Packages:

• flows.netobserv.io/v1beta2

flows.netobserv.io/v1beta2

Resource Types:

• FlowCollector

FlowCollector

^{↩ Parent}

FlowCollector is the schema for the network flows collection API, which pilots and configures the underlying deployments.

Name	Type	Description	Required
apiVersion	string	flows.netobserv.io/v1beta2	true
kind	string	FlowCollector	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the `metadata` field.	true
spec	object	Defines the desired state of the FlowCollector resource.	false
status	object	`FlowCollectorStatus` defines the observed state of FlowCollector	false

FlowCollector.spec

^{↩ Parent}

Defines the desired state of the FlowCollector resource.

Name	Type	Description	Required
agent	object	Agent configuration for flows extraction.	false
consolePlugin	object	`consolePlugin` defines the settings related to the Web Console.	false
deploymentModel	enum	`deploymentModel` defines the desired type of deployment for flow processing. Possible values are: - `Service` (default) to make the flow processor listen as a Kubernetes Service, backed by a scalable Deployment. - `Kafka` to make flows sent to a Kafka pipeline before consumption by the processor. - `Direct` to make the flow processor listen directly from the agents using the host network, backed by a DaemonSet. Only recommended on small clusters, below 15 nodes. Kafka can provide better scalability, resiliency, and high availability (for more details, see https://www.redhat.com/en/topics/integration/what-is-apache-kafka). `Direct` is not recommended on large clusters as it is less memory efficient. Enum: Service, Direct, Kafka Default: Service	false
execution	object	`execution` defines configuration related to the execution of the flow collection process.	false
exporters	[]object	`exporters` defines additional optional exporters for custom consumption or storage.	false
kafka	object	Kafka configuration, allowing to use Kafka as a broker as part of the flow collection pipeline. Available when the `spec.deploymentModel` is `Kafka`.	false
loki	object	`loki`, the flow store, client settings.	false
namespace	string	Namespace where NetObserv pods are deployed. Those pods require various cluster role bindings in order to operate. Those bindings are preinstalled for service accounts located in the default namespace. If you configured a different namespace, you must update (or recreate) the cluster role bindings accordingly. You can see the list of preinstalled bindings here: https://github.com/netobserv/netobserv-operator/blob/main/helm/templates/component_role_bindings.yaml Validations: self == oldSelf: Namespace is immutable. If you need to change it, delete and recreate the resource. Default: netobserv	false
networkPolicy	object	`networkPolicy` defines network policy settings for NetObserv components isolation.	false
processor	object	`processor` defines the settings of the component that receives the flows from the agent, enriches them, generates metrics, and forwards them to the Loki persistence layer and/or any available exporter.	false
prometheus	object	`prometheus` defines Prometheus settings, such as querier configuration used to fetch metrics from the Console plugin.	false

FlowCollector.spec.agent

^{↩ Parent}

Agent configuration for flows extraction.

Name	Type	Description	Required
ebpf	object	`ebpf` describes the settings related to the eBPF-based flow reporter when `spec.agent.type` is set to `eBPF`.	false
ipfix	object	`ipfix` describes the settings related to the IPFIX-based flow reporter when `spec.agent.type` is set to `IPFIX`. Deprecated: only eBPF remains supported.	false
type	enum	type selects the flows tracing agent. Deprecated: Previously, this field allowed to select between eBPF or IPFIX. Only eBPF is allowed now, so this field is deprecated and is planned for removal in a future version of the API. Enum: eBPF, IPFIX Default: eBPF	false

FlowCollector.spec.agent.ebpf

^{↩ Parent}

ebpf describes the settings related to the eBPF-based flow reporter when spec.agent.type is set to eBPF.

Name	Type	Description	Required
advanced	object	`advanced` allows setting some aspects of the internal configuration of the eBPF agent. This section is aimed mostly for debugging and fine-grained performance optimizations, such as `GOGC` and `GOMAXPROCS` environment variables. Set these values at your own risk. You can also override the default Linux capabilities from there.	false
cacheActiveTimeout	string	`cacheActiveTimeout` is the period during which the agent aggregates flows before sending. Increasing `cacheMaxFlows` and `cacheActiveTimeout` can decrease the network traffic overhead and the CPU load, however you can expect higher memory consumption and an increased latency in the flow collection. Default: 15s	false
cacheMaxFlows	integer	`cacheMaxFlows` is the maximum number of flows in an aggregate; when reached, the reporter sends the flows. Increasing `cacheMaxFlows` and `cacheActiveTimeout` can decrease the network traffic overhead and the CPU load, however you can expect higher memory consumption and an increased latency in the flow collection. Format: int32 Default: 120000 Minimum: 1	false
excludeInterfaces	[]string	`excludeInterfaces` contains the interface names that are excluded from flow tracing. An entry enclosed by slashes, such as `/br-/`, is matched as a regular expression. Otherwise it is matched as a case-sensitive string. Default: [lo]	false
features	[]enum	List of additional features to enable. They are all disabled by default. Enabling additional features might have performance impacts. Possible values are: - `PacketDrop`: Enable the packets drop flows logging feature. This feature requires mounting the kernel debug filesystem, so the eBPF agent pods must run as privileged via `spec.agent.ebpf.privileged`. - `DNSTracking`: Enable the DNS tracking feature. - `FlowRTT`: Enable flow latency (sRTT) extraction in the eBPF agent from TCP traffic. - `NetworkEvents`: Enable the network events monitoring feature, such as correlating flows and network policies. This feature requires mounting the kernel debug filesystem, so the eBPF agent pods must run as privileged via `spec.agent.ebpf.privileged`. It requires using the OVN-Kubernetes network plugin with the Observability feature. - `PacketTranslation`: Enable enriching flows with packet translation information, such as Service NAT. - `EbpfManager`: Use eBPF Manager to manage NetObserv eBPF programs. Pre-requisite: the eBPF Manager operator (or upstream bpfman operator) must be installed. - `UDNMapping`: Enable interfaces mapping to User Defined Networks (UDN). This feature requires mounting the kernel debug filesystem, so the eBPF agent pods must run as privileged via `spec.agent.ebpf.privileged`. It requires using the OVN-Kubernetes network plugin. - `IPSec`, to track flows between nodes with IPsec encryption. - `TLSTracking`, to track TLS usage. Enum: PacketDrop, DNSTracking, FlowRTT, NetworkEvents, PacketTranslation, EbpfManager, UDNMapping, IPSec, TLSTracking	false
flowFilter	object	`flowFilter` defines the eBPF agent configuration regarding flow filtering.	false
imagePullPolicy	enum	`imagePullPolicy` is the Kubernetes pull policy for the image defined above Enum: IfNotPresent, Always, Never Default: IfNotPresent	false
interfaces	[]string	`interfaces` contains the interface names from where flows are collected. If empty, the agent fetches all the interfaces in the system, excepting the ones listed in `excludeInterfaces`. An entry enclosed by slashes, such as `/br-/`, is matched as a regular expression. Otherwise it is matched as a case-sensitive string.	false
kafkaBatchSize	integer	`kafkaBatchSize` limits the maximum size of a request in bytes before being sent to a partition. Ignored when not using Kafka. Default: 1MB. Default: 1048576	false
logLevel	enum	`logLevel` defines the log level for the NetObserv eBPF Agent Enum: trace, debug, info, warn, error, fatal, panic Default: info	false
metrics	object	`metrics` defines the eBPF agent configuration regarding metrics.	false
privileged	boolean	Privileged mode for the eBPF Agent container. When set to `true`, the agent is able to capture more traffic, including from secondary interfaces. When ignored or set to `false`, the operator sets granular capabilities (BPF, PERFMON, NET_ADMIN) to the container. Some agent features require the privileged mode, such as packet drops tracking (see `features`) and SR-IOV support.	false
resources	object	`resources` are the compute resources required by this container. For more information, see https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ Default: map[limits:map[memory:800Mi] requests:map[cpu:100m memory:50Mi]]	false
sampling	integer	Sampling interval of the eBPF probe. 100 means one packet on 100 is sent. 0 or 1 means all packets are sampled. Format: int32 Default: 50 Minimum: 0	false

FlowCollector.spec.agent.ebpf.advanced

^{↩ Parent}

advanced allows setting some aspects of the internal configuration of the eBPF agent. This section is aimed mostly for debugging and fine-grained performance optimizations, such as GOGC and GOMAXPROCS environment variables. Set these values at your own risk. You can also override the default Linux capabilities from there.

Name	Type	Description	Required
capOverride	[]string	Linux capabilities override, when not running as privileged. Default capabilities are BPF, PERFMON and NET_ADMIN.	false
env	map[string]string	`env` allows passing custom environment variables to underlying components. Useful for passing some very concrete performance-tuning options, such as `GOGC` and `GOMAXPROCS`, that should not be publicly exposed as part of the FlowCollector descriptor, as they are only useful in edge debug or support scenarios.	false
scheduling	object	scheduling controls how the pods are scheduled on nodes.	false

FlowCollector.spec.agent.ebpf.advanced.scheduling

^{↩ Parent}

scheduling controls how the pods are scheduled on nodes.

Name	Type	Description	Required
affinity	object	If specified, the pod's scheduling constraints. For documentation, refer to https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling.	false
nodeSelector	map[string]string	`nodeSelector` allows scheduling of pods only onto nodes that have each of the specified labels. For documentation, refer to https://kubernetes.io/docs/concepts/configuration/assign-pod-node/.	false
priorityClassName	string	If specified, indicates the pod's priority. For documentation, refer to https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/#how-to-use-priority-and-preemption. If not specified, default priority is used, or zero if there is no default.	false
tolerations	[]object	`tolerations` is a list of tolerations that allow the pod to schedule onto nodes with matching taints. For documentation, refer to https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling.	false

FlowCollector.spec.agent.ebpf.advanced.scheduling.affinity

^{↩ Parent}

If specified, the pod's scheduling constraints. For documentation, refer to https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling.

Name	Type	Description	Required
nodeAffinity	object	Describes node affinity scheduling rules for the pod.	false
podAffinity	object	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).	false
podAntiAffinity	object	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).	false

FlowCollector.spec.agent.ebpf.advanced.scheduling.affinity.nodeAffinity

^{↩ Parent}

Describes node affinity scheduling rules for the pod.

Name	Type	Description	Required
preferredDuringSchedulingIgnoredDuringExecution	[]object	The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred.	false
requiredDuringSchedulingIgnoredDuringExecution	object	If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node.	false

FlowCollector.spec.agent.ebpf.advanced.scheduling.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[index]

^{↩ Parent}

An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).

Name	Type	Description	Required
preference	object	A node selector term, associated with the corresponding weight.	true
weight	integer	Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. Format: int32	true

FlowCollector.spec.agent.ebpf.advanced.scheduling.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].preference

^{↩ Parent}

A node selector term, associated with the corresponding weight.

Name	Type	Description	Required
matchExpressions	[]object	A list of node selector requirements by node's labels.	false
matchFields	[]object	A list of node selector requirements by node's fields.	false

FlowCollector.spec.agent.ebpf.advanced.scheduling.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].preference.matchExpressions[index]

^{↩ Parent}

A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	The label key that the selector applies to.	true
operator	string	Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.	true
values	[]string	An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.	false

FlowCollector.spec.agent.ebpf.advanced.scheduling.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].preference.matchFields[index]

^{↩ Parent}

A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	The label key that the selector applies to.	true
operator	string	Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.	true
values	[]string	An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.	false

FlowCollector.spec.agent.ebpf.advanced.scheduling.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution

^{↩ Parent}

If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node.

Name	Type	Description	Required
nodeSelectorTerms	[]object	Required. A list of node selector terms. The terms are ORed.	true

FlowCollector.spec.agent.ebpf.advanced.scheduling.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[index]

^{↩ Parent}

A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.

Name	Type	Description	Required
matchExpressions	[]object	A list of node selector requirements by node's labels.	false
matchFields	[]object	A list of node selector requirements by node's fields.	false

FlowCollector.spec.agent.ebpf.advanced.scheduling.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[index].matchExpressions[index]

^{↩ Parent}

A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	The label key that the selector applies to.	true
operator	string	Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.	true
values	[]string	An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.	false

FlowCollector.spec.agent.ebpf.advanced.scheduling.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[index].matchFields[index]

^{↩ Parent}

A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	The label key that the selector applies to.	true
operator	string	Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.	true
values	[]string	An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.	false

FlowCollector.spec.agent.ebpf.advanced.scheduling.affinity.podAffinity

^{↩ Parent}

Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).

Name	Type	Description	Required
preferredDuringSchedulingIgnoredDuringExecution	[]object	The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred.	false
requiredDuringSchedulingIgnoredDuringExecution	[]object	If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied.	false

FlowCollector.spec.agent.ebpf.advanced.scheduling.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index]

^{↩ Parent}

The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)

Name	Type	Description	Required
podAffinityTerm	object	Required. A pod affinity term, associated with the corresponding weight.	true
weight	integer	weight associated with matching the corresponding podAffinityTerm, in the range 1-100. Format: int32	true

FlowCollector.spec.agent.ebpf.advanced.scheduling.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm

^{↩ Parent}

Required. A pod affinity term, associated with the corresponding weight.

Name	Type	Description	Required
topologyKey	string	This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.	true
labelSelector	object	A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.	false
matchLabelKeys	[]string	MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set.	false
mismatchLabelKeys	[]string	MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set.	false
namespaceSelector	object	A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.	false
namespaces	[]string	namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace".	false

FlowCollector.spec.agent.ebpf.advanced.scheduling.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.labelSelector

^{↩ Parent}

A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.	false

FlowCollector.spec.agent.ebpf.advanced.scheduling.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.labelSelector.matchExpressions[index]

^{↩ Parent}

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

FlowCollector.spec.agent.ebpf.advanced.scheduling.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.namespaceSelector

^{↩ Parent}

A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.	false

FlowCollector.spec.agent.ebpf.advanced.scheduling.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.namespaceSelector.matchExpressions[index]

^{↩ Parent}

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

FlowCollector.spec.agent.ebpf.advanced.scheduling.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index]

^{↩ Parent}

Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running

Name	Type	Description	Required
topologyKey	string	This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.	true
labelSelector	object	A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.	false
matchLabelKeys	[]string	MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set.	false
mismatchLabelKeys	[]string	MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set.	false
namespaceSelector	object	A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.	false
namespaces	[]string	namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace".	false

FlowCollector.spec.agent.ebpf.advanced.scheduling.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].labelSelector

^{↩ Parent}

A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.	false

FlowCollector.spec.agent.ebpf.advanced.scheduling.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].labelSelector.matchExpressions[index]

^{↩ Parent}

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

FlowCollector.spec.agent.ebpf.advanced.scheduling.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].namespaceSelector

^{↩ Parent}

A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.	false

FlowCollector.spec.agent.ebpf.advanced.scheduling.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].namespaceSelector.matchExpressions[index]

^{↩ Parent}

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

FlowCollector.spec.agent.ebpf.advanced.scheduling.affinity.podAntiAffinity

^{↩ Parent}

Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).

Name	Type	Description	Required
preferredDuringSchedulingIgnoredDuringExecution	[]object	The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and subtracting "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred.	false
requiredDuringSchedulingIgnoredDuringExecution	[]object	If the anti-affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the anti-affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied.	false

FlowCollector.spec.agent.ebpf.advanced.scheduling.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index]

^{↩ Parent}

The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)

Name	Type	Description	Required
podAffinityTerm	object	Required. A pod affinity term, associated with the corresponding weight.	true
weight	integer	weight associated with matching the corresponding podAffinityTerm, in the range 1-100. Format: int32	true

FlowCollector.spec.agent.ebpf.advanced.scheduling.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm

^{↩ Parent}

Required. A pod affinity term, associated with the corresponding weight.

