LoginSign Up
← Back to all sparks
N

NetObserv

ANALYTICS
Velocity2.5

Network observability operator for OpenShift and Kubernetes

github.com/netobserv ↗

NetObserv hit 2.0 without breaking changes, then started renaming its metrics.

network-observabilityebpfkubernetesbgptls-visibilityoperator-security
◆Current state
NetObserv's operator reached 2.0.0 in September, labelled entirely non-breaking: BGP ASN enrichment through FRRConfiguration CRDs, DNS names in metrics, DNS port configuration in the FlowCollector API, stricter RBAC and network policies for the operator itself, and TLS settings taken from the OpenShift API server. 2.0.1 was fixes and dependency bumps. 2.0.2 fixes ASN labels and IPSec metrics, captures OpenSSL socket tuples at event time in the eBPF agent, and renames filtered_flows_total to filtered_packets_total.
◆Where it's heading
The 2.0 line adds routing context (BGP ASNs) and DNS identity to flows, which moves the tool from 'which pod talked to which' toward 'which network and service.' The operator's own security posture, with RBAC, network policies and TLS profiles, is getting as much attention as the data. The TLS thread continues inside the eBPF agent, with OpenSSL tracking narrowed to packet mode in 2.0.2.
◆Prediction
Expect 2.0.x fixes around the new ASN and TLS enrichment, which both needed corrections in 2.0.2. The metric rename is a signal that dashboards built on older names may need updating in later releases too.

◆Recent moves

  1. 11d ago

    2.0.2 fixes ASN enrichment and renames a flow metric

    Fixes BGP ASN labels and enrichment RBAC, captures OpenSSL socket tuples at event time, and renames filtered_flows_total to filtered_packets_total. Follow-up work on the enrichment that 2.0 introduced, with one rename users' dashboards will notice.

    View source ↗
  2. 1mo ago

    2.0.1 adjusts DNS port defaults and bumps dependencies

    Demo Loki limits, contextual DNS tracking ports, a column default revert and dependency bumps. Maintenance after 2.0.0.

    View source ↗
  3. 1mo ago

    2.0.0 adds BGP ASN enrichment and stricter operator RBAC

    The 2.0 major adds BGP ASN enrichment, DNS names in metrics, configurable DNS ports, stricter operator RBAC and network policies, and TLS settings from the OpenShift API server. A large release, but it is labelled non-breaking and extends existing threads rather than changing direction.

    View source ↗
  4. 3mo ago

    1.12.0 adds TLS alerting, flp-informers and signed releases

    Extends the TLS thread with alerting, wires up flp-informers deployment, and adds SBOM generation and signing to the release workflow. The security-of-the-build work here — SHA-pinned actions, pwn-request checks, a pprof exposure fix — is as substantial as the feature content.

    View source ↗
  5. 4mo ago

    1.11.5 adds TLS metrics, Kafka compression and drop events

    Integrates drops and network events, adds a Kafka compression option (then disables it by default), fixes dns.name mapping in the OTLP export, and adds TLS metrics. The agent-to-pipeline mTLS path is fixed downstream, continuing the hardening that started in 1.11.2.

    View source ↗
  6. 7mo ago

    TLS tracking arrives as a feature knob with new TLS fields

    ⚡ SPARK

    The release that opens a new observable dimension: a TLSTracking knob and TLS fields on flows, alongside automatic enrichment with secondary interfaces and Prometheus defaulting to enabled. Everything TLS-related in the two releases that follow — metrics, then alerts — builds on what landed here.

    View source ↗