[Feature] Add support for enabling Cilium drop events
- Dominant language
- TypeScript
- Stars
- 2.1k
- Forks
- 395
- Avg merge
- 2d 22h
- Merged PRs (30d)
- 13
Description
**Is your feature request related to a problem? Please describe.**
This feature request is related to discoverability of cluster issues. It can be problematic to discover that network policy issues are involved when troubleshooting general cluster issues. Of course, there are already various ways to inspect drop events, like the Hubble UI, or metrics/flow logs. However, cilium also allows for emitting Kubernetes events (see below for an example), which end up in the namespace of the specific workloads. This would allow for better discoverability that there are issues with network policies.
_Example events:_
```
LAST SEEN TYPE REASON OBJECT MESSAGE
52m Warning PacketDrop pod/test Outgoing packet dropped (policy_denied) to world (10.0.0.1) TCP/80
49m Warning PacketDrop pod/test Outgoing packet dropped (policy_denied) to world (10.0.0.1) TCP/80
47m Warning PacketDrop pod/test Outgoing packet dropped (policy_denied) to world (10.0.0.1) TCP/81
21m Normal Killing pod/test Stopping container test
```
**Describe the solution you'd like**
It would help to be able to enable the cilium drop events, and also configure the specifics of that. So the equivalent of adding something like this to the `cilium-config` configmap:
```yaml
apiVersion: v1
kind: ConfigMap
data:
...
hubble-drop-events: "true"
hubble-drop-events-interval: 5m
hubble-drop-events-reasons: auth_required policy_denied policy_deny
...
```
Perhaps with a custom CRD managed by AKS, or perhaps just by supporting the `CiliumNodeConfig` (it is present on AKS clusters, but doesn't pick up changes, I've tested that), which you would set to an empty node selector, so it applies to all nodes.
**Describe alternatives you've considered**
An alternative is to edit the `cilium-config` configmap directly. I've also tested that, that works, however, this is managed by AKS, and AFAIK, this is not something you should change.
Contributor guide
Assessment
This issue has not been assessed yet.