mbp-1128: Add Network Observability with NooBaa-backed Loki by pmatouse · Pull Request #165 · validatedpatterns/layered-zero-trust

pmatouse · 2026-07-23T09:50:15Z

feat: add Network Observability with NooBaa-backed Loki

Install Loki and Network Observability operators via a storage-dependent
feature fragment, and deploy LokiStack plus FlowCollector using NooBaa
storage.

Signed-off-by: Petr Matousek pmatouse@redhat.com

mlorenzofr

overall it's very good, but some small changes need to be made

p-rog

Overall LGTM

I left one suggestion which I found when I was testing it at OCP 4.22.
Additionally, it would be great to add network policies to the Network Observability feature, to follow ZT methodology. You can test my network policy architect skill :)

pmatouse · 2026-07-29T12:15:45Z

Additionally, it would be great to add network policies to the Network Observability feature, to follow ZT methodology. You can test my network policy architect skill :)

I've added the the network policies

mlorenzofr

Overall okay, it's almost ready for LGTM in my opinion, just a couple of minor things.

Additionally:

Change its status from draft to ready for review.
Do a rebase to get the latest changes from the main branch and avoid conflicts.

p-rog · 2026-08-04T11:02:19Z

@pmatouse the network policies looks very nice. As I can see you didn't restrict specific ports in the ingress rules from netobserv, openshift-console, and openshift-monitoring. Loki components typically listen on specific ports (3100 for HTTP API, 9095 for gRPC, 7946 for memberlist). Is it intentional because Loki has multiple internal ports that vary by component?

Additionally, the Loki Operator channel is pinned to stable-6.6. To avoid OCP compatibility problems, maybe let's remove it like it was done with ODF, Quay, and RHTAS so subscriptions follow the default catalog channel on newer OCP releases. WDYT?

Install Loki and Network Observability operators via a storage-dependent feature fragment, and deploy LokiStack plus FlowCollector using NooBaa storage. Signed-off-by: Petr Matousek <pmatouse@redhat.com>

Use Helm lookup for the default StorageClass when possible; require an explicit value under Argo CD. LokiStack CRD rejects an omitted field.

Enable FlowCollector operator NPs for netobserv/privileged, and add least-privilege policies for netobserv-loki.

pmatouse · 2026-08-05T09:31:59Z

Addressed in 0323cd0 — peer-namespace ingress is port-pinned now. Same-ns left unrestricted to stay cautious around Loki’s internal gRPC/memberlist traffic.

Also unpinned Loki channel in b56eb16 so OLM follows the catalog default.

mlorenzofr

with the current code it is fully functional

If we want to avoid OutOfSync in the Argo CD application, we would have to ignore some attributes that mutate when the FlowCollector is initialized.

I may be wrong, but I think the SYNC-WAVE-INVENTORY.md file is missing the NetworkPolicies entries.

mlorenzofr · 2026-08-05T11:26:52Z

+        argocd.argoproj.io/sync-wave: "42"
+      overrides:
+        - name: loki.storageClassName
+          value: "<YOUR-STORAGE-CLASS>"


netobserv operator mutates some fields after creation, so every ArgoCD sync after the first will report OutOfSync. I think this would solve it.

Suggested change

value: "<YOUR-STORAGE-CLASS>"

value: "<YOUR-STORAGE-CLASS>"

ignoreDifferences:

- group: flows.netobserv.io

kind: FlowCollector

jsonPointers:

- /spec/agent/ebpf/cacheActiveTimeout

- /spec/agent/ebpf/cacheMaxFlows

- /spec/agent/ebpf/excludeInterfaces

- /spec/agent/ebpf/imagePullPolicy

- /spec/agent/ebpf/kafkaBatchSize

- /spec/agent/ebpf/logLevel

- /spec/agent/ebpf/metrics

- /spec/agent/ebpf/resources

- /spec/agent/ipfix

- /spec/consolePlugin/autoscaler

- /spec/consolePlugin/imagePullPolicy

- /spec/consolePlugin/logLevel

- /spec/consolePlugin/portNaming

- /spec/consolePlugin/quickFilters

- /spec/consolePlugin/replicas

- /spec/consolePlugin/resources

- /spec/execution

- /spec/kafka

- /spec/loki/manual

- /spec/loki/microservices

- /spec/loki/monolithic

- /spec/loki/readTimeout

- /spec/loki/writeBatchSize

- /spec/loki/writeBatchWait

- /spec/loki/writeTimeout

- /spec/processor

- /spec/prometheus

mlorenzofr · 2026-08-05T11:40:41Z

+    #     argocd.argoproj.io/sync-wave: "42"  # Deploy after NooBaa storage backend
+    #   overrides:
+    #     - name: loki.storageClassName
+    #       value: ""  # Add your own storageClassName here


