LoginSign Up
← Back to all sparks
N

NetObserv

ANALYTICS
Velocity2.5

Network observability operator for OpenShift and Kubernetes

github.com/netobserv ↗

NetObserv is layering TLS visibility and health alerting on top of its eBPF flow pipeline.

network-observabilityebpfkubernetestls-visibilityprometheussupply-chain-security
◆Current state
NetObserv ships roughly monthly as a coordinated bundle — operator, eBPF agent, flowlogs-pipeline and console plugin move together in each release. The functional work over these six releases splits three ways: a TLS visibility feature that arrived as a knob in 1.11.3 and has been extended with metrics and alerts since, a Network Health layer built on Prometheus recording rules rather than alerts alone, and steady hardening of the agent-to-pipeline path (mTLS, hot-reload filters, packet translation and sampling fixes). Prometheus is now on by default.
◆Where it's heading
The project is moving from flow collection toward opinionated health signalling — recording rules, runbook links in alerts, ingress 5xx and latency templates, health metadata driving console plugin config. That is the shape of a tool trying to answer 'is the network healthy' rather than only 'what traffic occurred'. In parallel, supply-chain and workflow security is getting real attention: SBOM generation and artifact signing, SHA-pinned GitHub Actions, pwn-request workflow checks and a pprof exposure fix all landed in the last two releases. The operator was also renamed from network-observability-operator to netobserv-operator.
◆Prediction
Expect the TLS thread to keep extending — the sequence so far is fields, then metrics, then alerts, so dashboards and health rules built on TLS data are the natural next step. Continued investment in the Network Health rule set is the other safe bet, since it is where the last three releases have concentrated their non-dependency commits.

◆Recent moves

  1. 19d ago

    1.12.0 adds TLS alerting, flp-informers and signed releases

    Extends the TLS thread with alerting, wires up flp-informers deployment, and adds SBOM generation and signing to the release workflow. The security-of-the-build work here — SHA-pinned actions, pwn-request checks, a pprof exposure fix — is as substantial as the feature content.

    View source ↗
  2. 1mo ago

    1.11.5 adds TLS metrics, Kafka compression and drop events

    Integrates drops and network events, adds a Kafka compression option (then disables it by default), fixes dns.name mapping in the OTLP export, and adds TLS metrics. The agent-to-pipeline mTLS path is fixed downstream, continuing the hardening that started in 1.11.2.

    View source ↗
  3. 4mo ago

    TLS tracking arrives as a feature knob with new TLS fields

    ⚡ SPARK

    The release that opens a new observable dimension: a TLSTracking knob and TLS fields on flows, alongside automatic enrichment with secondary interfaces and Prometheus defaulting to enabled. Everything TLS-related in the two releases that follow — metrics, then alerts — builds on what landed here.

    View source ↗
  4. 5mo ago

    1.11.2 adds a pause control and TLS/mTLS hardening

    Adds a way to pause Network Observability functions without tearing the deployment down, hardens TLS and mTLS between components, and adds predefined network metrics including IPsec. Also renames the operator to netobserv-operator, which is the kind of change that breaks scripted installs.

    View source ↗
  5. 5mo ago

    1.11.1 is documentation, Snyk config and dependency updates

    Almost entirely housekeeping: Snyk configuration, documentation vendor-neutrality passes, a GOMEMLIMIT setting on flowlogs-pipeline, and a long Konflux dependency run. The one functional fix is NetworkEvents against upstream ovn-kubernetes.

    View source ↗
  6. 6mo ago

    1.11.0 builds out Network Health rules and hot-reload filters

    The release that establishes the health direction: recording rules as an alternative to alerts, ingress 5xx and latency trend templates, runbook links in alerts, and health integration in the topology view. Hot-reloadable filters land here too, removing a restart from the tuning loop.

    View source ↗