Name	Type	Description	Required
topologyKey	string	This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.	true
labelSelector	object	A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.	false
matchLabelKeys	[]string	MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set.	false
mismatchLabelKeys	[]string	MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set.	false
namespaceSelector	object	A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.	false
namespaces	[]string	namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace".	false

FlowCollector.spec.agent.ebpf.advanced.scheduling.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.labelSelector

^{↩ Parent}

A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.	false

FlowCollector.spec.agent.ebpf.advanced.scheduling.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.labelSelector.matchExpressions[index]

^{↩ Parent}

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

FlowCollector.spec.agent.ebpf.advanced.scheduling.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.namespaceSelector

^{↩ Parent}

A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.	false

FlowCollector.spec.agent.ebpf.advanced.scheduling.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.namespaceSelector.matchExpressions[index]

^{↩ Parent}

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

FlowCollector.spec.agent.ebpf.advanced.scheduling.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index]

^{↩ Parent}

Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running

Name	Type	Description	Required
topologyKey	string	This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.	true
labelSelector	object	A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.	false
matchLabelKeys	[]string	MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set.	false
mismatchLabelKeys	[]string	MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set.	false
namespaceSelector	object	A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.	false
namespaces	[]string	namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace".	false

FlowCollector.spec.agent.ebpf.advanced.scheduling.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].labelSelector

^{↩ Parent}

A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.	false

FlowCollector.spec.agent.ebpf.advanced.scheduling.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].labelSelector.matchExpressions[index]

^{↩ Parent}

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

FlowCollector.spec.agent.ebpf.advanced.scheduling.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].namespaceSelector

^{↩ Parent}

A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.	false

FlowCollector.spec.agent.ebpf.advanced.scheduling.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].namespaceSelector.matchExpressions[index]

^{↩ Parent}

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

FlowCollector.spec.agent.ebpf.advanced.scheduling.tolerations[index]

^{↩ Parent}

The pod this Toleration is attached to tolerates any taint that matches the triple <key,value,effect> using the matching operator .

Name	Type	Description	Required
effect	string	Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.	false
key	string	Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys.	false
operator	string	Operator represents a key's relationship to the value. Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).	false
tolerationSeconds	integer	TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system. Format: int64	false
value	string	Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string.	false

FlowCollector.spec.agent.ebpf.flowFilter

^{↩ Parent}

flowFilter defines the eBPF agent configuration regarding flow filtering.

Name	Type	Description	Required
action	enum	`action` defines the action to perform on the flows that match the filter. The available options are `Accept`, which is the default, and `Reject`. Enum: Accept, Reject	false
cidr	string	`cidr` defines the IP CIDR to filter flows by. Examples: `10.10.10.0/24` or `100:100:100:100::/64`	false
destPorts	int or string	`destPorts` optionally defines the destination ports to filter flows by. To filter a single port, set a single port as an integer value. For example, `destPorts: 80`. To filter a range of ports, use a "start-end" range in string format. For example, `destPorts: "80-100"`. To filter two ports, use a "port1,port2" in string format. For example, `ports: "80,100"`.	false
direction	enum	`direction` optionally defines a direction to filter flows by. The available options are `Ingress` and `Egress`. Enum: Ingress, Egress	false
enable	boolean	Set `enable` to `true` to enable the eBPF flow filtering feature.	false
icmpCode	integer	`icmpCode`, for Internet Control Message Protocol (ICMP) traffic, optionally defines the ICMP code to filter flows by.	false
icmpType	integer	`icmpType`, for ICMP traffic, optionally defines the ICMP type to filter flows by.	false
peerCIDR	string	`peerCIDR` defines the Peer IP CIDR to filter flows by. Examples: `10.10.10.0/24` or `100:100:100:100::/64`	false
peerIP	string	`peerIP` optionally defines the remote IP address to filter flows by. Example: `10.10.10.10`.	false
pktDrops	boolean	`pktDrops` optionally filters only flows containing packet drops.	false
ports	int or string	`ports` optionally defines the ports to filter flows by. It is used both for source and destination ports. To filter a single port, set a single port as an integer value. For example, `ports: 80`. To filter a range of ports, use a "start-end" range in string format. For example, `ports: "80-100"`. To filter two ports, use a "port1,port2" in string format. For example, `ports: "80,100"`.	false
protocol	enum	`protocol` optionally defines a protocol to filter flows by. The available options are `TCP`, `UDP`, `ICMP`, `ICMPv6`, and `SCTP`. Enum: TCP, UDP, ICMP, ICMPv6, SCTP	false
rules	[]object	`rules` defines a list of filtering rules on the eBPF Agents. When filtering is enabled, by default, flows that don't match any rule are rejected. To change the default, you can define a rule that accepts everything: `{ action: "Accept", cidr: "0.0.0.0/0" }`, and then refine with rejecting rules.	false
sampling	integer	`sampling` is the sampling interval for the matched packets, overriding the global sampling defined at `spec.agent.ebpf.sampling`. Format: int32	false
sourcePorts	int or string	`sourcePorts` optionally defines the source ports to filter flows by. To filter a single port, set a single port as an integer value. For example, `sourcePorts: 80`. To filter a range of ports, use a "start-end" range in string format. For example, `sourcePorts: "80-100"`. To filter two ports, use a "port1,port2" in string format. For example, `ports: "80,100"`.	false
tcpFlags	enum	`tcpFlags` optionally defines TCP flags to filter flows by. In addition to the standard flags (RFC-9293), you can also filter by one of the three following combinations: `SYN-ACK`, `FIN-ACK`, and `RST-ACK`. Enum: SYN, SYN-ACK, ACK, FIN, RST, URG, ECE, CWR, FIN-ACK, RST-ACK	false

FlowCollector.spec.agent.ebpf.flowFilter.rules[index]

^{↩ Parent}

EBPFFlowFilterRule defines the desired eBPF agent configuration regarding flow filtering rule.

Name	Type	Description	Required
action	enum	`action` defines the action to perform on the flows that match the filter. The available options are `Accept`, which is the default, and `Reject`. Enum: Accept, Reject	false
cidr	string	`cidr` defines the IP CIDR to filter flows by. Examples: `10.10.10.0/24` or `100:100:100:100::/64`	false
destPorts	int or string	`destPorts` optionally defines the destination ports to filter flows by. To filter a single port, set a single port as an integer value. For example, `destPorts: 80`. To filter a range of ports, use a "start-end" range in string format. For example, `destPorts: "80-100"`. To filter two ports, use a "port1,port2" in string format. For example, `ports: "80,100"`.	false
direction	enum	`direction` optionally defines a direction to filter flows by. The available options are `Ingress` and `Egress`. Enum: Ingress, Egress	false
icmpCode	integer	`icmpCode`, for Internet Control Message Protocol (ICMP) traffic, optionally defines the ICMP code to filter flows by.	false
icmpType	integer	`icmpType`, for ICMP traffic, optionally defines the ICMP type to filter flows by.	false
peerCIDR	string	`peerCIDR` defines the Peer IP CIDR to filter flows by. Examples: `10.10.10.0/24` or `100:100:100:100::/64`	false
peerIP	string	`peerIP` optionally defines the remote IP address to filter flows by. Example: `10.10.10.10`.	false
pktDrops	boolean	`pktDrops` optionally filters only flows containing packet drops.	false
ports	int or string	`ports` optionally defines the ports to filter flows by. It is used both for source and destination ports. To filter a single port, set a single port as an integer value. For example, `ports: 80`. To filter a range of ports, use a "start-end" range in string format. For example, `ports: "80-100"`. To filter two ports, use a "port1,port2" in string format. For example, `ports: "80,100"`.	false
protocol	enum	`protocol` optionally defines a protocol to filter flows by. The available options are `TCP`, `UDP`, `ICMP`, `ICMPv6`, and `SCTP`. Enum: TCP, UDP, ICMP, ICMPv6, SCTP	false
sampling	integer	`sampling` is the sampling interval for the matched packets, overriding the global sampling defined at `spec.agent.ebpf.sampling`. Format: int32	false
sourcePorts	int or string	`sourcePorts` optionally defines the source ports to filter flows by. To filter a single port, set a single port as an integer value. For example, `sourcePorts: 80`. To filter a range of ports, use a "start-end" range in string format. For example, `sourcePorts: "80-100"`. To filter two ports, use a "port1,port2" in string format. For example, `ports: "80,100"`.	false
tcpFlags	enum	`tcpFlags` optionally defines TCP flags to filter flows by. In addition to the standard flags (RFC-9293), you can also filter by one of the three following combinations: `SYN-ACK`, `FIN-ACK`, and `RST-ACK`. Enum: SYN, SYN-ACK, ACK, FIN, RST, URG, ECE, CWR, FIN-ACK, RST-ACK	false

FlowCollector.spec.agent.ebpf.metrics

^{↩ Parent}

metrics defines the eBPF agent configuration regarding metrics.

Name	Type	Description	Required
disableAlerts	[]enum	`disableAlerts` is a list of alerts that should be disabled. Possible values are: `NetObservDroppedFlows`, which is triggered when the eBPF agent is missing packets or flows, such as when the BPF hashmap is busy or full, or the capacity limiter is being triggered. Enum: NetObservDroppedFlows	false
enable	boolean	Set `enable` to `false` to disable eBPF agent metrics collection. It is enabled by default.	false
server	object	Metrics server endpoint configuration for the Prometheus scraper.	false

FlowCollector.spec.agent.ebpf.metrics.server

^{↩ Parent}

Metrics server endpoint configuration for the Prometheus scraper.

Name	Type	Description	Required
port	integer	The metrics server HTTP port. Format: int32 Minimum: 1 Maximum: 65535	false
scrapeInterval	string	Prometheus scraping interval, how often metrics are pulled. Format: duration	false
tls	object	TLS configuration.	false

FlowCollector.spec.agent.ebpf.metrics.server.tls

^{↩ Parent}

TLS configuration.

Name	Type	Description	Required
type	enum	Select the type of TLS configuration: - `Disabled` (default) to not configure TLS for the endpoint. - `Provided` to manually provide cert file and a key file. - `Auto` to use a default certificate, which may vary depending on the Kubernetes vendor. Refer to https://github.com/netobserv/netobserv-operator/blob/main/docs/TLS.md for more information. Enum: Disabled, Provided, Auto Default: Disabled	true
insecureSkipVerify	boolean	`insecureSkipVerify` allows skipping client-side verification of the provided certificate. If set to `true`, the `providedCaFile` field is ignored. For security, this should not be used other than for testing or demo. Default: false	false
provided	object	TLS configuration when `type` is set to `Provided`.	false
providedCaFile	object	Reference to the CA file when `type` is set to `Provided`.	false

FlowCollector.spec.agent.ebpf.metrics.server.tls.provided

^{↩ Parent}

TLS configuration when type is set to Provided.

Name	Type	Description	Required
certFile	string	`certFile` defines the path to the certificate file name within the config map or secret.	false
certKey	string	`certKey` defines the path to the certificate private key file name within the config map or secret. Omit when the key is not necessary.	false
name	string	Name of the config map or secret containing certificates.	false
namespace	string	Namespace of the config map or secret containing certificates. If omitted, the default is to use the same namespace as where NetObserv is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. Default:	false
type	enum	Type for the certificate reference: `configmap` or `secret`. Enum: configmap, secret	false

FlowCollector.spec.agent.ebpf.metrics.server.tls.providedCaFile

^{↩ Parent}

Reference to the CA file when type is set to Provided.

Name	Type	Description	Required
file	string	File name within the config map or secret.	false
name	string	Name of the config map or secret containing the file.	false
namespace	string	Namespace of the config map or secret containing the file. If omitted, the default is to use the same namespace as where NetObserv is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. Default:	false
type	enum	Type for the file reference: `configmap` or `secret`. Enum: configmap, secret	false

FlowCollector.spec.agent.ebpf.resources

^{↩ Parent}

resources are the compute resources required by this container. For more information, see https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/

Name	Type	Description	Required
claims	[]object	Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container. This field depends on the DynamicResourceAllocation feature gate. This field is immutable. It can only be set for containers.	false
limits	map[string]int or string	Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/	false
requests	map[string]int or string	Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. Requests cannot exceed Limits. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/	false

FlowCollector.spec.agent.ebpf.resources.claims[index]

^{↩ Parent}

ResourceClaim references one entry in PodSpec.ResourceClaims.

Name	Type	Description	Required
name	string	Name must match the name of one entry in pod.spec.resourceClaims of the Pod where this field is used. It makes that resource available inside a container.	true
request	string	Request is the name chosen for a request in the referenced claim. If empty, everything from the claim is made available, otherwise only the result of this request.	false

FlowCollector.spec.agent.ipfix

^{↩ Parent}

ipfix describes the settings related to the IPFIX-based flow reporter when spec.agent.type is set to IPFIX.

Deprecated: only eBPF remains supported.

Name	Type	Description	Required
cacheActiveTimeout	string	`cacheActiveTimeout` is the max period during which the reporter aggregates flows before sending. Default: 20s	false
cacheMaxFlows	integer	`cacheMaxFlows` is the max number of flows in an aggregate; when reached, the reporter sends the flows. Format: int32 Default: 400 Minimum: 0	false
clusterNetworkOperator	object	`clusterNetworkOperator` defines the settings related to the Cluster Network Operator, when available.	false
forceSampleAll	boolean	`forceSampleAll` allows disabling sampling in the IPFIX-based flow reporter. It is not recommended to sample all the traffic with IPFIX, as it might generate cluster instability. If you REALLY want to do that, set this flag to `true`. Use at your own risk. When it is set to `true`, the value of `sampling` is ignored. Default: false	false
ovnKubernetes	object	`ovnKubernetes` defines the settings of the OVN-Kubernetes network plugin, when available. This configuration is used when using upstream OVN's IPFIX exports.	false
sampling	integer	`sampling` is the sampling interval on the reporter. 100 means one flow on 100 is sent. To ensure cluster stability, it is not possible to set a value below 2. If you really want to sample every packet, which might impact the cluster stability, refer to `forceSampleAll`. Alternatively, you can use the eBPF Agent instead of IPFIX. Format: int32 Default: 400 Minimum: 2	false

FlowCollector.spec.agent.ipfix.clusterNetworkOperator

^{↩ Parent}

clusterNetworkOperator defines the settings related to the Cluster Network Operator, when available.

Name	Type	Description	Required
namespace	string	Namespace where the config map is going to be deployed.	false

FlowCollector.spec.agent.ipfix.ovnKubernetes

^{↩ Parent}

ovnKubernetes defines the settings of the OVN-Kubernetes network plugin, when available. This configuration is used when using upstream OVN's IPFIX exports.

Name	Type	Description	Required
containerName	string	`containerName` defines the name of the container to configure for IPFIX. Default: ovnkube-node	false
daemonSetName	string	`daemonSetName` defines the name of the DaemonSet controlling the OVN-Kubernetes pods. Default: ovnkube-node	false
namespace	string	Namespace where OVN-Kubernetes pods are deployed. Default: ovn-kubernetes	false

FlowCollector.spec.consolePlugin

^{↩ Parent}

consolePlugin defines the settings related to the Web Console.

