Skip to content

Commit fe03b4b

Browse files
jotakjotak
authored
Fix pprof broad exposition (#2821)
* Fix pprof broad exposition When pprof was enabled on FLP or the agent, it was exposed on ":(port)" which stands for all net interfaces. FLP and agent configs are modified to accept the full listening address, not just the port (breaking changes). For FLP, the pprof config is exposed in FlowCollector. Force using "localhost" (which stands for 127.0.0.1 in ipv4 but also works on ipv6). We don't change the FlowCollector API, only the port is exposed. For the agent, the pprof config is not explicitely exposed but can be modified through env, so the user may configure whatever they want. Raise 3 warnings through the webhook: - when pprof is enbaled on FLP - when pprof is enabled on the agent - when the agent pprof uses broad interface exposition Add more info to the pprof doc about security. * bump flp/agent deps * fix agent tests
1 parent c313f67 commit fe03b4b

125 files changed

Lines changed: 4749 additions & 2324 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.mk/local.mk‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ IMAGE_FOR_HELM := $(word 1,$(subst :, ,${IMAGE}))
77
VERSION_FOR_HELM := $(word 2,$(subst :, ,${IMAGE}))
88
.PHONY: helm-install
99
helm-install: prereqs-helm ## Install the operator and its pre-requisites to a running cluster, using Helm
10+
cd helm && helm dependency update --skip-refresh ; cd ..
1011
helm repo add cert-manager https://charts.jetstack.io
1112
helm upgrade --install cert-manager -n cert-manager --create-namespace cert-manager/cert-manager --set crds.enabled=true
1213
helm upgrade --install trust-manager -n cert-manager oci://quay.io/jetstack/charts/trust-manager --wait

‎api/flowcollector/v1beta2/flowcollector_types.go‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1395,18 +1395,20 @@ type AdvancedProcessorConfig struct {
13951395
//+kubebuilder:validation:Maximum=65535
13961396
//+kubebuilder:default:=8080
13971397
//+optional
1398-
// `healthPort` is a collector HTTP port in the Pod that exposes the health check API
1398+
// `healthPort` is a collector HTTP port in the Pod that exposes the health check API.
13991399
HealthPort *int32 `json:"healthPort,omitempty"`
14001400

14011401
//+kubebuilder:validation:Minimum=0
14021402
//+kubebuilder:validation:Maximum=65535
14031403
//+optional
1404-
// `profilePort` allows setting up a Go pprof profiler listening to this port
1404+
// `profilePort` allows setting up a Go pprof profiler listening to this port.
1405+
// This is for debugging purpose only. This port should not be exposed, you can
1406+
// access it through local port-forwarding.
14051407
ProfilePort *int32 `json:"profilePort,omitempty"`
14061408

14071409
//+kubebuilder:default:=true
14081410
//+optional
1409-
// `enableKubeProbes` is a flag to enable or disable Kubernetes liveness and readiness probes
1411+
// `enableKubeProbes` is a flag to enable or disable Kubernetes liveness and readiness probes.
14101412
EnableKubeProbes *bool `json:"enableKubeProbes,omitempty"`
14111413

14121414
//+kubebuilder:default:=true
@@ -1416,7 +1418,7 @@ type AdvancedProcessorConfig struct {
14161418

14171419
//+kubebuilder:default:="30s"
14181420
//+optional
1419-
// `conversationHeartbeatInterval` is the time to wait between "tick" events of a conversation
1421+
// `conversationHeartbeatInterval` is the time to wait between "tick" events of a conversation.
14201422
ConversationHeartbeatInterval *metav1.Duration `json:"conversationHeartbeatInterval,omitempty"`
14211423

14221424
//+kubebuilder:default:="10s"

