apiVersion: v1 kind: Namespace metadata: labels: app: flow-aggregator name: flow-aggregator --- apiVersion: v1 kind: ServiceAccount metadata: labels: app: flow-aggregator name: flow-aggregator namespace: flow-aggregator --- apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: labels: app: flow-aggregator name: flow-exporter-role namespace: flow-aggregator rules: - apiGroups: - "" resourceNames: - flow-aggregator-ca resources: - configmaps verbs: - get - apiGroups: - "" resourceNames: - flow-aggregator-client-tls resources: - secrets verbs: - get --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: labels: app: flow-aggregator name: flow-aggregator-role rules: - apiGroups: - "" resourceNames: - flow-aggregator-ca resources: - configmaps verbs: - get - update - apiGroups: - "" resources: - pods verbs: - get - list - watch - apiGroups: - "" resources: - configmaps verbs: - create - get - list - watch - apiGroups: - "" resourceNames: - extension-apiserver-authentication resources: - configmaps verbs: - get - list - watch - apiGroups: - "" resourceNames: - flow-aggregator-client-tls resources: - secrets verbs: - get - update - apiGroups: - "" resources: - secrets verbs: - create --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: labels: app: flow-aggregator name: flow-exporter-role-binding namespace: flow-aggregator roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: flow-exporter-role subjects: - kind: ServiceAccount name: antrea-agent namespace: kube-system --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: labels: app: flow-aggregator name: flow-aggregator-cluster-id-reader roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: antrea-cluster-identity-reader subjects: - kind: ServiceAccount name: flow-aggregator namespace: flow-aggregator --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: labels: app: flow-aggregator name: flow-aggregator-cluster-role-binding roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: flow-aggregator-role subjects: - kind: ServiceAccount name: flow-aggregator namespace: flow-aggregator --- apiVersion: v1 data: flow-aggregator.conf: | # Provide the active flow record timeout as a duration string. This determines # how often the flow aggregator exports the active flow records to the flow # collector. Thus, for flows with a continuous stream of packets, a flow record # will be exported to the collector once the elapsed time since the last export # event in the flow aggregator is equal to the value of this timeout. # Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h". #activeFlowRecordTimeout: 60s # Provide the inactive flow record timeout as a duration string. This determines # how often the flow aggregator exports the inactive flow records to the flow # collector. A flow record is considered to be inactive if no matching record # has been received by the flow aggregator in the specified interval. # Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h". #inactiveFlowRecordTimeout: 90s # Provide the transport protocol for the flow aggregator collecting process, which is tls, tcp or udp. #aggregatorTransportProtocol: "tls" # Provide DNS name or IP address of flow aggregator for generating TLS certificate. It must match # the flowCollectorAddr parameter in the antrea-agent config. #flowAggregatorAddress: "flow-aggregator.flow-aggregator.svc" # recordContents enables configuring some fields in the flow records. Fields can # be excluded to reduce record size, but some features or external tooling may # depend on these fields. recordContents: # Determine whether source and destination Pod labels will be included in the flow records. #podLabels: false # apiServer contains APIServer related configuration options. apiServer: # The port for the flow-aggregator APIServer to serve on. #apiPort: 10348 # Comma-separated list of Cipher Suites. If omitted, the default Go Cipher Suites will be used. # https://golang.org/pkg/crypto/tls/#pkg-constants # Note that TLS1.3 Cipher Suites cannot be added to the list. But the apiserver will always # prefer TLS1.3 Cipher Suites whenever possible. #tlsCipherSuites: # TLS min version from: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13. #tlsMinVersion: # flowCollector contains external IPFIX or JSON collector related configuration options. flowCollector: # Enable is the switch to enable exporting flow records to external flow collector. #enable: false # Provide the flow collector address as string with format :[:], where proto is tcp or udp. # If no L4 transport proto is given, we consider tcp as default. #address: "" # Provide the 32-bit Observation Domain ID which will uniquely identify this instance of the flow # aggregator to an external flow collector. If omitted, an Observation Domain ID will be generated # from the persistent cluster UUID generated by Antrea. Failing that (e.g. because the cluster UUID # is not available), a value will be randomly generated, which may vary across restarts of the flow # aggregator. #observationDomainID: # Provide format for records sent to the configured flow collector. # Supported formats are IPFIX and JSON. #recordFormat: "IPFIX" # clickHouse contains ClickHouse related configuration options. clickHouse: # Enable is the switch to enable exporting flow records to ClickHouse. #enable: false # Database is the name of database where Antrea "flows" table is created. #database: "default" # DatabaseURL is the url to the database. TCP protocol is required. #databaseURL: "tcp://clickhouse-clickhouse.flow-visibility.svc:9000" # Debug enables debug logs from ClickHouse sql driver. #debug: false # Compress enables lz4 compression when committing flow records. #compress: true # CommitInterval is the periodical interval between batch commit of flow records to DB. # Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h". # The minimum interval is 1s based on ClickHouse documentation for best performance. #commitInterval: "8s" kind: ConfigMap metadata: labels: app: flow-aggregator name: flow-aggregator-configmap-7572tg842t namespace: flow-aggregator --- apiVersion: v1 kind: Secret metadata: labels: app: flow-aggregator name: clickhouse-secret namespace: flow-aggregator stringData: password: clickhouse_operator_password username: clickhouse_operator type: Opaque --- apiVersion: v1 kind: Service metadata: labels: app: flow-aggregator name: flow-aggregator namespace: flow-aggregator spec: ports: - name: ipfix-udp port: 4739 protocol: UDP targetPort: 4739 - name: ipfix-tcp port: 4739 protocol: TCP targetPort: 4739 selector: app: flow-aggregator --- apiVersion: apps/v1 kind: Deployment metadata: labels: app: flow-aggregator name: flow-aggregator namespace: flow-aggregator spec: replicas: 1 selector: matchLabels: app: flow-aggregator template: metadata: labels: app: flow-aggregator spec: containers: - args: - --config - /etc/flow-aggregator/flow-aggregator.conf - --logtostderr=false - --log_dir=/var/log/antrea/flow-aggregator - --alsologtostderr - --log_file_max_size=100 - --log_file_max_num=4 - --v=0 env: - name: POD_NAME valueFrom: fieldRef: fieldPath: metadata.name - name: CH_USERNAME valueFrom: secretKeyRef: key: username name: clickhouse-secret - name: CH_PASSWORD valueFrom: secretKeyRef: key: password name: clickhouse-secret image: projects.registry.vmware.com/antrea/flow-aggregator:latest imagePullPolicy: IfNotPresent name: flow-aggregator ports: - containerPort: 4739 volumeMounts: - mountPath: /etc/flow-aggregator/flow-aggregator.conf name: flow-aggregator-config readOnly: true subPath: flow-aggregator.conf - mountPath: /var/log/antrea/flow-aggregator name: host-var-log-antrea-flow-aggregator nodeSelector: kubernetes.io/arch: amd64 kubernetes.io/os: linux serviceAccountName: flow-aggregator volumes: - configMap: name: flow-aggregator-configmap-7572tg842t name: flow-aggregator-config - hostPath: path: /var/log/antrea/flow-aggregator type: DirectoryOrCreate name: host-var-log-antrea-flow-aggregator