Name	Type	Description	Required
advanced	object	`advanced` allows setting some aspects of the internal configuration of the console plugin. This section is aimed mostly for debugging and fine-grained performance optimizations, such as `GOGC` and `GOMAXPROCS` environment variables. Set these values at your own risk.	false
autoscaler	object	`autoscaler`: spec of a horizontal pod autoscaler to set up for the web console Deployment. Deprecated: managed autoscaler will be removed in a future version. You may configure instead an autoscaler of your choice, and set spec.consolePlugin.unmanagedReplicas to true.	false
enable	boolean	Enables the console plugin deployment. Default: true	false
imagePullPolicy	enum	imagePullPolicy is the Kubernetes pull policy for the image defined above. Enum: IfNotPresent, Always, Never Default: IfNotPresent	false
logLevel	enum	logLevel for the web console backend. Enum: trace, debug, info, warn, error, fatal, panic Default: info	false
portNaming	object	portNaming defines the configuration of the port-to-service name translation. Default: map[enable:true]	false
quickFilters	[]object	quickFilters configures quick filter presets for the web console. Filters for external traffic assume the subnet labels are configured to distinguish internal and external traffic (see spec.processor.subnetLabels). Default: [map[default:true filter:map[flow_layer:"app"] name:Applications] map[filter:map[flow_layer:"infra"] name:Infrastructure] map[default:true filter:map[dst_kind:"Pod" src_kind:"Pod"] name:Pods network] map[filter:map[dst_kind:"Service"] name:Services network] map[filter:map[src_subnet_label:"",EXT:] name:External ingress] map[filter:map[dst_subnet_label:"",EXT:] name:External egress]]	false
replicas	integer	replicas defines the number of replicas (pods) to start. Format: int32 Default: 1 Minimum: 0	false
resources	object	resources, in terms of compute resources, required by this container. For more information, see https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/. Default: map[limits:map[memory:100Mi] requests:map[cpu:100m memory:50Mi]]	false
standalone	boolean	Deploy as a standalone console. Supported vendors may use a plugin system instead.	false
unmanagedReplicas	boolean	If unmanagedReplicas is true, the operator will not reconcile replicas. This is useful when using a pod autoscaler.	false

FlowCollector.spec.consolePlugin.advanced

^{↩ Parent}

advanced allows setting some aspects of the internal configuration of the console plugin. This section is aimed mostly for debugging and fine-grained performance optimizations, such as GOGC and GOMAXPROCS environment variables. Set these values at your own risk.

Name	Type	Description	Required
args	[]string	`args` allows passing custom arguments to underlying components. Useful for overriding some parameters, such as a URL or a configuration path, that should not be publicly exposed as part of the FlowCollector descriptor, as they are only useful in edge debug or support scenarios.	false
env	map[string]string	`env` allows passing custom environment variables to underlying components. Useful for passing some very concrete performance-tuning options, such as `GOGC` and `GOMAXPROCS`, that should not be publicly exposed as part of the FlowCollector descriptor, as they are only useful in edge debug or support scenarios.	false
port	integer	`port` is the plugin service port. Do not use 9002, which is reserved for metrics. Format: int32 Default: 9001 Minimum: 1 Maximum: 65535	false
register	boolean	`register` allows, when set to `true`, to automatically register the console plugin when possible, depending on the vendor. It requires `spec.consolePlugin.standalone` to be `false`. Default: true	false
scheduling	object	`scheduling` controls how the pods are scheduled on nodes.	false

FlowCollector.spec.consolePlugin.advanced.scheduling

^{↩ Parent}

scheduling controls how the pods are scheduled on nodes.

Name	Type	Description	Required
affinity	object	If specified, the pod's scheduling constraints. For documentation, refer to https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling.	false
nodeSelector	map[string]string	`nodeSelector` allows scheduling of pods only onto nodes that have each of the specified labels. For documentation, refer to https://kubernetes.io/docs/concepts/configuration/assign-pod-node/.	false
priorityClassName	string	If specified, indicates the pod's priority. For documentation, refer to https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/#how-to-use-priority-and-preemption. If not specified, default priority is used, or zero if there is no default.	false
tolerations	[]object	`tolerations` is a list of tolerations that allow the pod to schedule onto nodes with matching taints. For documentation, refer to https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling.	false

FlowCollector.spec.consolePlugin.advanced.scheduling.affinity

^{↩ Parent}

If specified, the pod's scheduling constraints. For documentation, refer to https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling.

Name	Type	Description	Required
nodeAffinity	object	Describes node affinity scheduling rules for the pod.	false
podAffinity	object	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).	false
podAntiAffinity	object	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).	false

FlowCollector.spec.consolePlugin.advanced.scheduling.affinity.nodeAffinity

^{↩ Parent}

Describes node affinity scheduling rules for the pod.

Name	Type	Description	Required
preferredDuringSchedulingIgnoredDuringExecution	[]object	The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred.	false
requiredDuringSchedulingIgnoredDuringExecution	object	If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node.	false

FlowCollector.spec.consolePlugin.advanced.scheduling.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[index]

^{↩ Parent}

An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).

Name	Type	Description	Required
preference	object	A node selector term, associated with the corresponding weight.	true
weight	integer	Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. Format: int32	true

FlowCollector.spec.consolePlugin.advanced.scheduling.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].preference

^{↩ Parent}

A node selector term, associated with the corresponding weight.

Name	Type	Description	Required
matchExpressions	[]object	A list of node selector requirements by node's labels.	false
matchFields	[]object	A list of node selector requirements by node's fields.	false

FlowCollector.spec.consolePlugin.advanced.scheduling.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].preference.matchExpressions[index]

^{↩ Parent}

A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	The label key that the selector applies to.	true
operator	string	Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.	true
values	[]string	An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.	false

FlowCollector.spec.consolePlugin.advanced.scheduling.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].preference.matchFields[index]

^{↩ Parent}

A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	The label key that the selector applies to.	true
operator	string	Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.	true
values	[]string	An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.	false

FlowCollector.spec.consolePlugin.advanced.scheduling.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution

^{↩ Parent}

If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node.

Name	Type	Description	Required
nodeSelectorTerms	[]object	Required. A list of node selector terms. The terms are ORed.	true

FlowCollector.spec.consolePlugin.advanced.scheduling.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[index]

^{↩ Parent}

A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.

Name	Type	Description	Required
matchExpressions	[]object	A list of node selector requirements by node's labels.	false
matchFields	[]object	A list of node selector requirements by node's fields.	false

FlowCollector.spec.consolePlugin.advanced.scheduling.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[index].matchExpressions[index]

^{↩ Parent}

A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	The label key that the selector applies to.	true
operator	string	Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.	true
values	[]string	An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.	false

FlowCollector.spec.consolePlugin.advanced.scheduling.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[index].matchFields[index]

^{↩ Parent}

A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	The label key that the selector applies to.	true
operator	string	Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.	true
values	[]string	An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.	false

FlowCollector.spec.consolePlugin.advanced.scheduling.affinity.podAffinity

^{↩ Parent}

Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).

Name	Type	Description	Required
preferredDuringSchedulingIgnoredDuringExecution	[]object	The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred.	false
requiredDuringSchedulingIgnoredDuringExecution	[]object	If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied.	false

FlowCollector.spec.consolePlugin.advanced.scheduling.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index]

^{↩ Parent}

The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)

Name	Type	Description	Required
podAffinityTerm	object	Required. A pod affinity term, associated with the corresponding weight.	true
weight	integer	weight associated with matching the corresponding podAffinityTerm, in the range 1-100. Format: int32	true

FlowCollector.spec.consolePlugin.advanced.scheduling.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm

^{↩ Parent}

Required. A pod affinity term, associated with the corresponding weight.

Name	Type	Description	Required
topologyKey	string	This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.	true
labelSelector	object	A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.	false
matchLabelKeys	[]string	MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set.	false
mismatchLabelKeys	[]string	MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set.	false
namespaceSelector	object	A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.	false
namespaces	[]string	namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace".	false

FlowCollector.spec.consolePlugin.advanced.scheduling.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.labelSelector

^{↩ Parent}

A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.	false

FlowCollector.spec.consolePlugin.advanced.scheduling.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.labelSelector.matchExpressions[index]

^{↩ Parent}

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

FlowCollector.spec.consolePlugin.advanced.scheduling.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.namespaceSelector

^{↩ Parent}

A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.	false

FlowCollector.spec.consolePlugin.advanced.scheduling.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.namespaceSelector.matchExpressions[index]

^{↩ Parent}

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

FlowCollector.spec.consolePlugin.advanced.scheduling.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index]

^{↩ Parent}

Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running

Name	Type	Description	Required
topologyKey	string	This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.	true
labelSelector	object	A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.	false
matchLabelKeys	[]string	MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set.	false
mismatchLabelKeys	[]string	MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set.	false
namespaceSelector	object	A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.	false
namespaces	[]string	namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace".	false

FlowCollector.spec.consolePlugin.advanced.scheduling.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].labelSelector

^{↩ Parent}

A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.	false

FlowCollector.spec.consolePlugin.advanced.scheduling.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].labelSelector.matchExpressions[index]

^{↩ Parent}

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

FlowCollector.spec.consolePlugin.advanced.scheduling.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].namespaceSelector

^{↩ Parent}

A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.	false

FlowCollector.spec.consolePlugin.advanced.scheduling.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].namespaceSelector.matchExpressions[index]

^{↩ Parent}

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

FlowCollector.spec.consolePlugin.advanced.scheduling.affinity.podAntiAffinity

^{↩ Parent}

Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).

Name	Type	Description	Required
preferredDuringSchedulingIgnoredDuringExecution	[]object	The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and subtracting "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred.	false
requiredDuringSchedulingIgnoredDuringExecution	[]object	If the anti-affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the anti-affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied.	false

FlowCollector.spec.consolePlugin.advanced.scheduling.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index]

^{↩ Parent}

The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)

Name	Type	Description	Required
podAffinityTerm	object	Required. A pod affinity term, associated with the corresponding weight.	true
weight	integer	weight associated with matching the corresponding podAffinityTerm, in the range 1-100. Format: int32	true

FlowCollector.spec.consolePlugin.advanced.scheduling.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm

^{↩ Parent}

Required. A pod affinity term, associated with the corresponding weight.

Name	Type	Description	Required
topologyKey	string	This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.	true
labelSelector	object	A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.	false
matchLabelKeys	[]string	MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set.	false
mismatchLabelKeys	[]string	MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set.	false
namespaceSelector	object	A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.	false
namespaces	[]string	namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace".	false

FlowCollector.spec.consolePlugin.advanced.scheduling.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.labelSelector

^{↩ Parent}

A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.	false

FlowCollector.spec.consolePlugin.advanced.scheduling.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.labelSelector.matchExpressions[index]

^{↩ Parent}

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

FlowCollector.spec.consolePlugin.advanced.scheduling.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.namespaceSelector

^{↩ Parent}

A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.	false

FlowCollector.spec.consolePlugin.advanced.scheduling.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.namespaceSelector.matchExpressions[index]

^{↩ Parent}

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

FlowCollector.spec.consolePlugin.advanced.scheduling.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index]

^{↩ Parent}

Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running

Name	Type	Description	Required
topologyKey	string	This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.	true
labelSelector	object	A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.	false
matchLabelKeys	[]string	MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set.	false
mismatchLabelKeys	[]string	MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set.	false
namespaceSelector	object	A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.	false
namespaces	[]string	namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace".	false

FlowCollector.spec.consolePlugin.advanced.scheduling.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].labelSelector

^{↩ Parent}

A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.	false

FlowCollector.spec.consolePlugin.advanced.scheduling.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].labelSelector.matchExpressions[index]

^{↩ Parent}

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

FlowCollector.spec.consolePlugin.advanced.scheduling.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].namespaceSelector

^{↩ Parent}

A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.	false

FlowCollector.spec.consolePlugin.advanced.scheduling.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].namespaceSelector.matchExpressions[index]

^{↩ Parent}

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

FlowCollector.spec.consolePlugin.advanced.scheduling.tolerations[index]

^{↩ Parent}

The pod this Toleration is attached to tolerates any taint that matches the triple <key,value,effect> using the matching operator .

Name	Type	Description	Required
effect	string	Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.	false
key	string	Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys.	false
operator	string	Operator represents a key's relationship to the value. Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).	false
tolerationSeconds	integer	TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system. Format: int64	false
value	string	Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string.	false

FlowCollector.spec.consolePlugin.autoscaler

^{↩ Parent}

autoscaler: spec of a horizontal pod autoscaler to set up for the web console Deployment.

Deprecated: managed autoscaler will be removed in a future version. You may configure instead an autoscaler of your choice, and set spec.consolePlugin.unmanagedReplicas to true.

Name	Type	Description	Required
maxReplicas	integer	`maxReplicas` is the upper limit for the number of pods that can be set by the autoscaler; cannot be smaller than MinReplicas. Format: int32 Default: 3	false
metrics	[]object	Metrics used by the pod autoscaler. For documentation, refer to https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/horizontal-pod-autoscaler-v2/	false
minReplicas	integer	`minReplicas` is the lower limit for the number of replicas to which the autoscaler can scale down. It defaults to 1 pod. minReplicas is allowed to be 0 if the alpha feature gate HPAScaleToZero is enabled and at least one Object or External metric is configured. Scaling is active as long as at least one metric value is available. Format: int32	false
status	enum	`status` describes the desired status regarding deploying an horizontal pod autoscaler. - `Disabled` does not deploy an horizontal pod autoscaler. - `Enabled` deploys an horizontal pod autoscaler. Enum: Disabled, Enabled Default: Disabled	false

FlowCollector.spec.consolePlugin.autoscaler.metrics[index]

^{↩ Parent}

Name	Type	Description	Required
type	string		true
containerResource	object		false
external	object		false
object	object		false
pods	object		false
resource	object		false

FlowCollector.spec.consolePlugin.autoscaler.metrics[index].containerResource

^{↩ Parent}

Name	Type	Description	Required
container	string		true
name	string		true
target	object		true

FlowCollector.spec.consolePlugin.autoscaler.metrics[index].containerResource.target

^{↩ Parent}

Name	Type	Description	Required
type	string		true
averageUtilization	integer	Format: int32	false
averageValue	int or string		false
value	int or string		false

FlowCollector.spec.consolePlugin.autoscaler.metrics[index].external

^{↩ Parent}

Name	Type	Description	Required
metric	object		true
target	object		true

FlowCollector.spec.consolePlugin.autoscaler.metrics[index].external.metric

^{↩ Parent}

Name	Type	Description	Required
name	string		true
selector	object		false

FlowCollector.spec.consolePlugin.autoscaler.metrics[index].external.metric.selector

^{↩ Parent}

Name	Type	Description	Required
matchExpressions	[]object		false
matchLabels	map[string]string		false

FlowCollector.spec.consolePlugin.autoscaler.metrics[index].external.metric.selector.matchExpressions[index]

^{↩ Parent}

Name	Type	Description	Required
key	string		true
operator	string		true
values	[]string		false

FlowCollector.spec.consolePlugin.autoscaler.metrics[index].external.target

^{↩ Parent}

Name	Type	Description	Required
type	string		true
averageUtilization	integer	Format: int32	false
averageValue	int or string		false
value	int or string		false

FlowCollector.spec.consolePlugin.autoscaler.metrics[index].object

^{↩ Parent}

Name	Type	Description	Required
describedObject	object		true
metric	object		true
target	object		true

FlowCollector.spec.consolePlugin.autoscaler.metrics[index].object.describedObject

^{↩ Parent}

Name	Type	Description	Required
kind	string		true
name	string		true
apiVersion	string		false

