Network Observability Operator release notes

The Network Observability Operator can now capture and analyze Transport Layer Security (TLS) metadata from network flows without decrypting traffic. By extracting handshake details from ClientHello and ServerHello messages, the Operator provides visibility into encryption protocols while maintaining data privacy.

Message compression configuration is now available when using Kafka to scale network flow collection. Enabling compression reduces the network bandwidth required to transport flows and decreases the storage footprint on Kafka brokers.

The configuration process for secondary network indexing is now simplified.

The Network Observability web console plugin is updated to support OKD 4.22 and later. Backward compatibility is maintained for OKD versions 4.14 through 4.21.

Before this update, changes to the sampling field caused an inconsistency in the FlowCollector resource status. As a consequence, you could see conflicting statuses across pipeline components.

Before this update, the --help flag was ignored when placed after other command flags in the Network Observability CLI. As a consequence, running commands such as oc netobserv flows --interfaces=br-ex --max-time=10s --help executed the flow collection instead of displaying the help page.

Before this update, the DNS names graph repeatedly displayed a warning message on every refresh when running in a Prometheus-only configuration. As a consequence, the persistent warning message covered other dashboard elements.

Before this update, the default setting for Prometheus metrics was unassigned during FlowCollector custom resource creation. As a consequence, you had to manually ensure that metrics collection was active to query accurate flow data.

Before this update, the help subcommands for the Network Observability CLI lacked syntax examples. As a consequence, understanding how to construct complex filtering and capture commands required additional research.

Before this update, flow durations and network latencies greater than one second were improperly formatted as milliseconds. As a consequence, donut graphs and latency metrics displayed confusing or inaccurate time designations.

Before this update, the FlowCollector resource reported a status of Ready even when a restrictive nodeSelector prevented any eBPF agent pods from deploying. As a consequence, the system status misrepresented the health of the agent layer.

Before this update, the OpenTelemetry exporter processed missing or null keys as non-null data. As a consequence, unpopulated metadata fields were exported to log streams, which increased storage usage and cluttered telemetry files.

Before this update, Internet Protocol Flow Information Export (IPFIX) record exports omitted per-flow sampling information. As a consequence, data exports failed to comply with the standard IPFIX specifications for samplingProbability usage.

Before this update, configuring TLS certificates on OpenTelemetry exporters generated an invalid volume name format. As a consequence, the apiserver rejected the underlying Flow-logs Pipeline deployment specification, causing the pipeline pod to fail during initialization.

Before this update, the default flow filter action was not enforced when a network flow failed to match both a CIDR rule and its corresponding peerCIDR rule identically. As a consequence, unexpected acknowledgment-only, ACK, flows bypass filtering restrictions inside the pod network.

When you configure custom product logos in the Console.operator.openshift.io resource using the spec.customization.logos field, the Network Observability Operator pod fails to start during installation. The Operator incorrectly reports a validation error indicating that both logos and the deprecated customLogoFile fields are set, even though only logos is configured.