Suggested change

# value: "" # Add your own storageClassName here

# value: "" # Add your own storageClassName here

# ignoreDifferences:

# - group: flows.netobserv.io

# kind: FlowCollector

# jsonPointers:

# - /spec/agent/ebpf/cacheActiveTimeout

# - /spec/agent/ebpf/cacheMaxFlows

# - /spec/agent/ebpf/excludeInterfaces

# - /spec/agent/ebpf/imagePullPolicy

# - /spec/agent/ebpf/kafkaBatchSize

# - /spec/agent/ebpf/logLevel

# - /spec/agent/ebpf/metrics

# - /spec/agent/ebpf/resources

# - /spec/agent/ipfix

# - /spec/consolePlugin/autoscaler

# - /spec/consolePlugin/imagePullPolicy

# - /spec/consolePlugin/logLevel

# - /spec/consolePlugin/portNaming

# - /spec/consolePlugin/quickFilters

# - /spec/consolePlugin/replicas

# - /spec/consolePlugin/resources

# - /spec/execution

# - /spec/kafka

# - /spec/loki/manual

# - /spec/loki/microservices

# - /spec/loki/monolithic

# - /spec/loki/readTimeout

# - /spec/loki/writeBatchSize

# - /spec/loki/writeBatchWait

# - /spec/loki/writeTimeout

# - /spec/processor

# - /spec/prometheus

sabre1041

A few small changes. However, functionality wise, the new integration works great. Once these items are addressed, we can integrate

sabre1041 · 2026-08-05T22:40:47Z

+{{- $sc -}}
+{{- else -}}
+{{- $default := "" -}}
+{{- range (lookup "storage.k8s.io/v1" "StorageClass" "" "").items | default list -}}


Since the lookup functionality is not supported in Argo CD, lets remove this from the chart and just fail if this value is not provided. Appropriate guidance via documentation should be provided to instruct the end user the steps that they need to take

sabre1041 · 2026-08-05T22:44:25Z

+    type: {{ .Values.flowcollector.agent.type }}
+    ebpf:
+      sampling: {{ .Values.flowcollector.agent.sampling }}
+      privileged: {{ .Values.flowcollector.agent.privileged }}


if privileged is false, the property is dropped from the resulting CR as results in out of sync warnings. Update this property to only provide the value only if true

pmatouse marked this pull request as draft July 23, 2026 09:51

mlorenzofr requested review from mlorenzofr, p-rog and sabre1041 July 23, 2026 14:24

mlorenzofr requested changes Jul 23, 2026

View reviewed changes

pmatouse force-pushed the mbp-1128-network-observability branch from abcf24c to 091415e Compare July 23, 2026 16:45

p-rog reviewed Jul 23, 2026

View reviewed changes

Comment thread charts/netobserv/templates/_helpers.tpl

p-rog reviewed Jul 23, 2026

View reviewed changes

Comment thread charts/netobserv/templates/lokistack.yaml

p-rog reviewed Jul 23, 2026

View reviewed changes

pmatouse force-pushed the mbp-1128-network-observability branch from 89a748b to 04a245d Compare July 30, 2026 10:35

mlorenzofr requested changes Aug 3, 2026

View reviewed changes

Comment thread scripts/features/netobserv.yaml

Comment thread values-hub.yaml

Comment thread charts/netobserv/templates/loki-s3-credentials-job.yaml Outdated

Comment thread charts/netobserv/templates/loki-s3-credentials-job.yaml Outdated

pmatouse marked this pull request as ready for review August 3, 2026 14:27

pmatouse added 5 commits August 5, 2026 10:25

feat: add Network Observability with NooBaa-backed Loki

1ebb7bc

Install Loki and Network Observability operators via a storage-dependent feature fragment, and deploy LokiStack plus FlowCollector using NooBaa storage. Signed-off-by: Petr Matousek <pmatouse@redhat.com>

fix(netobserv): resolve LokiStack storageClassName for Helm and Argo

ffee937

Use Helm lookup for the default StorageClass when possible; require an explicit value under Argo CD. LokiStack CRD rejects an omitted field.

fix(netobserv): harden OBC credentials Job error handling

da21ff8

docs: comment netobserv enablement in values-hub

4d0a141

feat(netobserv): add NetworkPolicies for LokiStack namespace

b46e35c

Enable FlowCollector operator NPs for netobserv/privileged, and add least-privilege policies for netobserv-loki.