FlowCollector.spec.consolePlugin.autoscaler.metrics[index].object.metric

^{↩ Parent}

Name	Type	Description	Required
name	string		true
selector	object		false

FlowCollector.spec.consolePlugin.autoscaler.metrics[index].object.metric.selector

^{↩ Parent}

Name	Type	Description	Required
matchExpressions	[]object		false
matchLabels	map[string]string		false

FlowCollector.spec.consolePlugin.autoscaler.metrics[index].object.metric.selector.matchExpressions[index]

^{↩ Parent}

Name	Type	Description	Required
key	string		true
operator	string		true
values	[]string		false

FlowCollector.spec.consolePlugin.autoscaler.metrics[index].object.target

^{↩ Parent}

Name	Type	Description	Required
type	string		true
averageUtilization	integer	Format: int32	false
averageValue	int or string		false
value	int or string		false

FlowCollector.spec.consolePlugin.autoscaler.metrics[index].pods

^{↩ Parent}

Name	Type	Description	Required
metric	object		true
target	object		true

FlowCollector.spec.consolePlugin.autoscaler.metrics[index].pods.metric

^{↩ Parent}

Name	Type	Description	Required
name	string		true
selector	object		false

FlowCollector.spec.consolePlugin.autoscaler.metrics[index].pods.metric.selector

^{↩ Parent}

Name	Type	Description	Required
matchExpressions	[]object		false
matchLabels	map[string]string		false

FlowCollector.spec.consolePlugin.autoscaler.metrics[index].pods.metric.selector.matchExpressions[index]

^{↩ Parent}

Name	Type	Description	Required
key	string		true
operator	string		true
values	[]string		false

FlowCollector.spec.consolePlugin.autoscaler.metrics[index].pods.target

^{↩ Parent}

Name	Type	Description	Required
type	string		true
averageUtilization	integer	Format: int32	false
averageValue	int or string		false
value	int or string		false

FlowCollector.spec.consolePlugin.autoscaler.metrics[index].resource

^{↩ Parent}

Name	Type	Description	Required
name	string		true
target	object		true

FlowCollector.spec.consolePlugin.autoscaler.metrics[index].resource.target

^{↩ Parent}

Name	Type	Description	Required
type	string		true
averageUtilization	integer	Format: int32	false
averageValue	int or string		false
value	int or string		false

FlowCollector.spec.consolePlugin.portNaming

^{↩ Parent}

portNaming defines the configuration of the port-to-service name translation.

Name	Type	Description	Required
enable	boolean	Enable the console plugin port-to-service name translation Default: true	false
portNames	map[string]string	`portNames` defines additional port names to use in the console, for example, `portNames: {"3100": "loki"}`.	false

FlowCollector.spec.consolePlugin.quickFilters[index]

^{↩ Parent}

QuickFilter defines preset configuration for Console's quick filters

Name	Type	Description	Required
filter	map[string]string	`filter` is a set of keys and values to be set when this filter is selected. Each key can relate to a list of values using a coma-separated string, for example, `filter: {"src_namespace": "namespace1,namespace2"}`.	true
name	string	Name of the filter, that is displayed in the Console	true
default	boolean	`default` defines whether this filter should be active by default or not	false

FlowCollector.spec.consolePlugin.resources

^{↩ Parent}

resources, in terms of compute resources, required by this container. For more information, see https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/.

Name	Type	Description	Required
claims	[]object	Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container. This field depends on the DynamicResourceAllocation feature gate. This field is immutable. It can only be set for containers.	false
limits	map[string]int or string	Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/	false
requests	map[string]int or string	Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. Requests cannot exceed Limits. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/	false

FlowCollector.spec.consolePlugin.resources.claims[index]

^{↩ Parent}

ResourceClaim references one entry in PodSpec.ResourceClaims.

Name	Type	Description	Required
name	string	Name must match the name of one entry in pod.spec.resourceClaims of the Pod where this field is used. It makes that resource available inside a container.	true
request	string	Request is the name chosen for a request in the referenced claim. If empty, everything from the claim is made available, otherwise only the result of this request.	false

FlowCollector.spec.execution

^{↩ Parent}

execution defines configuration related to the execution of the flow collection process.

Name	Type	Description	Required
mode	enum	`mode` is the flow collection process execution desired mode: `Running` or `OnHold`. When `OnHold`, the operator deletes all managed services and workloads, with the exception of the static console plugin, and the operator itself. It allows to use minimal cluster resources without losing configuration. Enum: , Running, OnHold Default: Running	false

FlowCollector.spec.exporters[index]

^{↩ Parent}

FlowCollectorExporter defines an additional exporter to send enriched flows to.

Name	Type	Description	Required
type	enum	`type` selects the type of exporters. The available options are `Kafka`, `IPFIX`, and `OpenTelemetry`. Enum: Kafka, IPFIX, OpenTelemetry	true
ipfix	object	IPFIX configuration, such as the IP address and port to send enriched IPFIX flows to.	false
kafka	object	Kafka configuration, such as the address and topic, to send enriched flows to.	false
openTelemetry	object	OpenTelemetry configuration, such as the IP address and port to send enriched logs or metrics to.	false

FlowCollector.spec.exporters[index].ipfix

^{↩ Parent}

IPFIX configuration, such as the IP address and port to send enriched IPFIX flows to.

Name	Type	Description	Required
enterpriseID	integer	EnterpriseID, or Private Enterprise Number (PEN). To date, NetObserv does not own an assigned number, so it is left open for configuration. The PEN is needed to collect non standard data, such as Kubernetes names, RTT, etc. Default: 2	true
targetHost	string	Address of the IPFIX external receiver. Default:	true
targetPort	integer	Port for the IPFIX external receiver. Default: 4739	true
transport	enum	Transport protocol (`TCP` or `UDP`) to be used for the IPFIX connection, defaults to `TCP`. Enum: TCP, UDP	false

FlowCollector.spec.exporters[index].kafka

^{↩ Parent}

Kafka configuration, such as the address and topic, to send enriched flows to.

Name	Type	Description	Required
address	string	Address of the Kafka server Default:	true
topic	string	Kafka topic to use. It must exist. NetObserv does not create it. Default:	true
compression	enum	Compression codec to use when producing messages to Kafka. Accepted values are: `none` (default), `gzip`, `snappy`, `lz4`, `zstd`. Enum: none, gzip, snappy, lz4, zstd Default: none	false
sasl	object	SASL authentication configuration.	false
tls	object	TLS and mTLS client configuration. When using TLS, verify that the address matches the Kafka port used for TLS, generally 9093. We recommend the use of mTLS for higher security standards. When configuring TLS, the operator watches the certificate secret and copies it to both the netobserv and netobserv-privileged namespaces. In order to do so, you must grant it permissions to the `netobserv-secret-watcher` and `netobserv-secret-creator` roles in the corresponding namespaces. Refer to the Kafka configuration documentation for more information.	false

FlowCollector.spec.exporters[index].kafka.sasl

^{↩ Parent}

SASL authentication configuration.

Name	Type	Description	Required
clientIDReference	object	Reference to the secret or config map containing the client ID	false
clientSecretReference	object	Reference to the secret or config map containing the client secret	false
type	enum	Type of SASL authentication to use, or `Disabled` if SASL is not used Enum: Disabled, Plain, ScramSHA512 Default: Disabled	false

FlowCollector.spec.exporters[index].kafka.sasl.clientIDReference

^{↩ Parent}

Reference to the secret or config map containing the client ID

Name	Type	Description	Required
file	string	File name within the config map or secret.	false
name	string	Name of the config map or secret containing the file.	false
namespace	string	Namespace of the config map or secret containing the file. If omitted, the default is to use the same namespace as where NetObserv is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. Default:	false
type	enum	Type for the file reference: `configmap` or `secret`. Enum: configmap, secret	false

FlowCollector.spec.exporters[index].kafka.sasl.clientSecretReference

^{↩ Parent}

Reference to the secret or config map containing the client secret

Name	Type	Description	Required
file	string	File name within the config map or secret.	false
name	string	Name of the config map or secret containing the file.	false
namespace	string	Namespace of the config map or secret containing the file. If omitted, the default is to use the same namespace as where NetObserv is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. Default:	false
type	enum	Type for the file reference: `configmap` or `secret`. Enum: configmap, secret	false

FlowCollector.spec.exporters[index].kafka.tls

^{↩ Parent}

TLS and mTLS client configuration. When using TLS, verify that the address matches the Kafka port used for TLS, generally 9093. We recommend the use of mTLS for higher security standards. When configuring TLS, the operator watches the certificate secret and copies it to both the netobserv and netobserv-privileged namespaces. In order to do so, you must grant it permissions to the netobserv-secret-watcher and netobserv-secret-creator roles in the corresponding namespaces. Refer to the Kafka configuration documentation for more information.

Name	Type	Description	Required
caCert	object	`caCert` defines the reference of the certificate for the Certificate Authority.	false
enable	boolean	Enable TLS Default: false	false
insecureSkipVerify	boolean	`insecureSkipVerify` allows skipping client-side verification of the server certificate. If set to `true`, the `caCert` field is ignored. For security, this should not be used other than for testing or demo. Default: false	false
userCert	object	`userCert` defines the user certificate reference and is used for mTLS. When you use one-way TLS, you can ignore this property.	false

FlowCollector.spec.exporters[index].kafka.tls.caCert

^{↩ Parent}

caCert defines the reference of the certificate for the Certificate Authority.

Name	Type	Description	Required
certFile	string	`certFile` defines the path to the certificate file name within the config map or secret.	false
certKey	string	`certKey` defines the path to the certificate private key file name within the config map or secret. Omit when the key is not necessary.	false
name	string	Name of the config map or secret containing certificates.	false
namespace	string	Namespace of the config map or secret containing certificates. If omitted, the default is to use the same namespace as where NetObserv is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. Default:	false
type	enum	Type for the certificate reference: `configmap` or `secret`. Enum: configmap, secret	false

FlowCollector.spec.exporters[index].kafka.tls.userCert

^{↩ Parent}

userCert defines the user certificate reference and is used for mTLS. When you use one-way TLS, you can ignore this property.

Name	Type	Description	Required
certFile	string	`certFile` defines the path to the certificate file name within the config map or secret.	false
certKey	string	`certKey` defines the path to the certificate private key file name within the config map or secret. Omit when the key is not necessary.	false
name	string	Name of the config map or secret containing certificates.	false
namespace	string	Namespace of the config map or secret containing certificates. If omitted, the default is to use the same namespace as where NetObserv is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. Default:	false
type	enum	Type for the certificate reference: `configmap` or `secret`. Enum: configmap, secret	false

FlowCollector.spec.exporters[index].openTelemetry

^{↩ Parent}

OpenTelemetry configuration, such as the IP address and port to send enriched logs or metrics to.

Name	Type	Description	Required
targetHost	string	Address of the OpenTelemetry receiver. Default:	true
targetPort	integer	Port for the OpenTelemetry receiver. Default: 4317	true
fieldsMapping	[]object	Custom fields mapping to an OpenTelemetry conformant format. By default, NetObserv format proposal is used: https://github.com/rhobs/observability-data-model/blob/main/network-observability.md#format-proposal . As there is currently no accepted standard for L3 or L4 enriched network logs, you can freely override it with your own.	false
headers	map[string]string	Headers to add to messages (optional)	false
logs	object	OpenTelemetry configuration for logs.	false
metrics	object	OpenTelemetry configuration for metrics.	false
protocol	enum	Protocol of the OpenTelemetry connection. The available options are `http` and `grpc`. Enum: http, grpc	false
tls	object	TLS client configuration.	false

FlowCollector.spec.exporters[index].openTelemetry.fieldsMapping[index]

^{↩ Parent}

Name	Type	Description	Required
input	string		false
multiplier	integer		false
output	string		false

FlowCollector.spec.exporters[index].openTelemetry.logs

^{↩ Parent}

OpenTelemetry configuration for logs.

Name	Type	Description	Required
enable	boolean	Set `enable` to `true` to send logs to an OpenTelemetry receiver. Default: true	false

FlowCollector.spec.exporters[index].openTelemetry.metrics

^{↩ Parent}

OpenTelemetry configuration for metrics.

Name	Type	Description	Required
enable	boolean	Set `enable` to `true` to send metrics to an OpenTelemetry receiver. Default: true	false
pushTimeInterval	string	Specify how often metrics are sent to a collector. Default: 20s	false

FlowCollector.spec.exporters[index].openTelemetry.tls

^{↩ Parent}

TLS client configuration.

Name	Type	Description	Required
caCert	object	`caCert` defines the reference of the certificate for the Certificate Authority.	false
enable	boolean	Enable TLS Default: false	false
insecureSkipVerify	boolean	`insecureSkipVerify` allows skipping client-side verification of the server certificate. If set to `true`, the `caCert` field is ignored. For security, this should not be used other than for testing or demo. Default: false	false
userCert	object	`userCert` defines the user certificate reference and is used for mTLS. When you use one-way TLS, you can ignore this property.	false

FlowCollector.spec.exporters[index].openTelemetry.tls.caCert

^{↩ Parent}

caCert defines the reference of the certificate for the Certificate Authority.

Name	Type	Description	Required
certFile	string	`certFile` defines the path to the certificate file name within the config map or secret.	false
certKey	string	`certKey` defines the path to the certificate private key file name within the config map or secret. Omit when the key is not necessary.	false
name	string	Name of the config map or secret containing certificates.	false
namespace	string	Namespace of the config map or secret containing certificates. If omitted, the default is to use the same namespace as where NetObserv is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. Default:	false
type	enum	Type for the certificate reference: `configmap` or `secret`. Enum: configmap, secret	false

FlowCollector.spec.exporters[index].openTelemetry.tls.userCert

^{↩ Parent}

userCert defines the user certificate reference and is used for mTLS. When you use one-way TLS, you can ignore this property.

Name	Type	Description	Required
certFile	string	`certFile` defines the path to the certificate file name within the config map or secret.	false
certKey	string	`certKey` defines the path to the certificate private key file name within the config map or secret. Omit when the key is not necessary.	false
name	string	Name of the config map or secret containing certificates.	false
namespace	string	Namespace of the config map or secret containing certificates. If omitted, the default is to use the same namespace as where NetObserv is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. Default:	false
type	enum	Type for the certificate reference: `configmap` or `secret`. Enum: configmap, secret	false

FlowCollector.spec.kafka

^{↩ Parent}

Kafka configuration, allowing to use Kafka as a broker as part of the flow collection pipeline. Available when the spec.deploymentModel is Kafka.

Name	Type	Description	Required
address	string	Address of the Kafka server Default:	true
topic	string	Kafka topic to use. It must exist. NetObserv does not create it. Default:	true
compression	enum	Compression codec to use when producing messages to Kafka. Accepted values are: `none` (default), `gzip`, `snappy`, `lz4`, `zstd`. Enum: none, gzip, snappy, lz4, zstd Default: none	false
sasl	object	SASL authentication configuration.	false
tls	object	TLS and mTLS client configuration. When using TLS, verify that the address matches the Kafka port used for TLS, generally 9093. We recommend the use of mTLS for higher security standards. When configuring TLS, the operator watches the certificate secret and copies it to both the netobserv and netobserv-privileged namespaces. In order to do so, you must grant it permissions to the `netobserv-secret-watcher` and `netobserv-secret-creator` roles in the corresponding namespaces. Refer to the Kafka configuration documentation for more information.	false

FlowCollector.spec.kafka.sasl

^{↩ Parent}

SASL authentication configuration.

Name	Type	Description	Required
clientIDReference	object	Reference to the secret or config map containing the client ID	false
clientSecretReference	object	Reference to the secret or config map containing the client secret	false
type	enum	Type of SASL authentication to use, or `Disabled` if SASL is not used Enum: Disabled, Plain, ScramSHA512 Default: Disabled	false

FlowCollector.spec.kafka.sasl.clientIDReference

^{↩ Parent}

Reference to the secret or config map containing the client ID

Name	Type	Description	Required
file	string	File name within the config map or secret.	false
name	string	Name of the config map or secret containing the file.	false
namespace	string	Namespace of the config map or secret containing the file. If omitted, the default is to use the same namespace as where NetObserv is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. Default:	false
type	enum	Type for the file reference: `configmap` or `secret`. Enum: configmap, secret	false

FlowCollector.spec.kafka.sasl.clientSecretReference

^{↩ Parent}

Reference to the secret or config map containing the client secret

Name	Type	Description	Required
file	string	File name within the config map or secret.	false
name	string	Name of the config map or secret containing the file.	false
namespace	string	Namespace of the config map or secret containing the file. If omitted, the default is to use the same namespace as where NetObserv is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. Default:	false
type	enum	Type for the file reference: `configmap` or `secret`. Enum: configmap, secret	false

FlowCollector.spec.kafka.tls

^{↩ Parent}

TLS and mTLS client configuration. When using TLS, verify that the address matches the Kafka port used for TLS, generally 9093. We recommend the use of mTLS for higher security standards. When configuring TLS, the operator watches the certificate secret and copies it to both the netobserv and netobserv-privileged namespaces. In order to do so, you must grant it permissions to the netobserv-secret-watcher and netobserv-secret-creator roles in the corresponding namespaces. Refer to the Kafka configuration documentation for more information.

Name	Type	Description	Required
caCert	object	`caCert` defines the reference of the certificate for the Certificate Authority.	false
enable	boolean	Enable TLS Default: false	false
insecureSkipVerify	boolean	`insecureSkipVerify` allows skipping client-side verification of the server certificate. If set to `true`, the `caCert` field is ignored. For security, this should not be used other than for testing or demo. Default: false	false
userCert	object	`userCert` defines the user certificate reference and is used for mTLS. When you use one-way TLS, you can ignore this property.	false

FlowCollector.spec.kafka.tls.caCert

^{↩ Parent}

caCert defines the reference of the certificate for the Certificate Authority.

Name	Type	Description	Required
certFile	string	`certFile` defines the path to the certificate file name within the config map or secret.	false
certKey	string	`certKey` defines the path to the certificate private key file name within the config map or secret. Omit when the key is not necessary.	false
name	string	Name of the config map or secret containing certificates.	false
namespace	string	Namespace of the config map or secret containing certificates. If omitted, the default is to use the same namespace as where NetObserv is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. Default:	false
type	enum	Type for the certificate reference: `configmap` or `secret`. Enum: configmap, secret	false

FlowCollector.spec.kafka.tls.userCert

^{↩ Parent}

userCert defines the user certificate reference and is used for mTLS. When you use one-way TLS, you can ignore this property.

Name	Type	Description	Required
certFile	string	`certFile` defines the path to the certificate file name within the config map or secret.	false
certKey	string	`certKey` defines the path to the certificate private key file name within the config map or secret. Omit when the key is not necessary.	false
name	string	Name of the config map or secret containing certificates.	false
namespace	string	Namespace of the config map or secret containing certificates. If omitted, the default is to use the same namespace as where NetObserv is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. Default:	false
type	enum	Type for the certificate reference: `configmap` or `secret`. Enum: configmap, secret	false

FlowCollector.spec.loki

^{↩ Parent}

loki, the flow store, client settings.

Name	Type	Description	Required
mode	enum	`mode` must be set according to the installation mode of Loki: - Use `LokiStack` when Loki is managed using the Loki Operator - Use `Monolithic` when Loki is installed as a monolithic workload - Use `Microservices` when Loki is installed as microservices, but without Loki Operator - Use `Manual` if none of the options above match your setup Enum: Manual, LokiStack, Monolithic, Microservices Default: Monolithic	true
advanced	object	`advanced` allows setting some aspects of the internal configuration of the Loki clients. This section is aimed mostly for debugging and fine-grained performance optimizations.	false
enable	boolean	Set `enable` to `true` to store flows in Loki. The Console plugin can use either Loki or Prometheus as a data source for metrics (see also `spec.prometheus.querier`), or both. Not all queries are transposable from Loki to Prometheus. Hence, if Loki is disabled, some features of the plugin are disabled as well, such as getting per-pod information or viewing raw flows. If both Prometheus and Loki are enabled, Prometheus takes precedence and Loki is used as a fallback for queries that Prometheus cannot handle. If they are both disabled, the Console plugin is not deployed. Default: true	false
lokiStack	object	Loki configuration for `LokiStack` mode. This is useful for an easy Loki Operator configuration. It is ignored for other modes.	false
manual	object	Loki configuration for `Manual` mode. This is the most flexible configuration. It is ignored for other modes.	false
microservices	object	Loki configuration for `Microservices` mode. Use this option when Loki is installed using the microservices deployment mode (https://grafana.com/docs/loki/latest/fundamentals/architecture/deployment-modes/#microservices-mode). It is ignored for other modes.	false
monolithic	object	Loki configuration for `Monolithic` mode. Use this option when Loki is installed using the monolithic deployment mode (https://grafana.com/docs/loki/latest/fundamentals/architecture/deployment-modes/#monolithic-mode). It is ignored for other modes.	false
readTimeout	string	`readTimeout` is the maximum console plugin loki query total time limit. A timeout of zero means no timeout. Default: 30s	false
writeBatchSize	integer	`writeBatchSize` is the maximum batch size (in bytes) of Loki logs to accumulate before sending. Format: int64 Default: 10485760 Minimum: 1	false
writeBatchWait	string	`writeBatchWait` is the maximum time to wait before sending a Loki batch. Default: 1s	false
writeTimeout	string	`writeTimeout` is the maximum Loki time connection / request limit. A timeout of zero means no timeout. Default: 10s	false

FlowCollector.spec.loki.advanced

^{↩ Parent}

advanced allows setting some aspects of the internal configuration of the Loki clients. This section is aimed mostly for debugging and fine-grained performance optimizations.

Name	Type	Description	Required
excludeLabels	[]string	`excludeLabels` is a list of fields to be excluded from the list of Loki labels.	false
staticLabels	map[string]string	`staticLabels` is a map of common labels to set on each flow in Loki storage. Default: map[app:netobserv-flowcollector]	false
writeMaxBackoff	string	`writeMaxBackoff` is the maximum backoff time for Loki client connection between retries. Default: 5s	false
writeMaxRetries	integer	`writeMaxRetries` is the maximum number of retries for Loki client connections. Format: int32 Default: 2 Minimum: 0	false
writeMinBackoff	string	`writeMinBackoff` is the initial backoff time for Loki client connection between retries. Default: 1s	false

FlowCollector.spec.loki.lokiStack

^{↩ Parent}

Loki configuration for LokiStack mode. This is useful for an easy Loki Operator configuration. It is ignored for other modes.

Name	Type	Description	Required
name	string	Name of an existing LokiStack resource to use. Default: loki	true
namespace	string	Namespace where this `LokiStack` resource is located. If omitted, it is assumed to be the same as `spec.namespace`. When configuring a different namespace, the operator watches certificate secret and copies it to the netobserv main namespaces. In order to do so, you must grant it permissions to the `netobserv-secret-watcher` and `netobserv-secret-creator` roles in the corresponding namespaces. Refer to the Loki configuration documentation for more information.	false

FlowCollector.spec.loki.manual

^{↩ Parent}

Loki configuration for Manual mode. This is the most flexible configuration. It is ignored for other modes.

Name	Type	Description	Required
authToken	enum	`authToken` describes the way to get a token to authenticate to Loki. - `Disabled` does not send any token with the request. - `Forward` forwards the user token for authorization. - `Host` (deprecated) - uses the local pod service account to authenticate to Loki. When using the Loki Operator, this must be set to `Forward`. Enum: Disabled, Host, Forward Default: Disabled	false
ingesterUrl	string	`ingesterUrl` is the address of an existing Loki ingester service to push the flows to. When using the Loki Operator, set it to the Loki gateway service with the `network` tenant set in path, for example https://loki-gateway-http.netobserv.svc:8080/api/logs/v1/network. Default: http://loki:3100/	false
querierUrl	string	`querierUrl` specifies the address of the Loki querier service. When using the Loki Operator, set it to the Loki gateway service with the `network` tenant set in path, for example https://loki-gateway-http.netobserv.svc:8080/api/logs/v1/network. Default: http://loki:3100/	false
statusTls	object	TLS client configuration for Loki status URL.	false
statusUrl	string	`statusUrl` specifies the address of the Loki `/ready`, `/metrics` and `/config` endpoints, in case it is different from the Loki querier URL. If empty, the `querierUrl` value is used. This is useful to show error messages and some context in the frontend. When using the Loki Operator, set it to the Loki HTTP query frontend service, for example https://loki-query-frontend-http.netobserv.svc:3100/. `statusTLS` configuration is used when `statusUrl` is set.	false
tenantID	string	`tenantID` is the Loki `X-Scope-OrgID` that identifies the tenant for each request. When using the Loki Operator, set it to `network`, which corresponds to a special tenant mode. Default: netobserv	false
tls	object	TLS client configuration for Loki URL.	false

FlowCollector.spec.loki.manual.statusTls

^{↩ Parent}

TLS client configuration for Loki status URL.

Name	Type	Description	Required
caCert	object	`caCert` defines the reference of the certificate for the Certificate Authority.	false
enable	boolean	Enable TLS Default: false	false
insecureSkipVerify	boolean	`insecureSkipVerify` allows skipping client-side verification of the server certificate. If set to `true`, the `caCert` field is ignored. For security, this should not be used other than for testing or demo. Default: false	false
userCert	object	`userCert` defines the user certificate reference and is used for mTLS. When you use one-way TLS, you can ignore this property.	false

FlowCollector.spec.loki.manual.statusTls.caCert

^{↩ Parent}

caCert defines the reference of the certificate for the Certificate Authority.

Name	Type	Description	Required
certFile	string	`certFile` defines the path to the certificate file name within the config map or secret.	false
certKey	string	`certKey` defines the path to the certificate private key file name within the config map or secret. Omit when the key is not necessary.	false
name	string	Name of the config map or secret containing certificates.	false
namespace	string	Namespace of the config map or secret containing certificates. If omitted, the default is to use the same namespace as where NetObserv is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. Default:	false
type	enum	Type for the certificate reference: `configmap` or `secret`. Enum: configmap, secret	false

FlowCollector.spec.loki.manual.statusTls.userCert

^{↩ Parent}

userCert defines the user certificate reference and is used for mTLS. When you use one-way TLS, you can ignore this property.

Name	Type	Description	Required
certFile	string	`certFile` defines the path to the certificate file name within the config map or secret.	false
certKey	string	`certKey` defines the path to the certificate private key file name within the config map or secret. Omit when the key is not necessary.	false
name	string	Name of the config map or secret containing certificates.	false
namespace	string	Namespace of the config map or secret containing certificates. If omitted, the default is to use the same namespace as where NetObserv is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. Default:	false
type	enum	Type for the certificate reference: `configmap` or `secret`. Enum: configmap, secret	false

FlowCollector.spec.loki.manual.tls

^{↩ Parent}

TLS client configuration for Loki URL.

Name	Type	Description	Required
caCert	object	`caCert` defines the reference of the certificate for the Certificate Authority.	false
enable	boolean	Enable TLS Default: false	false
insecureSkipVerify	boolean	`insecureSkipVerify` allows skipping client-side verification of the server certificate. If set to `true`, the `caCert` field is ignored. For security, this should not be used other than for testing or demo. Default: false	false
userCert	object	`userCert` defines the user certificate reference and is used for mTLS. When you use one-way TLS, you can ignore this property.	false

FlowCollector.spec.loki.manual.tls.caCert

^{↩ Parent}

caCert defines the reference of the certificate for the Certificate Authority.

Name	Type	Description	Required
certFile	string	`certFile` defines the path to the certificate file name within the config map or secret.	false
certKey	string	`certKey` defines the path to the certificate private key file name within the config map or secret. Omit when the key is not necessary.	false
name	string	Name of the config map or secret containing certificates.	false
namespace	string	Namespace of the config map or secret containing certificates. If omitted, the default is to use the same namespace as where NetObserv is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. Default:	false
type	enum	Type for the certificate reference: `configmap` or `secret`. Enum: configmap, secret	false

FlowCollector.spec.loki.manual.tls.userCert

^{↩ Parent}

userCert defines the user certificate reference and is used for mTLS. When you use one-way TLS, you can ignore this property.

Name	Type	Description	Required
certFile	string	`certFile` defines the path to the certificate file name within the config map or secret.	false
certKey	string	`certKey` defines the path to the certificate private key file name within the config map or secret. Omit when the key is not necessary.	false
name	string	Name of the config map or secret containing certificates.	false
namespace	string	Namespace of the config map or secret containing certificates. If omitted, the default is to use the same namespace as where NetObserv is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. Default:	false
type	enum	Type for the certificate reference: `configmap` or `secret`. Enum: configmap, secret	false

FlowCollector.spec.loki.microservices

^{↩ Parent}

Loki configuration for Microservices mode. Use this option when Loki is installed using the microservices deployment mode (https://grafana.com/docs/loki/latest/fundamentals/architecture/deployment-modes/#microservices-mode). It is ignored for other modes.

Name	Type	Description	Required
ingesterUrl	string	`ingesterUrl` is the address of an existing Loki ingester service to push the flows to. Default: http://loki-distributor:3100/	false
querierUrl	string	`querierURL` specifies the address of the Loki querier service. Default: http://loki-query-frontend:3100/	false
tenantID	string	`tenantID` is the Loki `X-Scope-OrgID` header that identifies the tenant for each request. Default: netobserv	false
tls	object	TLS client configuration for Loki URL.	false

FlowCollector.spec.loki.microservices.tls

^{↩ Parent}

TLS client configuration for Loki URL.

Name	Type	Description	Required
caCert	object	`caCert` defines the reference of the certificate for the Certificate Authority.	false
enable	boolean	Enable TLS Default: false	false
insecureSkipVerify	boolean	`insecureSkipVerify` allows skipping client-side verification of the server certificate. If set to `true`, the `caCert` field is ignored. For security, this should not be used other than for testing or demo. Default: false	false
userCert	object	`userCert` defines the user certificate reference and is used for mTLS. When you use one-way TLS, you can ignore this property.	false

FlowCollector.spec.loki.microservices.tls.caCert

^{↩ Parent}

caCert defines the reference of the certificate for the Certificate Authority.

Name	Type	Description	Required
certFile	string	`certFile` defines the path to the certificate file name within the config map or secret.	false
certKey	string	`certKey` defines the path to the certificate private key file name within the config map or secret. Omit when the key is not necessary.	false
name	string	Name of the config map or secret containing certificates.	false
namespace	string	Namespace of the config map or secret containing certificates. If omitted, the default is to use the same namespace as where NetObserv is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. Default:	false
type	enum	Type for the certificate reference: `configmap` or `secret`. Enum: configmap, secret	false

FlowCollector.spec.loki.microservices.tls.userCert

^{↩ Parent}

userCert defines the user certificate reference and is used for mTLS. When you use one-way TLS, you can ignore this property.

