Network Observability Operator release notes

The Network Observability Operator implements network policies and security hardening measures to improve cluster security posture. Network policies control traffic flow to and from Operator components, and the openshift-netobserv-operator namespace is now protected with appropriate network policy rules.

The Network Observability Operator provides preconfigured Prometheus alerts for Transport Layer Security (TLS) security compliance. Automated alerts notify administrators when workloads use deprecated TLS versions or non-compliant cryptographic protocols.

The Network Health page in the Network Observability Operator web console plugin is enhanced with additional features and improvements for cluster and application administrators. Enhanced health monitoring capabilities provide better visibility into network reliability and performance.

The Network Observability Operator web console plugin provides preconfigured feature views to streamline access to common monitoring tasks. Users can navigate directly to specialized views without manually configuring columns, panels, or metric selections.

The flowlogs-pipeline component is optimized to improve network flow processing performance and resource efficiency. Performance enhancements reduce CPU and memory usage when handling high-volume network traffic.

The Network Observability Operator enhances cluster role binding management to support custom installation namespaces while maintaining security and simplifying configuration. The Network Observability Operator manages cluster role bindings dynamically, eliminating the need for manual updates when changing the default namespace.

The Network Observability Operator is available as a Technology Preview feature for automatic installation in OKD 5.0. You can enable network traffic visualization and monitoring capabilities during cluster installation without performing a separate Operator installation.

Before this update, enabling shared informers in direct deployment mode caused flowlogs-pipeline pods to fail with volume mount errors. As a consequence, flow collection was unavailable when using this configuration.

Before this update, when the FlowCollector processor service TLS type was set to Provided for user-supplied certificates, the Kubernetes cache component defaulted to automatic TLS mode and referenced a certificate secret that was never created. As a consequence, flowlogs-pipeline pods failed to start with a volume mount error.

Before this update, the Network Observability CLI failed to deploy in clusters with a configured default node selector because the CLI namespace did not override the cluster-level selector. As a consequence, many CLI pods remained in pending status when attempting to capture network flows.

Before this update, DNS flow metrics included an incorrect _count suffix that prevented Prometheus alert rules from evaluating properly. As a consequence, DNS-related alerts for NXDomain responses and DNS errors never triggered.

Before this update, the Operator replaced existing namespace metadata when adding required labels for monitoring and eBPF agent namespaces. As a consequence, custom annotations and labels were removed, and OpenShift Security Context Constraints allocation annotations could be reassigned with different values, potentially causing pod execution failures.

Before this update, when reinstalling the Operator by using a different installation method, the static console plugin failed to load because the ConsolePlugin resource namespace was not updated to match the new installation. As a consequence, the Network Observability web console plugin was unavailable after reinstallation.

Before this update, owner-scoped queries required Loki as the data source and were not handled by Prometheus when Loki was disabled. As a consequence, users could not retrieve owner-based network flow data in Prometheus-only configurations.

Before this update, network flows for UDP-encapsulated IPsec packets reported zero bytes and zero packets when the IPsec eBPF feature was enabled. As a consequence, traffic volume metrics were incorrect for encrypted network communications.

Before this update, secondary network flows were not enriched with Kubernetes metadata when flowlogs-pipeline informers were enabled. As a consequence, user-defined network flows lacked pod, namespace, and workload information.

Before this update, the IP Flow Information Export (IPFIX) exporter retained data from previously processed flows in memory and included stale values in later flow records. As a consequence, exported IPFIX data contained incorrect metrics such as round-trip time values from unrelated flows.

Before this update, health rules by using the low volume threshold filter evaluated sampled metric values rather than normalized traffic volumes. As a consequence, increasing the sampling rate caused health rules to disappear from the Network Health page because observed packet counts fell below the threshold.

Before this update, exporting the topology view to a PNG image file resulted in blackened node labels and icons. As a consequence, the exported topology diagrams were unreadable.

Before this update, donut panels displaying paired metrics such as TLS and DNS statistics were misaligned within their rows. As a consequence, the panels appeared shifted to the left instead of centered.