Skip to content

Commit

Permalink
Updating the network mapper tutorial to include public internet egres…
Browse files Browse the repository at this point in the history
…s. (#191)
  • Loading branch information
bglynn authored Jan 22, 2024
1 parent 350c5c9 commit b339e7c
Show file tree
Hide file tree
Showing 4 changed files with 18 additions and 9 deletions.
21 changes: 15 additions & 6 deletions docs/quickstart/visualization/k8s-network-mapper.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ import Tabs from "@theme/Tabs";
import TabItem from "@theme/TabItem";
import styles from "/src/css/styles.module.css";

The network mapper allows you to map pod-to-pod traffic within your K8s cluster.
The network mapper allows you to map network traffic for your K8s cluster. Once mapped you can export it as an image, json, list, or view it within Otterize Cloud.

In this tutorial, we will:

Expand All @@ -29,7 +29,7 @@ Before you start, you'll need a Kubernetes cluster. Having a cluster with a [CNI
You can now install Otterize in your cluster (if it's not already installed), and optionally connect to Otterize Cloud. Connecting to Cloud lets you:

1. See what's happening visually in your browser, through the "access graph";
2. Avoid using SPIRE (which can be installed with Otterize) for issuing certificates, as Otterize Cloud provides a certificate service.
2. View pod public internet egress traffic.

So either forego browser visualization and:

Expand Down Expand Up @@ -73,6 +73,15 @@ Deploy the following simple example — `client`, `client2` and `server`, co
kubectl apply -n otterize-tutorial-mapper -f ${ABSOLUTE_URL}/code-examples/network-mapper/all.yaml
```

<details>
<summary>Expand to see the deployment YAML</summary>

```yaml
{@include: ../../../static/code-examples/network-mapper/all.yaml}
```

</details>

## Map the cluster

The network mapper starts to sniff traffic and build an in-memory network map as soon as it's installed.
Expand All @@ -94,11 +103,11 @@ If you've attached Otterize OSS to Otterize Cloud, you can now also see the [acc
The access graph reveals several types of information and insights, such as:

1. Seeing the network map for different clusters, seeing the subset of the map for a given namespace, or even &mdash; according to how you've mapped namespaces to environments &mdash; seeing the subset of the map for a specific environment.
2. Filtering the map to include recently-seen traffic, since some date in the past. That way you can eliminate calls that are no longer relevant, without having to reset the network mapper and start building a new map.
3. If the intents operator is also connected, the access graph now reveals more specifics about access: understand which services are protected or would be protected, and which client calls are being blocked or would be blocked. We'll see more of that in the next couple of tutorials

Note, for example, that the `client` &rightarrow; `server` arrow is yellow. Clicking on it shows:
2. Viewing the public internet egress traffic for each pod, including the DNS name and the IPs associated with each outbound request.
3. Filtering the map to include recently-seen traffic, since some date in the past. That way you can eliminate calls that are no longer relevant, without having to reset the network mapper and start building a new map.
4. If the intents operator is also connected, the access graph now reveals more specifics about access: understand which services are protected or would be protected, and which client calls are being blocked or would be blocked. We'll see more of that in the next couple of tutorials.

Note, for example, that the `client` &rightarrow; `server` arrow is yellow. Clicking on it shows the automatically generated intents for both the client pod to the server pod and the egress of the client to the public internet. If we take a closer look, the ClientIntent YAML specifies that the `client` can call the `server` on the internal network, and it can reach the IP Address`142.250.189.174`. We can see from the comment that this IP belongs to google.com.
<img
src="/img/quick-tutorials/network-mapper/otterize-tutorial-access-graph-edge-info-modal.png"
alt="Client to server edge info"
Expand Down
6 changes: 3 additions & 3 deletions static/code-examples/network-mapper/all.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ spec:
- name: client
image: alpine/curl
command: [ "/bin/sh", "-c", "--" ]
args: [ "while true; do curl -si server; sleep 2; done" ]
args: [ "while true; do curl -s server; sleep 1; echo 'Client - The time is:'; curl -v --silent google.com 2>&1 | grep 'Date:'; sleep 2; done" ]
---
apiVersion: apps/v1
kind: Deployment
Expand All @@ -41,7 +41,7 @@ spec:
- name: server
image: node:19
command: [ "/bin/sh","-c" ]
args: [ "echo \"Hi, I am the server, you called, may I help you?\" > index.html; npx --yes http-server -p 80 " ]
args: [ "echo \"\n\nHi, I am the server, do you have the time or know anything funny?\n \" > index.html; npx --yes http-server -p 80 " ]
---
apiVersion: v1
kind: Service
Expand Down Expand Up @@ -74,4 +74,4 @@ spec:
- name: client2
image: alpine/curl
command: [ "/bin/sh", "-c", "--" ]
args: [ "while true; do curl -si server; sleep 2; done" ]
args: [ "while true; do curl -s server; sleep 1; echo 'Client2 - These are usually funny:'; curl -s https://xkcd.com/info.0.json; sleep 2; done" ]
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.

0 comments on commit b339e7c

Please sign in to comment.