Name	Type	Description	Required
certFile	string	`certFile` defines the path to the certificate file name within the config map or secret.	false
certKey	string	`certKey` defines the path to the certificate private key file name within the config map or secret. Omit when the key is not necessary.	false
name	string	Name of the config map or secret containing certificates.	false
namespace	string	Namespace of the config map or secret containing certificates. If omitted, the default is to use the same namespace as where NetObserv is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. Default:	false
type	enum	Type for the certificate reference: `configmap` or `secret`. Enum: configmap, secret	false

FlowCollector.spec.loki.monolithic

^{↩ Parent}

Loki configuration for Monolithic mode. Use this option when Loki is installed using the monolithic deployment mode (https://grafana.com/docs/loki/latest/fundamentals/architecture/deployment-modes/#monolithic-mode). It is ignored for other modes.

Name	Type	Description	Required
installDemoLoki	boolean	Set `installDemoLoki` to `true` to automatically create Loki deployment, service and storage. This is meant for development and demo use only, and not recommended in production. Default: false	false
tenantID	string	`tenantID` is the Loki `X-Scope-OrgID` header that identifies the tenant for each request. Default: netobserv	false
tls	object	TLS client configuration for Loki URL.	false
url	string	`url` is the unique address of an existing Loki service that points to both the ingester and the querier. Default: http://loki:3100/	false

FlowCollector.spec.loki.monolithic.tls

^{↩ Parent}

TLS client configuration for Loki URL.

Name	Type	Description	Required
caCert	object	`caCert` defines the reference of the certificate for the Certificate Authority.	false
enable	boolean	Enable TLS Default: false	false
insecureSkipVerify	boolean	`insecureSkipVerify` allows skipping client-side verification of the server certificate. If set to `true`, the `caCert` field is ignored. For security, this should not be used other than for testing or demo. Default: false	false
userCert	object	`userCert` defines the user certificate reference and is used for mTLS. When you use one-way TLS, you can ignore this property.	false

FlowCollector.spec.loki.monolithic.tls.caCert

^{↩ Parent}

caCert defines the reference of the certificate for the Certificate Authority.

Name	Type	Description	Required
certFile	string	`certFile` defines the path to the certificate file name within the config map or secret.	false
certKey	string	`certKey` defines the path to the certificate private key file name within the config map or secret. Omit when the key is not necessary.	false
name	string	Name of the config map or secret containing certificates.	false
namespace	string	Namespace of the config map or secret containing certificates. If omitted, the default is to use the same namespace as where NetObserv is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. Default:	false
type	enum	Type for the certificate reference: `configmap` or `secret`. Enum: configmap, secret	false

FlowCollector.spec.loki.monolithic.tls.userCert

^{↩ Parent}

userCert defines the user certificate reference and is used for mTLS. When you use one-way TLS, you can ignore this property.

Name	Type	Description	Required
certFile	string	`certFile` defines the path to the certificate file name within the config map or secret.	false
certKey	string	`certKey` defines the path to the certificate private key file name within the config map or secret. Omit when the key is not necessary.	false
name	string	Name of the config map or secret containing certificates.	false
namespace	string	Namespace of the config map or secret containing certificates. If omitted, the default is to use the same namespace as where NetObserv is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. Default:	false
type	enum	Type for the certificate reference: `configmap` or `secret`. Enum: configmap, secret	false

FlowCollector.spec.networkPolicy

^{↩ Parent}

networkPolicy defines network policy settings for NetObserv components isolation.

Name	Type	Description	Required
additionalNamespaces	[]string	`additionalNamespaces` contains additional namespaces allowed to connect to the NetObserv namespace. It provides flexibility in the network policy configuration, but if you need a more specific configuration, you can disable it and install your own instead.	false
enable	boolean	Deploys network policies on the namespaces used by NetObserv operands (main and privileged). These network policies better isolate the NetObserv components to prevent undesired connections from and to them. Because it cannot be tested with all CNIs, this option is only enabled by default when NetObserv runs in a known supported environment, and it is disabled by default otherwise. When disabled, it is highly recommended to create network policies manually, to prevent undesired accesses. This setting is for operands only, and does not control the Operator network policy, which is covered by the `OPERATOR_NETWORK_POLICY` environment variable. If the operator and the operands are deployed in the same namespace, this setting is ignored, and only `OPERATOR_NETWORK_POLICY` controls whether or not any policy is installed. More information: https://github.com/netobserv/netobserv-operator/blob/main/docs/NetworkPolicy.md.	false

FlowCollector.spec.processor

^{↩ Parent}

processor defines the settings of the component that receives the flows from the agent, enriches them, generates metrics, and forwards them to the Loki persistence layer and/or any available exporter.

Name	Type	Description	Required
addZone	boolean	`addZone` allows availability zone awareness by labeling flows with their source and destination zones. This feature requires the "topology.kubernetes.io/zone" label to be set on nodes.	false
advanced	object	`advanced` allows setting some aspects of the internal configuration of the flow processor. This section is aimed mostly for debugging and fine-grained performance optimizations, such as `GOGC` and `GOMAXPROCS` environment variables. Set these values at your own risk.	false
clusterName	string	`clusterName` is the name of the cluster to appear in the flows data. In a multi-cluster context, it makes it possible to identify the flows provenance. Default:	false
consumerReplicas	integer	`consumerReplicas` defines the number of replicas (pods) to start for `flowlogs-pipeline`, default is 3. This setting is ignored when `spec.deploymentModel` is `Direct` or when `spec.processor.unmanagedReplicas` is `true`. Format: int32 Minimum: 0	false
deduper	object	`deduper` allows you to sample or drop flows identified as duplicates, in order to save on resource usage.	false
filters	[]object	`filters` lets you define custom filters to limit the amount of generated flows. These filters provide more flexibility than the eBPF Agent filters (in `spec.agent.ebpf.flowFilter`), such as allowing to filter by Kubernetes namespace, but with a lesser improvement in performance.	false
imagePullPolicy	enum	`imagePullPolicy` is the Kubernetes pull policy for the image defined above Enum: IfNotPresent, Always, Never Default: IfNotPresent	false
informerCacheProxy	object	`informerCacheProxy` configuration for centralized Kubernetes informers that push cache updates to flowlogs-pipeline processors. This reduces load on the Kubernetes API server by having a single component query the API instead of N FLP processors. When enabled, a dedicated deployment is created that watches Kubernetes resources and pushes updates via gRPC. Benefits: Reduced API server load on large clusters with many FLP replicas. Drawbacks: More complex deployment (additional component), higher resource usage on small clusters. Recommended only for clusters with many FLP replicas (>3) or when API server load is a concern.	false
kafkaConsumerAutoscaler	object	`kafkaConsumerAutoscaler` is the spec of a horizontal pod autoscaler to set up for `flowlogs-pipeline-transformer`, which consumes Kafka messages. This setting is ignored when Kafka is disabled. Deprecated: managed autoscaler will be removed in a future version. You may configure instead an autoscaler of your choice, and set spec.processor.unmanagedReplicas to true.	false
kafkaConsumerBatchSize	integer	kafkaConsumerBatchSize indicates to the broker the maximum batch size, in bytes, that the consumer accepts. Ignored when not using Kafka. Default: 10MB. Default: 10485760	false
kafkaConsumerQueueCapacity	integer	kafkaConsumerQueueCapacity defines the capacity of the internal message queue used in the Kafka consumer client. Ignored when not using Kafka. Default: 1000	false
kafkaConsumerReplicas	integer	kafkaConsumerReplicas defines the number of replicas (pods) to start for flowlogs-pipeline-transformer, which consumes Kafka messages. This setting is ignored when Kafka is disabled. Deprecated: use spec.processor.consumerReplicas instead. Format: int32 Default: 3 Minimum: 0	false
logLevel	enum	logLevel of the processor runtime Enum: trace, debug, info, warn, error, fatal, panic Default: info	false
logTypes	enum	logTypes defines the desired record types to generate. Possible values are: Flows to export regular network flows. This is the default. Conversations to generate events for started conversations, ended conversations as well as periodic "tick" updates. Note that in this mode, Prometheus metrics are not accurate on long-standing conversations. EndedConversations to generate only ended conversations events. Note that in this mode, Prometheus metrics are not accurate on long-standing conversations. All to generate both network flows and all conversations events. It is not recommended due to the impact on resources footprint. Enum: Flows, Conversations, EndedConversations, All Default: Flows	false
metrics	object	Metrics define the processor configuration regarding metrics	false
multiClusterDeployment	boolean	Set multiClusterDeployment to true to enable multi clusters feature. This adds clusterName label to flows data Default: false	false
resources	object	resources are the compute resources required by this container. For more information, see https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ Default: map[limits:map[memory:800Mi] requests:map[cpu:100m memory:100Mi]]	false
service	object	Service configuration, only used when spec.deploymentModel is Service.	false
slicesConfig	object	Global configuration managing FlowCollectorSlices custom resources.	false
subnetLabels	object	subnetLabels allows to define custom labels on subnets and IPs and, for supported vendors, to enable automatic labeling of recognized subnets, which is used to identify cluster external traffic. When a subnet matches the source or destination IP of a flow, a corresponding field is added: SrcSubnetLabel or DstSubnetLabel.	false
unmanagedReplicas	boolean	If unmanagedReplicas is true, the operator will not reconcile consumerReplicas. This is useful when using a pod autoscaler.	false

FlowCollector.spec.processor.advanced

^{↩ Parent}

advanced allows setting some aspects of the internal configuration of the flow processor. This section is aimed mostly for debugging and fine-grained performance optimizations, such as GOGC and GOMAXPROCS environment variables. Set these values at your own risk.

Name	Type	Description	Required
conversationEndTimeout	string	`conversationEndTimeout` is the time to wait after a network flow is received, to consider the conversation ended. This delay is ignored when a FIN packet is collected for TCP flows (see `conversationTerminatingTimeout` instead). Default: 10s	false
conversationHeartbeatInterval	string	`conversationHeartbeatInterval` is the time to wait between "tick" events of a conversation. Default: 30s	false
conversationTerminatingTimeout	string	`conversationTerminatingTimeout` is the time to wait from detected FIN flag to end a conversation. Only relevant for TCP flows. Default: 5s	false
dropUnusedFields	boolean	`dropUnusedFields`. Deprecated: this setting is not used anymore. Default: true	false
enableKubeProbes	boolean	enableKubeProbes is a flag to enable or disable Kubernetes liveness and readiness probes. Default: true	false
env	map[string]string	env allows passing custom environment variables to underlying components. Useful for passing some very concrete performance-tuning options, such as GOGC and GOMAXPROCS, that should not be publicly exposed as part of the FlowCollector descriptor, as they are only useful in edge debug or support scenarios.	false
healthPort	integer	healthPort is a collector HTTP port in the Pod that exposes the health check API. Format: int32 Default: 8080 Minimum: 1 Maximum: 65535	false
port	integer	Port of the flow collector (host port). By convention, some values are forbidden. It must be greater than 1024 and different from 4500, 4789 and 6081. Format: int32 Default: 2055 Minimum: 1025 Maximum: 65535	false
profilePort	integer	profilePort allows setting up a Go pprof profiler listening to this port. This is for debugging purpose only. This port should not be exposed, you can access it through local port-forwarding. Format: int32 Minimum: 0 Maximum: 65535	false
scheduling	object	scheduling controls how the pods are scheduled on nodes.	false
secondaryNetworks	[]object	Defines secondary networks to be checked for resources identification. To guarantee a correct identification, indexed values must form an unique identifier across the cluster. If the same index is used by several resources, those resources might be incorrectly labeled. If not provided and spec.agent.ebpf.privileged is true, secondary networks are detected automatically.	false

FlowCollector.spec.processor.advanced.scheduling

^{↩ Parent}

scheduling controls how the pods are scheduled on nodes.

Name	Type	Description	Required
affinity	object	If specified, the pod's scheduling constraints. For documentation, refer to https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling.	false
nodeSelector	map[string]string	`nodeSelector` allows scheduling of pods only onto nodes that have each of the specified labels. For documentation, refer to https://kubernetes.io/docs/concepts/configuration/assign-pod-node/.	false
priorityClassName	string	If specified, indicates the pod's priority. For documentation, refer to https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/#how-to-use-priority-and-preemption. If not specified, default priority is used, or zero if there is no default.	false
tolerations	[]object	`tolerations` is a list of tolerations that allow the pod to schedule onto nodes with matching taints. For documentation, refer to https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling.	false

FlowCollector.spec.processor.advanced.scheduling.affinity

^{↩ Parent}

If specified, the pod's scheduling constraints. For documentation, refer to https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling.

Name	Type	Description	Required
nodeAffinity	object	Describes node affinity scheduling rules for the pod.	false
podAffinity	object	Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).	false
podAntiAffinity	object	Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).	false

FlowCollector.spec.processor.advanced.scheduling.affinity.nodeAffinity

^{↩ Parent}

Describes node affinity scheduling rules for the pod.

Name	Type	Description	Required
preferredDuringSchedulingIgnoredDuringExecution	[]object	The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred.	false
requiredDuringSchedulingIgnoredDuringExecution	object	If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node.	false

FlowCollector.spec.processor.advanced.scheduling.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[index]

^{↩ Parent}

An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).

Name	Type	Description	Required
preference	object	A node selector term, associated with the corresponding weight.	true
weight	integer	Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. Format: int32	true

FlowCollector.spec.processor.advanced.scheduling.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].preference

^{↩ Parent}

A node selector term, associated with the corresponding weight.

Name	Type	Description	Required
matchExpressions	[]object	A list of node selector requirements by node's labels.	false
matchFields	[]object	A list of node selector requirements by node's fields.	false

FlowCollector.spec.processor.advanced.scheduling.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].preference.matchExpressions[index]

^{↩ Parent}

A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	The label key that the selector applies to.	true
operator	string	Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.	true
values	[]string	An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.	false

FlowCollector.spec.processor.advanced.scheduling.affinity.nodeAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].preference.matchFields[index]

^{↩ Parent}

A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	The label key that the selector applies to.	true
operator	string	Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.	true
values	[]string	An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.	false

FlowCollector.spec.processor.advanced.scheduling.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution

^{↩ Parent}

If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node.

Name	Type	Description	Required
nodeSelectorTerms	[]object	Required. A list of node selector terms. The terms are ORed.	true

FlowCollector.spec.processor.advanced.scheduling.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[index]

^{↩ Parent}

A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.

Name	Type	Description	Required
matchExpressions	[]object	A list of node selector requirements by node's labels.	false
matchFields	[]object	A list of node selector requirements by node's fields.	false

FlowCollector.spec.processor.advanced.scheduling.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[index].matchExpressions[index]

^{↩ Parent}

A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	The label key that the selector applies to.	true
operator	string	Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.	true
values	[]string	An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.	false

FlowCollector.spec.processor.advanced.scheduling.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[index].matchFields[index]

^{↩ Parent}

A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	The label key that the selector applies to.	true
operator	string	Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.	true
values	[]string	An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.	false

FlowCollector.spec.processor.advanced.scheduling.affinity.podAffinity

^{↩ Parent}

Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).

Name	Type	Description	Required
preferredDuringSchedulingIgnoredDuringExecution	[]object	The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred.	false
requiredDuringSchedulingIgnoredDuringExecution	[]object	If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied.	false

FlowCollector.spec.processor.advanced.scheduling.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index]

^{↩ Parent}

The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)

Name	Type	Description	Required
podAffinityTerm	object	Required. A pod affinity term, associated with the corresponding weight.	true
weight	integer	weight associated with matching the corresponding podAffinityTerm, in the range 1-100. Format: int32	true

FlowCollector.spec.processor.advanced.scheduling.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm

^{↩ Parent}

Required. A pod affinity term, associated with the corresponding weight.