pmatouse force-pushed the mbp-1128-network-observability branch from 04a245d to b46e35c Compare August 5, 2026 08:25

pmatouse added 4 commits August 5, 2026 10:36

docs(netobserv): add storageClassName override examples

b349833

fix(netobserv): unpin Loki operator channel

b56eb16

fix(netobserv): drop redundant Job securityContext fields

66d5c8c

fix(netobserv): pin LokiStack NetworkPolicy ingress ports

0323cd0

pmatouse requested review from mlorenzofr and p-rog August 5, 2026 09:33

mlorenzofr approved these changes Aug 5, 2026

View reviewed changes

sabre1041 requested changes Aug 5, 2026

View reviewed changes

-          value: "<YOUR-STORAGE-CLASS>"
+          value: "<YOUR-STORAGE-CLASS>"
+      ignoreDifferences:
+        - group: flows.netobserv.io
+          kind: FlowCollector
+          jsonPointers:
+            - /spec/agent/ebpf/cacheActiveTimeout
+            - /spec/agent/ebpf/cacheMaxFlows
+            - /spec/agent/ebpf/excludeInterfaces
+            - /spec/agent/ebpf/imagePullPolicy
+            - /spec/agent/ebpf/kafkaBatchSize
+            - /spec/agent/ebpf/logLevel
+            - /spec/agent/ebpf/metrics
+            - /spec/agent/ebpf/resources
+            - /spec/agent/ipfix
+            - /spec/consolePlugin/autoscaler
+            - /spec/consolePlugin/imagePullPolicy
+            - /spec/consolePlugin/logLevel
+            - /spec/consolePlugin/portNaming
+            - /spec/consolePlugin/quickFilters
+            - /spec/consolePlugin/replicas
+            - /spec/consolePlugin/resources
+            - /spec/execution
+            - /spec/kafka
+            - /spec/loki/manual
+            - /spec/loki/microservices
+            - /spec/loki/monolithic
+            - /spec/loki/readTimeout
+            - /spec/loki/writeBatchSize
+            - /spec/loki/writeBatchWait
+            - /spec/loki/writeTimeout
+            - /spec/processor
+            - /spec/prometheus

-    #       value: ""  # Add your own storageClassName here
+    #       value: ""  # Add your own storageClassName here
+    #   ignoreDifferences:
+    #     - group: flows.netobserv.io
+    #       kind: FlowCollector
+    #       jsonPointers:
+    #         - /spec/agent/ebpf/cacheActiveTimeout
+    #         - /spec/agent/ebpf/cacheMaxFlows
+    #         - /spec/agent/ebpf/excludeInterfaces
+    #         - /spec/agent/ebpf/imagePullPolicy
+    #         - /spec/agent/ebpf/kafkaBatchSize
+    #         - /spec/agent/ebpf/logLevel
+    #         - /spec/agent/ebpf/metrics
+    #         - /spec/agent/ebpf/resources
+    #         - /spec/agent/ipfix
+    #         - /spec/consolePlugin/autoscaler
+    #         - /spec/consolePlugin/imagePullPolicy
+    #         - /spec/consolePlugin/logLevel
+    #         - /spec/consolePlugin/portNaming
+    #         - /spec/consolePlugin/quickFilters
+    #         - /spec/consolePlugin/replicas
+    #         - /spec/consolePlugin/resources
+    #         - /spec/execution
+    #         - /spec/kafka
+    #         - /spec/loki/manual
+    #         - /spec/loki/microservices
+    #         - /spec/loki/monolithic
+    #         - /spec/loki/readTimeout
+    #         - /spec/loki/writeBatchSize
+    #         - /spec/loki/writeBatchWait
+    #         - /spec/loki/writeTimeout
+    #         - /spec/processor
+    #         - /spec/prometheus

Uh oh!

Conversation

pmatouse commented Jul 23, 2026

Uh oh!

mlorenzofr left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

p-rog left a comment

Choose a reason for hiding this comment

Uh oh!

pmatouse commented Jul 29, 2026

Uh oh!

mlorenzofr left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

p-rog commented Aug 4, 2026

Uh oh!

pmatouse commented Aug 5, 2026

Uh oh!

mlorenzofr left a comment

Choose a reason for hiding this comment

Uh oh!

mlorenzofr Aug 5, 2026

Choose a reason for hiding this comment

Uh oh!

mlorenzofr Aug 5, 2026

Choose a reason for hiding this comment

Uh oh!

sabre1041 left a comment

Choose a reason for hiding this comment

Uh oh!

sabre1041 Aug 5, 2026

Choose a reason for hiding this comment

Uh oh!

sabre1041 Aug 5, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants