(P)sampling kubernetes network policies#

Speakers: Dumitru Ceara, Nadia Pinaeva, Adrian Moreno, Red Hat, Inc.

Why: "Why was this connection allowed or denied" is the top operational pain point in clusters with thousands of NetworkPolicies — and this talk shows the full cross-stack feature chain (kernel → OVS → OVN → ovn-kubernetes) that solves it at line rate.

What: Live NetworkPolicy visibility via OVN ACL sampling (OVN 24.09: new Sampling_App, Sample_Collector, Sample NB tables; per-ACL sample_new/sample_est). It replaces the OVN drop-debugging design's IPFIX export, which forced every sample through the kernel → ovs-vswitchd path, sharing a netlink socket with upcalls (packet loss) and causing IPFIX-cache contention.

How: The kernel's psample netlink multicast group now ships samples directly to listeners, bypassing ovs-vswitchd entirely; OVS gained a psample datapath action (integrated with sample() and trunc(), cookie support added) plus an OVS 3.4 optimization where the sample action's obs_point can be loaded from packet fields (NXM_NX_CT_LABEL). OVN encodes the observation point into ct_label at connection commit, collapsing the reply-direction sampling from O(number-of-ACLs) flows to exactly two flows regardless of ACL count.

Where applicable: OVN-Kubernetes/OpenShift deployments of any size. Note the psample action is implemented in the kernel datapath (ACL sampling itself works with either IPFIX or psample collectors). The pattern — OVN-generated metadata riding packet samples — is extensible to other observability applications.