Name	Type	Description	Required
topologyKey	string	This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.	true
labelSelector	object	A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.	false
matchLabelKeys	[]string	MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set.	false
mismatchLabelKeys	[]string	MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set.	false
namespaceSelector	object	A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.	false
namespaces	[]string	namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace".	false

FlowCollector.spec.processor.advanced.scheduling.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.labelSelector

^{↩ Parent}

A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.	false

FlowCollector.spec.processor.advanced.scheduling.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.labelSelector.matchExpressions[index]

^{↩ Parent}

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

FlowCollector.spec.processor.advanced.scheduling.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.namespaceSelector

^{↩ Parent}

A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.	false

FlowCollector.spec.processor.advanced.scheduling.affinity.podAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.namespaceSelector.matchExpressions[index]

^{↩ Parent}

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

FlowCollector.spec.processor.advanced.scheduling.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index]

^{↩ Parent}

Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running

Name	Type	Description	Required
topologyKey	string	This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.	true
labelSelector	object	A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.	false
matchLabelKeys	[]string	MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set.	false
mismatchLabelKeys	[]string	MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set.	false
namespaceSelector	object	A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.	false
namespaces	[]string	namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace".	false

FlowCollector.spec.processor.advanced.scheduling.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].labelSelector

^{↩ Parent}

A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.	false

FlowCollector.spec.processor.advanced.scheduling.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].labelSelector.matchExpressions[index]

^{↩ Parent}

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

FlowCollector.spec.processor.advanced.scheduling.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].namespaceSelector

^{↩ Parent}

A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.	false

FlowCollector.spec.processor.advanced.scheduling.affinity.podAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].namespaceSelector.matchExpressions[index]

^{↩ Parent}

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

FlowCollector.spec.processor.advanced.scheduling.affinity.podAntiAffinity

^{↩ Parent}

Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).

Name	Type	Description	Required
preferredDuringSchedulingIgnoredDuringExecution	[]object	The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and subtracting "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred.	false
requiredDuringSchedulingIgnoredDuringExecution	[]object	If the anti-affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the anti-affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied.	false

FlowCollector.spec.processor.advanced.scheduling.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index]

^{↩ Parent}

The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)

Name	Type	Description	Required
podAffinityTerm	object	Required. A pod affinity term, associated with the corresponding weight.	true
weight	integer	weight associated with matching the corresponding podAffinityTerm, in the range 1-100. Format: int32	true

FlowCollector.spec.processor.advanced.scheduling.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm

^{↩ Parent}

Required. A pod affinity term, associated with the corresponding weight.

Name	Type	Description	Required
topologyKey	string	This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.	true
labelSelector	object	A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.	false
matchLabelKeys	[]string	MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set.	false
mismatchLabelKeys	[]string	MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set.	false
namespaceSelector	object	A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.	false
namespaces	[]string	namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace".	false

FlowCollector.spec.processor.advanced.scheduling.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.labelSelector

^{↩ Parent}

A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.	false

FlowCollector.spec.processor.advanced.scheduling.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.labelSelector.matchExpressions[index]

^{↩ Parent}

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

FlowCollector.spec.processor.advanced.scheduling.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.namespaceSelector

^{↩ Parent}

A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.	false

FlowCollector.spec.processor.advanced.scheduling.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[index].podAffinityTerm.namespaceSelector.matchExpressions[index]

^{↩ Parent}

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

FlowCollector.spec.processor.advanced.scheduling.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index]

^{↩ Parent}

Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running

Name	Type	Description	Required
topologyKey	string	This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.	true
labelSelector	object	A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.	false
matchLabelKeys	[]string	MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set.	false
mismatchLabelKeys	[]string	MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set.	false
namespaceSelector	object	A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.	false
namespaces	[]string	namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace".	false

FlowCollector.spec.processor.advanced.scheduling.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].labelSelector

^{↩ Parent}

A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.	false

FlowCollector.spec.processor.advanced.scheduling.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].labelSelector.matchExpressions[index]

^{↩ Parent}

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

FlowCollector.spec.processor.advanced.scheduling.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].namespaceSelector

^{↩ Parent}

A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces.

Name	Type	Description	Required
matchExpressions	[]object	matchExpressions is a list of label selector requirements. The requirements are ANDed.	false
matchLabels	map[string]string	matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.	false

FlowCollector.spec.processor.advanced.scheduling.affinity.podAntiAffinity.requiredDuringSchedulingIgnoredDuringExecution[index].namespaceSelector.matchExpressions[index]

^{↩ Parent}

A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

Name	Type	Description	Required
key	string	key is the label key that the selector applies to.	true
operator	string	operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.	true
values	[]string	values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.	false

FlowCollector.spec.processor.advanced.scheduling.tolerations[index]

^{↩ Parent}

The pod this Toleration is attached to tolerates any taint that matches the triple <key,value,effect> using the matching operator .

Name	Type	Description	Required
effect	string	Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.	false
key	string	Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys.	false
operator	string	Operator represents a key's relationship to the value. Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).	false
tolerationSeconds	integer	TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system. Format: int64	false
value	string	Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string.	false

FlowCollector.spec.processor.advanced.secondaryNetworks[index]

^{↩ Parent}

Name	Type	Description	Required
index	[]enum	`index` is a list of fields to use for indexing the pods. They should form a unique Pod identifier across the cluster. Can be any of: `MAC`, `IP`, `Interface`. Fields absent from the 'k8s.v1.cni.cncf.io/network-status' annotation must not be added to the index. Enum: MAC, IP, Interface	true
name	string	Deprecated: `name` is unused.	false

FlowCollector.spec.processor.deduper

^{↩ Parent}

deduper allows you to sample or drop flows identified as duplicates, in order to save on resource usage.

Name	Type	Description	Required
mode	enum	Set the Processor de-duplication mode. It comes in addition to the Agent-based deduplication, since the Agent cannot de-duplicate same flows reported from different nodes. - Use `Drop` to drop every flow considered as duplicates, allowing saving more on resource usage but potentially losing some information such as the network interfaces used from peer, or network events. - Use `Sample` to randomly keep only one flow on 50, which is the default, among the ones considered as duplicates. This is a compromise between dropping every duplicate or keeping every duplicate. This sampling action comes in addition to the Agent-based sampling. If both Agent and Processor sampling values are `50`, the combined sampling is 1:2500. - Use `Disabled` to turn off Processor-based de-duplication. Enum: Disabled, Drop, Sample Default: Disabled	false
sampling	integer	`sampling` is the sampling interval when deduper `mode` is `Sample`. For example, a value of `50` means that 1 flow in 50 is sampled. Format: int32 Default: 50 Minimum: 0	false

FlowCollector.spec.processor.filters[index]

^{↩ Parent}

FLPFilterSet defines the desired configuration for FLP-based filtering satisfying all conditions.

Name	Type	Description	Required
outputTarget	enum	If specified, these filters target a single output: `Loki`, `Metrics` or `Exporters`. By default, all outputs are targeted. Enum: , Loki, Metrics, Exporters	false
query	string	A query that selects the network flows to keep. More information about this query language in https://github.com/netobserv/flowlogs-pipeline/blob/main/docs/filtering.md.	false
sampling	integer	`sampling` is an optional sampling interval to apply to this filter. For example, a value of `50` means that 1 matching flow in 50 is sampled. Format: int32 Minimum: 0	false

FlowCollector.spec.processor.informerCacheProxy

^{↩ Parent}

informerCacheProxy configuration for centralized Kubernetes informers that push cache updates to flowlogs-pipeline processors. This reduces load on the Kubernetes API server by having a single component query the API instead of N FLP processors. When enabled, a dedicated deployment is created that watches Kubernetes resources and pushes updates via gRPC. Benefits: Reduced API server load on large clusters with many FLP replicas. Drawbacks: More complex deployment (additional component), higher resource usage on small clusters. Recommended only for clusters with many FLP replicas (>3) or when API server load is a concern.

Name	Type	Description	Required
advanced	object	`advanced` allows setting some technical parameters of the informer cache proxy component.	false
enabled	boolean	`enabled` controls whether to deploy the informer cache proxy. When `true`, a dedicated deployment watches K8s resources and pushes cache updates via gRPC to FLP processors, reducing API server load. When `false` (default), each FLP processor uses local informers. Enable only on large clusters or when API server load is a concern, as it adds deployment complexity. Default: false	false
replicas	integer	`replicas` defines the number of replicas for the flowlogs-pipeline-informers deployment. For high availability, a minimum of 2 replicas is required when `enabled` is `true`. Format: int32 Default: 2 Minimum: 2	false
resources	object	`resources` are the compute resources required by the informer cache proxy container. For more information, see https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ Default: map[limits:map[cpu:200m memory:256Mi] requests:map[cpu:50m memory:128Mi]]	false
tls	object	`tls` defines the TLS configuration for the gRPC communication between the informer cache proxy and processors.	false

FlowCollector.spec.processor.informerCacheProxy.advanced

^{↩ Parent}

advanced allows setting some technical parameters of the informer cache proxy component.

Name	Type	Description	Required
batchSize	integer	`batchSize` defines the maximum number of cache entries to send in a single update batch. Default: 100 Minimum: 1	false
processorPort	integer	`processorPort` defines the gRPC port where flowlogs-pipeline processors listen for k8s cache updates. Format: int32 Default: 9402 Minimum: 1 Maximum: 65535	false
resyncInterval	integer	`resyncInterval` defines the interval in seconds to rediscover processors and sync state. Default: 60 Minimum: 1	false
sendTimeout	integer	`sendTimeout` defines the timeout in seconds for sending updates to processors. Default: 10 Minimum: 1	false
updateBufferSize	integer	`updateBufferSize` defines the size of the internal update channel buffer. Default: 100 Minimum: 1	false

FlowCollector.spec.processor.informerCacheProxy.resources

^{↩ Parent}

resources are the compute resources required by the informer cache proxy container. For more information, see https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/

Name	Type	Description	Required
claims	[]object	Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container. This field depends on the DynamicResourceAllocation feature gate. This field is immutable. It can only be set for containers.	false
limits	map[string]int or string	Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/	false
requests	map[string]int or string	Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. Requests cannot exceed Limits. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/	false

FlowCollector.spec.processor.informerCacheProxy.resources.claims[index]

^{↩ Parent}

ResourceClaim references one entry in PodSpec.ResourceClaims.

Name	Type	Description	Required
name	string	Name must match the name of one entry in pod.spec.resourceClaims of the Pod where this field is used. It makes that resource available inside a container.	true
request	string	Request is the name chosen for a request in the referenced claim. If empty, everything from the claim is made available, otherwise only the result of this request.	false

FlowCollector.spec.processor.informerCacheProxy.tls

^{↩ Parent}

tls defines the TLS configuration for the gRPC communication between the informer cache proxy and processors.

Name	Type	Description	Required
type	enum	Select the type of TLS configuration: - `Disabled` to not configure TLS for the k8scache endpoint. Disabling TLS results in a less secure deployment model. - `Provided` to manually provide cert/key references for mTLS. - `Auto` (default) to use a default certificate, which may vary depending on the Kubernetes vendor. - `Auto-mTLS` to preconfigure mTLS with cert-manager. See also: https://github.com/netobserv/netobserv-operator/blob/main/docs/TLS.md. Enum: Disabled, Provided, Auto, Auto-mTLS Default: Auto	true
providedCertificates	object	mTLS configuration when `type` is set to `Provided`. `serverCert` is required. `clientCert` is optional; if provided, mTLS is enabled.	false

FlowCollector.spec.processor.informerCacheProxy.tls.providedCertificates

^{↩ Parent}

mTLS configuration when type is set to Provided. serverCert is required. clientCert is optional; if provided, mTLS is enabled.

Name	Type	Description	Required
caFile	object	Reference to the CA file.	false
clientCert	object	TLS client certificate reference, used for mTLS. Leave unset for simple TLS.	false
serverCert	object	TLS server certificate reference.	false

FlowCollector.spec.processor.informerCacheProxy.tls.providedCertificates.caFile

^{↩ Parent}

Reference to the CA file.

Name	Type	Description	Required
file	string	File name within the config map or secret.	false
name	string	Name of the config map or secret containing the file.	false
namespace	string	Namespace of the config map or secret containing the file. If omitted, the default is to use the same namespace as where NetObserv is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. Default:	false
type	enum	Type for the file reference: `configmap` or `secret`. Enum: configmap, secret	false

FlowCollector.spec.processor.informerCacheProxy.tls.providedCertificates.clientCert

^{↩ Parent}

TLS client certificate reference, used for mTLS. Leave unset for simple TLS.

Name	Type	Description	Required
certFile	string	`certFile` defines the path to the certificate file name within the config map or secret.	false
certKey	string	`certKey` defines the path to the certificate private key file name within the config map or secret. Omit when the key is not necessary.	false
name	string	Name of the config map or secret containing certificates.	false
namespace	string	Namespace of the config map or secret containing certificates. If omitted, the default is to use the same namespace as where NetObserv is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. Default:	false
type	enum	Type for the certificate reference: `configmap` or `secret`. Enum: configmap, secret	false

FlowCollector.spec.processor.informerCacheProxy.tls.providedCertificates.serverCert

^{↩ Parent}

TLS server certificate reference.

Name	Type	Description	Required
certFile	string	`certFile` defines the path to the certificate file name within the config map or secret.	false
certKey	string	`certKey` defines the path to the certificate private key file name within the config map or secret. Omit when the key is not necessary.	false
name	string	Name of the config map or secret containing certificates.	false
namespace	string	Namespace of the config map or secret containing certificates. If omitted, the default is to use the same namespace as where NetObserv is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. Default:	false
type	enum	Type for the certificate reference: `configmap` or `secret`. Enum: configmap, secret	false

FlowCollector.spec.processor.kafkaConsumerAutoscaler

^{↩ Parent}

kafkaConsumerAutoscaler is the spec of a horizontal pod autoscaler to set up for flowlogs-pipeline-transformer, which consumes Kafka messages. This setting is ignored when Kafka is disabled.

Deprecated: managed autoscaler will be removed in a future version. You may configure instead an autoscaler of your choice, and set spec.processor.unmanagedReplicas to true.