‎api/flowcollector/v1beta2/flowcollector_validation_webhook.go‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,7 @@ func (r *FlowCollector) Validate(_ context.Context, fc *FlowCollector) (admissio
6868
v.validateAgent()
6969
v.validateFLP()
7070
v.warnLogLevels()
71+
v.warnProfiling()
7172
v.warnLokiDemo()
7273
return v.warnings, errors.Join(v.errors...)
7374
}
@@ -87,6 +88,21 @@ func (v *validator) warnLogLevels() {
8788
}
8889
}
8990

91+
func (v *validator) warnProfiling() {
92+
warning := "This is for debugging purpose only. The profiling port should not be exposed, you can access it through local port-forwarding."
93+
if v.fc.Agent.EBPF.Advanced != nil {
94+
if env, ok := v.fc.Agent.EBPF.Advanced.Env["PPROF_ADDR"]; ok && env != "" {
95+
v.warnings = append(v.warnings, "Profiling is enabled on the eBPF agent. "+warning)
96+
if strings.HasPrefix(env, ":") || strings.HasPrefix(env, "0.0.0.0:") {
97+
v.warnings = append(v.warnings, "Profiling is enabled for all network interfaces, make sure access is restricted e.g. with a network policy.")
98+
}
99+
}
100+
}
101+
if v.fc.Processor.Advanced != nil && v.fc.Processor.Advanced.ProfilePort != nil && *v.fc.Processor.Advanced.ProfilePort > 0 {
102+
v.warnings = append(v.warnings, "Profiling is enabled on flowlogs-pipeline. "+warning)
103+
}
104+
}
105+
90106
func (v *validator) warnLokiDemo() {
91107
if v.fc.Loki.Mode == LokiModeMonolithic && v.fc.Loki.Monolithic.InstallDemoLoki != nil && *v.fc.Loki.Monolithic.InstallDemoLoki {
92108
v.warnings = append(v.warnings, "InstallDemoLoki option is enabled. This is useful for development and demo purposes but should not be used in production.")

‎bundle/manifests/flows.netobserv.io_flowcollectors.yaml‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4378,7 +4378,7 @@ spec:
43784378
conversationHeartbeatInterval:
43794379
default: 30s
43804380
description: '`conversationHeartbeatInterval` is the time
4381-
to wait between "tick" events of a conversation'
4381+
to wait between "tick" events of a conversation.'
43824382
type: string
43834383
conversationTerminatingTimeout:
43844384
default: 5s
@@ -4394,7 +4394,7 @@ spec:
43944394
enableKubeProbes:
43954395
default: true
43964396
description: '`enableKubeProbes` is a flag to enable or disable
4397-
Kubernetes liveness and readiness probes'
4397+
Kubernetes liveness and readiness probes.'
43984398
type: boolean
43994399
env:
44004400
additionalProperties:
@@ -4408,7 +4408,7 @@ spec:
44084408
healthPort:
44094409
default: 8080
44104410
description: '`healthPort` is a collector HTTP port in the
4411-
Pod that exposes the health check API'
4411+
Pod that exposes the health check API.'
44124412
format: int32
44134413
maximum: 65535
44144414
minimum: 1
@@ -4424,8 +4424,10 @@ spec:
44244424
minimum: 1025
44254425
type: integer
44264426
profilePort:
4427-
description: '`profilePort` allows setting up a Go pprof profiler
4428-
listening to this port'
4427+
description: |-
4428+
`profilePort` allows setting up a Go pprof profiler listening to this port.
4429+
This is for debugging purpose only. This port should not be exposed, you can
4430+
access it through local port-forwarding.
44294431
format: int32
44304432
maximum: 65535
44314433
minimum: 0

