feat: add FlowTracer plugin · Pull Request !778 · openEuler/gala-gopher

## What is FlowTracer?

Consider a network scenario where a client communicates to a server through NAT. The most common
case is Kubernetes with the default Kubeproxy where a pod talks to a virtual service IP and doesn't 
know a real destination. Depending on underlying network technology the destination pod has the 
symmetric issue - it sees only the translated address and not the address of the original source.

FlowTracer is an active probe that monitors TCP connections and transfers packet source address
in-band within the connection. At a receiver end the probe extracts injected address and maintains
association from the observed address tuple to the received one.

## How to run FlowTracer

FlowTracer is implemented as a Gala-Gopher plugin, it can be started/stopped using REST API. 
Data retrieval is integrated into TCP probe and if enabled it replaces an observed address with
an original one.

### Prerequisites

FlowTracer BPF program is attached to cgroup2 mounted into a host file system. It is possible
to mount all cgroups or be more specific, for example to enable FlowTracer for individual processes
or containers.

To mount cgroup2 in OpenEuler:
 1. Create a mount point: `sudo mkdir /mnt/cgroup2`.
 2. Mount cgroup2 to the mount point: `mount -t cgroup2 none /mnt/cgroup2/`.

### To enable FlowTracer

FlowTracer can be controlled via Gala-Gopher's REST API (in the example below the API runs at the local host):
 1. Enable FlowTracer: `curl -X PUT -d json='{"state":"running"}' http://localhost:9999/flowtracer`.
 2. Enable FlowTracer data mapping in tcp probe: `curl -X PUT -d json='{"cmd":{"probe":["tcp_stats"]},"snoopers":{"proc_name":[{"comm":"^python.*","cmdline":""}]},"params":{"report_event":0,"report_period":10,"cluster_ip_backend":2},"state":"running"}' http://localhost:9999/tcp`. Note that this command enables only 1 of TCP probes for processes that name start with python.

### To disable FlowTracer

FlowTracer can be controlled via Gala-Gopher's REST API:
 1. Stop FlowTracer: `curl -X PUT -d json='{"state":"stopped"}' http://localhost:9999/flowtracer`.
 2. Disable FlowTracer data mapping in tcp probe: `curl -X PUT -d json='{"cmd":{"probe":["tcp_stats"]},"snoopers":{"proc_name":[{"comm":"^python.*","cmdline":""}]},"params":{"report_event":0,"report_period":10,"cluster_ip_backend":0},"state":"running"}' http://localhost:9999/tcp`.

### Example

There are 2 pods running on different nodes in Kubernetes cluster. Pod A is a client that sends HTTP request to a server running in Pod B. 
The example shows metric attributes that are collected by Gala-Gopher (common attributes are removed for brevity).

#### Metrics without FlowTracer

Client-side - the client connects to a virtual service IP:
```
gala_gopher_tcp_link_tx_bytes{role="client",client_ip="10.0.0.131",server_ip="10.247.204.240",server_port="8000",pod="app/a-664d757c7b-q6ds2"} 110 1704451439000
```
Server-side - the server receives packets from a translated address (host gateway):
```
gala_gopher_tcp_link_rx_bytes{role="server",client_ip="192.168.3.14",server_ip="10.0.0.5",server_port="8000",pod="app/b-6758f884b4-7mgbm"} 110 1704451440000
```

#### Metrics with FlowTracer

Client-side - the virtual service IP is resolved to the address of the server:
```
gala_gopher_tcp_link_tx_bytes{role="client",client_ip="10.0.0.131",server_ip="10.0.0.5",server_port="8000",pod="app/a-664d757c7b-q6ds2"} 110 1704451981000
```
Server-side - the real client address is visible too:
```
gala_gopher_tcp_link_rx_bytes{role="server",client_ip="10.0.0.131",server_ip="10.0.0.5",server_port="8000",pod="app/b-6758f884b4-7mgbm"} 110 1704451982000
```

openEuler/gala-gopher关闭 .gitee-modal { width: 500px !important; }

搜索帮助

openEuler/gala-gopher
关闭