>Direction": "fine",
   "K8S_ClusterName": "fine",
+  "Sampling": "fine",
+  "ZoneId": "avoid",
+  "XlatSrcPort": "careful",
+  "XlatSrcAddr": "avoid",
+  "XlatIcmpId": "avoid",
+  "XlatDstPort": "careful",
+  "XlatDstAddr": "avoid",
   "_RecordType": "fine",
   "_HashId": "avoid"
-}
+}