‎config/crd/bases/flows.netobserv.io_flowcollectors.yaml‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4029,7 +4029,7 @@ spec:
40294029
type: string
40304030
conversationHeartbeatInterval:
40314031
default: 30s
4032-
description: '`conversationHeartbeatInterval` is the time to wait between "tick" events of a conversation'
4032+
description: '`conversationHeartbeatInterval` is the time to wait between "tick" events of a conversation.'
40334033
type: string
40344034
conversationTerminatingTimeout:
40354035
default: 5s
@@ -4041,7 +4041,7 @@ spec:
40414041
type: boolean
40424042
enableKubeProbes:
40434043
default: true
4044-
description: '`enableKubeProbes` is a flag to enable or disable Kubernetes liveness and readiness probes'
4044+
description: '`enableKubeProbes` is a flag to enable or disable Kubernetes liveness and readiness probes.'
40454045
type: boolean
40464046
env:
40474047
additionalProperties:
@@ -4054,7 +4054,7 @@ spec:
40544054
type: object
40554055
healthPort:
40564056
default: 8080
4057-
description: '`healthPort` is a collector HTTP port in the Pod that exposes the health check API'
4057+
description: '`healthPort` is a collector HTTP port in the Pod that exposes the health check API.'
40584058
format: int32
40594059
maximum: 65535
40604060
minimum: 1
@@ -4070,7 +4070,10 @@ spec:
40704070
minimum: 1025
40714071
type: integer
40724072
profilePort:
4073-
description: '`profilePort` allows setting up a Go pprof profiler listening to this port'
4073+
description: |-
4074+
`profilePort` allows setting up a Go pprof profiler listening to this port.
4075+
This is for debugging purpose only. This port should not be exposed, you can
4076+
access it through local port-forwarding.
40744077
format: int32
40754078
maximum: 65535
40764079
minimum: 0

‎docs/FlowCollector.md‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8711,7 +8711,7 @@ This delay is ignored when a FIN packet is collected for TCP flows (see `convers
87118711
<td><b>conversationHeartbeatInterval</b></td>
87128712
<td>string</td>
87138713
<td>
8714-
`conversationHeartbeatInterval` is the time to wait between "tick" events of a conversation<br/>
8714+
`conversationHeartbeatInterval` is the time to wait between "tick" events of a conversation.<br/>
87158715
<br/>
87168716
<i>Default</i>: 30s<br/>
87178717
</td>
@@ -8738,7 +8738,7 @@ This delay is ignored when a FIN packet is collected for TCP flows (see `convers
87388738
<td><b>enableKubeProbes</b></td>
87398739
<td>boolean</td>
87408740
<td>
8741-
`enableKubeProbes` is a flag to enable or disable Kubernetes liveness and readiness probes<br/>
8741+
`enableKubeProbes` is a flag to enable or disable Kubernetes liveness and readiness probes.<br/>
87428742
<br/>
87438743
<i>Default</i>: true<br/>
87448744
</td>
@@ -8757,7 +8757,7 @@ in edge debug or support scenarios.<br/>
87578757
<td><b>healthPort</b></td>
87588758
<td>integer</td>
87598759
<td>
8760-
`healthPort` is a collector HTTP port in the Pod that exposes the health check API<br/>
8760+
`healthPort` is a collector HTTP port in the Pod that exposes the health check API.<br/>
87618761
<br/>
87628762
<i>Format</i>: int32<br/>
87638763
<i>Default</i>: 8080<br/>
@@ -8783,7 +8783,9 @@ By convention, some values are forbidden. It must be greater than 1024 and diffe
87838783
<td><b>profilePort</b></td>
87848784
<td>integer</td>
87858785
<td>
8786-
`profilePort` allows setting up a Go pprof profiler listening to this port<br/>
8786+
`profilePort` allows setting up a Go pprof profiler listening to this port.
8787+
This is for debugging purpose only. This port should not be exposed, you can
8788+
access it through local port-forwarding.<br/>
87878789
<br/>
87888790
<i>Format</i>: int32<br/>
87898791
<i>Minimum</i>: 0<br/>

‎go.mod‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@ require (
77
github.com/coreos/go-semver v0.3.1
88
github.com/google/go-cmp v0.7.0
99
github.com/grafana/loki/operator/apis/loki v0.0.0-20241021105923-5e970e50b166
10-
github.com/netobserv/flowlogs-pipeline v1.11.4-community.0.20260521155724-7ee2fbbc7651
11-
github.com/netobserv/netobserv-ebpf-agent v1.11.3-community.0.20260505134559-24f8cbea14ad
10+
github.com/netobserv/flowlogs-pipeline v1.11.5-community.0.20260625083056-0aefbc7d051e
11+
github.com/netobserv/netobserv-ebpf-agent v1.11.5-community.0.20260625084536-cd2c2a1fa4fb
1212
github.com/onsi/ginkgo/v2 v2.31.0
1313
github.com/onsi/gomega v1.41.0
1414
github.com/openshift/api v0.0.0-20250707164913-2cd5821c9080
@@ -42,7 +42,7 @@ require (
4242
github.com/evanphx/json-patch v5.9.11+incompatible // indirect
4343
github.com/evanphx/json-patch/v5 v5.9.11 // indirect
4444
github.com/felixge/httpsnoop v1.0.4 // indirect
45-
github.com/fsnotify/fsnotify v1.9.0 // indirect
45+
github.com/fsnotify/fsnotify v1.10.1 // indirect
4646
github.com/fxamacker/cbor/v2 v2.9.0 // indirect
4747
github.com/go-logr/logr v1.4.3 // indirect
4848
github.com/go-logr/stdr v1.2.2 // indirect
@@ -69,7 +69,7 @@ require (
6969
github.com/google/gnostic-models v0.7.1 // indirect
7070
github.com/google/pprof v0.0.0-20260402051712-545e8a4df936 // indirect
7171
github.com/google/uuid v1.6.0 // indirect
72-
github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 // indirect
72+
github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect
7373
github.com/inconshreveable/mousetrap v1.1.0 // indirect
7474
github.com/jpillora/backoff v1.0.0 // indirect
7575
github.com/json-iterator/go v1.1.12 // indirect
@@ -87,12 +87,12 @@ require (
8787
github.com/x448/float16 v0.8.4 // indirect
8888
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
8989
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0 // indirect
90-
go.opentelemetry.io/otel v1.43.0 // indirect
91-
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 // indirect
92-
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0 // indirect
93-
go.opentelemetry.io/otel/metric v1.43.0 // indirect
94-
go.opentelemetry.io/otel/sdk v1.43.0 // indirect
95-
go.opentelemetry.io/otel/trace v1.43.0 // indirect
90+
go.opentelemetry.io/otel v1.44.0 // indirect
91+
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0 // indirect
92+
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.44.0 // indirect
93+
go.opentelemetry.io/otel/metric v1.44.0 // indirect
94+
go.opentelemetry.io/otel/sdk v1.44.0 // indirect
95+
go.opentelemetry.io/otel/trace v1.44.0 // indirect
9696
go.opentelemetry.io/proto/otlp v1.10.0 // indirect
9797
go.uber.org/multierr v1.11.0 // indirect
9898
go.yaml.in/yaml/v2 v2.4.4 // indirect
@@ -102,14 +102,14 @@ require (
102102
golang.org/x/net v0.55.0 // indirect
103103
golang.org/x/oauth2 v0.36.0 // indirect
104104
golang.org/x/sync v0.20.0 // indirect
105-
golang.org/x/sys v0.45.0 // indirect
105+
golang.org/x/sys v0.46.0 // indirect
106106
golang.org/x/term v0.43.0 // indirect
107107
golang.org/x/text v0.37.0 // indirect
108108
golang.org/x/time v0.15.0 // indirect
109109
golang.org/x/tools v0.44.0 // indirect
110110
gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect
111-
google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 // indirect
112-
google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 // indirect
111+
google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect
112+
google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect
113113
google.golang.org/grpc v1.81.1 // indirect
114114
google.golang.org/protobuf v1.36.11 // indirect
115115
gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect

0 commit comments

Comments
 (0)