Name	Type	Description	Required
maxReplicas	integer	`maxReplicas` is the upper limit for the number of pods that can be set by the autoscaler; cannot be smaller than MinReplicas. Format: int32 Default: 3	false
metrics	[]object	Metrics used by the pod autoscaler. For documentation, refer to https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/horizontal-pod-autoscaler-v2/	false
minReplicas	integer	`minReplicas` is the lower limit for the number of replicas to which the autoscaler can scale down. It defaults to 1 pod. minReplicas is allowed to be 0 if the alpha feature gate HPAScaleToZero is enabled and at least one Object or External metric is configured. Scaling is active as long as at least one metric value is available. Format: int32	false
status	enum	`status` describes the desired status regarding deploying an horizontal pod autoscaler. - `Disabled` does not deploy an horizontal pod autoscaler. - `Enabled` deploys an horizontal pod autoscaler. Enum: Disabled, Enabled Default: Disabled	false

FlowCollector.spec.processor.kafkaConsumerAutoscaler.metrics[index]

^{↩ Parent}

Name	Type	Description	Required
type	string		true
containerResource	object		false
external	object		false
object	object		false
pods	object		false
resource	object		false

FlowCollector.spec.processor.kafkaConsumerAutoscaler.metrics[index].containerResource

^{↩ Parent}

Name	Type	Description	Required
container	string		true
name	string		true
target	object		true

FlowCollector.spec.processor.kafkaConsumerAutoscaler.metrics[index].containerResource.target

^{↩ Parent}

Name	Type	Description	Required
type	string		true
averageUtilization	integer	Format: int32	false
averageValue	int or string		false
value	int or string		false

FlowCollector.spec.processor.kafkaConsumerAutoscaler.metrics[index].external

^{↩ Parent}

Name	Type	Description	Required
metric	object		true
target	object		true

FlowCollector.spec.processor.kafkaConsumerAutoscaler.metrics[index].external.metric

^{↩ Parent}

Name	Type	Description	Required
name	string		true
selector	object		false

FlowCollector.spec.processor.kafkaConsumerAutoscaler.metrics[index].external.metric.selector

^{↩ Parent}

Name	Type	Description	Required
matchExpressions	[]object		false
matchLabels	map[string]string		false

FlowCollector.spec.processor.kafkaConsumerAutoscaler.metrics[index].external.metric.selector.matchExpressions[index]

^{↩ Parent}

Name	Type	Description	Required
key	string		true
operator	string		true
values	[]string		false

FlowCollector.spec.processor.kafkaConsumerAutoscaler.metrics[index].external.target

^{↩ Parent}

Name	Type	Description	Required
type	string		true
averageUtilization	integer	Format: int32	false
averageValue	int or string		false
value	int or string		false

FlowCollector.spec.processor.kafkaConsumerAutoscaler.metrics[index].object

^{↩ Parent}

Name	Type	Description	Required
describedObject	object		true
metric	object		true
target	object		true

FlowCollector.spec.processor.kafkaConsumerAutoscaler.metrics[index].object.describedObject

^{↩ Parent}

Name	Type	Description	Required
kind	string		true
name	string		true
apiVersion	string		false

FlowCollector.spec.processor.kafkaConsumerAutoscaler.metrics[index].object.metric

^{↩ Parent}

Name	Type	Description	Required
name	string		true
selector	object		false

FlowCollector.spec.processor.kafkaConsumerAutoscaler.metrics[index].object.metric.selector

^{↩ Parent}

Name	Type	Description	Required
matchExpressions	[]object		false
matchLabels	map[string]string		false

FlowCollector.spec.processor.kafkaConsumerAutoscaler.metrics[index].object.metric.selector.matchExpressions[index]

^{↩ Parent}

Name	Type	Description	Required
key	string		true
operator	string		true
values	[]string		false

FlowCollector.spec.processor.kafkaConsumerAutoscaler.metrics[index].object.target

^{↩ Parent}

Name	Type	Description	Required
type	string		true
averageUtilization	integer	Format: int32	false
averageValue	int or string		false
value	int or string		false

FlowCollector.spec.processor.kafkaConsumerAutoscaler.metrics[index].pods

^{↩ Parent}

Name	Type	Description	Required
metric	object		true
target	object		true

FlowCollector.spec.processor.kafkaConsumerAutoscaler.metrics[index].pods.metric

^{↩ Parent}

Name	Type	Description	Required
name	string		true
selector	object		false

FlowCollector.spec.processor.kafkaConsumerAutoscaler.metrics[index].pods.metric.selector

^{↩ Parent}

Name	Type	Description	Required
matchExpressions	[]object		false
matchLabels	map[string]string		false

FlowCollector.spec.processor.kafkaConsumerAutoscaler.metrics[index].pods.metric.selector.matchExpressions[index]

^{↩ Parent}

Name	Type	Description	Required
key	string		true
operator	string		true
values	[]string		false

FlowCollector.spec.processor.kafkaConsumerAutoscaler.metrics[index].pods.target

^{↩ Parent}

Name	Type	Description	Required
type	string		true
averageUtilization	integer	Format: int32	false
averageValue	int or string		false
value	int or string		false

FlowCollector.spec.processor.kafkaConsumerAutoscaler.metrics[index].resource

^{↩ Parent}

Name	Type	Description	Required
name	string		true
target	object		true

FlowCollector.spec.processor.kafkaConsumerAutoscaler.metrics[index].resource.target

^{↩ Parent}

Name	Type	Description	Required
type	string		true
averageUtilization	integer	Format: int32	false
averageValue	int or string		false
value	int or string		false

FlowCollector.spec.processor.metrics

^{↩ Parent}

Metrics define the processor configuration regarding metrics

Name	Type	Description	Required
additionalIncludeList	[]enum	`additionalIncludeList` is a list of metric names to include in addition to the default metrics. Unlike `includeList`, this appends to the default list rather than replacing it. This field is mutually exclusive with `includeList`. If `includeList` is set, `additionalIncludeList` is ignored. The names correspond to the names in Prometheus without the prefix. For example, `namespace_egress_packets_total` shows up as `netobserv_namespace_egress_packets_total` in Prometheus. Note that the more metrics you add, the bigger is the impact on Prometheus workload resources. More information, with full list of available metrics: https://github.com/netobserv/netobserv-operator/blob/main/docs/Metrics.md Enum: namespace_egress_bytes_total, namespace_egress_packets_total, namespace_ingress_bytes_total, namespace_ingress_packets_total, namespace_flows_total, node_egress_bytes_total, node_egress_packets_total, node_ingress_bytes_total, node_ingress_packets_total, node_flows_total, workload_egress_bytes_total, workload_egress_packets_total, workload_ingress_bytes_total, workload_ingress_packets_total, workload_flows_total, namespace_drop_bytes_total, namespace_drop_packets_total, node_drop_bytes_total, node_drop_packets_total, workload_drop_bytes_total, workload_drop_packets_total, namespace_rtt_seconds, node_rtt_seconds, workload_rtt_seconds, namespace_dns_latency_seconds, node_dns_latency_seconds, workload_dns_latency_seconds, namespace_dns_flows_total, node_dns_flows_total, workload_dns_flows_total, node_network_policy_events_total, namespace_network_policy_events_total, workload_network_policy_events_total, node_ipsec_flows_total, namespace_ipsec_flows_total, workload_ipsec_flows_total, node_tls_flows_total, namespace_tls_flows_total, workload_tls_flows_total, node_to_node_ingress_flows_total	false
disableAlerts	[]string	`disableAlerts` is a list of alert groups that should be disabled from the default set of alerts. Possible values are: `NetObservNoFlows`, `NetObservLokiError`, `PacketDropsByKernel`, `PacketDropsByDevice`, `IPsecErrors`, `NetpolDenied`, `LatencyHighTrend`, `DNSErrors`, `DNSNxDomain`, `ExternalEgressHighTrend`, `ExternalIngressHighTrend`, `Ingress5xxErrors`, `IngressHTTPLatencyTrend`, `TLSInsecureVersion`. More information on alerts: https://github.com/netobserv/netobserv-operator/blob/main/docs/HealthRules.md	false
healthRules	[]object	`healthRules` is a list of health rules to be created for Prometheus, organized by templates and variants. Each health rule can be configured to generate either alerts or recording rules based on the mode field. More information on health rules: https://github.com/netobserv/netobserv-operator/blob/main/docs/HealthRules.md	false
includeList	[]enum	`includeList` is a list of metric names to specify which ones to generate. The names correspond to the names in Prometheus without the prefix. For example, `namespace_egress_packets_total` shows up as `netobserv_namespace_egress_packets_total` in Prometheus. Note that the more metrics you add, the bigger is the impact on Prometheus workload resources. Metrics enabled by default are: `namespace_flows_total`, `node_ingress_bytes_total`, `node_egress_bytes_total`, `workload_ingress_bytes_total`, `workload_egress_bytes_total`, `namespace_drop_packets_total` (when `PacketDrop` feature is enabled), `namespace_rtt_seconds` (when `FlowRTT` feature is enabled), `namespace_dns_latency_seconds` and `namespace_dns_flows_total` (when `DNSTracking` feature is enabled), `namespace_network_policy_events_total` (when `NetworkEvents` feature is enabled). More information, with full list of available metrics: https://github.com/netobserv/netobserv-operator/blob/main/docs/Metrics.md Enum: namespace_egress_bytes_total, namespace_egress_packets_total, namespace_ingress_bytes_total, namespace_ingress_packets_total, namespace_flows_total, node_egress_bytes_total, node_egress_packets_total, node_ingress_bytes_total, node_ingress_packets_total, node_flows_total, workload_egress_bytes_total, workload_egress_packets_total, workload_ingress_bytes_total, workload_ingress_packets_total, workload_flows_total, namespace_drop_bytes_total, namespace_drop_packets_total, node_drop_bytes_total, node_drop_packets_total, workload_drop_bytes_total, workload_drop_packets_total, namespace_rtt_seconds, node_rtt_seconds, workload_rtt_seconds, namespace_dns_latency_seconds, node_dns_latency_seconds, workload_dns_latency_seconds, namespace_dns_flows_total, node_dns_flows_total, workload_dns_flows_total, node_network_policy_events_total, namespace_network_policy_events_total, workload_network_policy_events_total, node_ipsec_flows_total, namespace_ipsec_flows_total, workload_ipsec_flows_total, node_tls_flows_total, namespace_tls_flows_total, workload_tls_flows_total, node_to_node_ingress_flows_total	false
server	object	Metrics server endpoint configuration for Prometheus scraper	false

FlowCollector.spec.processor.metrics.healthRules[index]

^{↩ Parent}

Name	Type	Description	Required
template	enum	Health rule template name. Possible values are: `PacketDropsByKernel`, `PacketDropsByDevice`, `IPsecErrors`, `NetpolDenied`, `LatencyHighTrend`, `DNSErrors`, `DNSNxDomain`, `ExternalEgressHighTrend`, `ExternalIngressHighTrend`, `Ingress5xxErrors`, `IngressHTTPLatencyTrend`, `TLSInsecureVersion`. Note: `NetObservNoFlows` and `NetObservLokiError` are alert-only and cannot be used as health rules. More information on health rules: https://github.com/netobserv/netobserv-operator/blob/main/docs/HealthRules.md Enum: PacketDropsByKernel, PacketDropsByDevice, IPsecErrors, NetpolDenied, LatencyHighTrend, DNSErrors, DNSNxDomain, ExternalEgressHighTrend, ExternalIngressHighTrend, Ingress5xxErrors, IngressHTTPLatencyTrend, TLSInsecureVersion	true
variants	[]object	A list of variants for this template	true
mode	enum	Mode defines whether this health rule should be generated as an alert or a recording rule. Possible values are: `Alert` (default), `Recording`. Recording rules violations are visible in the Network Health dashboard without generating any Prometheus alert. This provides an alternative way of getting Health information for SRE and cluster admins who may find many new alerts burdensome. Enum: Alert, Recording Default: Alert	false

FlowCollector.spec.processor.metrics.healthRules[index].variants[index]

^{↩ Parent}

Name	Type	Description	Required
thresholds	object	Thresholds of the health rule per severity. They are expressed as a percentage of errors above which the alert is triggered. They must be parsable as floats. Required for both alert and recording modes	true
groupBy	enum	Optional grouping criteria, possible values are: `Node`, `Namespace`, `Workload`. Enum: , Node, Namespace, Workload	false
lowVolumeThreshold	string	The low volume threshold allows to ignore metrics with a too low volume of traffic, in order to improve signal-to-noise. It is provided as an absolute rate (bytes per second or packets per second, depending on the context). When provided, it must be parsable as a float.	false
mode	enum	Mode overrides the health rule mode for this specific variant. If not specified, inherits from the parent health rule's mode. Possible values are: `Alert`, `Recording`. Enum: Alert, Recording	false
trendDuration	string	For trending health rules, the duration interval for baseline comparison. For example, "2h" means comparing against a 2-hours average. Defaults to 2h.	false
trendOffset	string	For trending health rules, the time offset for baseline comparison. For example, "1d" means comparing against yesterday. Defaults to 1d.	false

FlowCollector.spec.processor.metrics.healthRules[index].variants[index].thresholds

^{↩ Parent}

Thresholds of the health rule per severity. They are expressed as a percentage of errors above which the alert is triggered. They must be parsable as floats. Required for both alert and recording modes

Name	Type	Description	Required
critical	string	Threshold for severity `critical`. Leave empty to not generate a Critical alert.	false
info	string	Threshold for severity `info`. Leave empty to not generate an Info alert.	false
warning	string	Threshold for severity `warning`. Leave empty to not generate a Warning alert.	false

FlowCollector.spec.processor.metrics.server

^{↩ Parent}

Metrics server endpoint configuration for Prometheus scraper

Name	Type	Description	Required
port	integer	The metrics server HTTP port. Format: int32 Minimum: 1 Maximum: 65535	false
scrapeInterval	string	Prometheus scraping interval, how often metrics are pulled. Format: duration	false
tls	object	TLS configuration.	false

FlowCollector.spec.processor.metrics.server.tls

^{↩ Parent}

TLS configuration.

Name	Type	Description	Required
type	enum	Select the type of TLS configuration: - `Disabled` (default) to not configure TLS for the endpoint. - `Provided` to manually provide cert file and a key file. - `Auto` to use a default certificate, which may vary depending on the Kubernetes vendor. Refer to https://github.com/netobserv/netobserv-operator/blob/main/docs/TLS.md for more information. Enum: Disabled, Provided, Auto Default: Disabled	true
insecureSkipVerify	boolean	`insecureSkipVerify` allows skipping client-side verification of the provided certificate. If set to `true`, the `providedCaFile` field is ignored. For security, this should not be used other than for testing or demo. Default: false	false
provided	object	TLS configuration when `type` is set to `Provided`.	false
providedCaFile	object	Reference to the CA file when `type` is set to `Provided`.	false

FlowCollector.spec.processor.metrics.server.tls.provided

^{↩ Parent}

TLS configuration when type is set to Provided.

Name	Type	Description	Required
certFile	string	`certFile` defines the path to the certificate file name within the config map or secret.	false
certKey	string	`certKey` defines the path to the certificate private key file name within the config map or secret. Omit when the key is not necessary.	false
name	string	Name of the config map or secret containing certificates.	false
namespace	string	Namespace of the config map or secret containing certificates. If omitted, the default is to use the same namespace as where NetObserv is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. Default:	false
type	enum	Type for the certificate reference: `configmap` or `secret`. Enum: configmap, secret	false

FlowCollector.spec.processor.metrics.server.tls.providedCaFile

^{↩ Parent}

Reference to the CA file when type is set to Provided.

Name	Type	Description	Required
file	string	File name within the config map or secret.	false
name	string	Name of the config map or secret containing the file.	false
namespace	string	Namespace of the config map or secret containing the file. If omitted, the default is to use the same namespace as where NetObserv is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. Default:	false
type	enum	Type for the file reference: `configmap` or `secret`. Enum: configmap, secret	false

FlowCollector.spec.processor.resources

^{↩ Parent}

resources are the compute resources required by this container. For more information, see https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/

Name	Type	Description	Required
claims	[]object	Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container. This field depends on the DynamicResourceAllocation feature gate. This field is immutable. It can only be set for containers.	false
limits	map[string]int or string	Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/	false
requests	map[string]int or string	Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. Requests cannot exceed Limits. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/	false

FlowCollector.spec.processor.resources.claims[index]

^{↩ Parent}

ResourceClaim references one entry in PodSpec.ResourceClaims.

Name	Type	Description	Required
name	string	Name must match the name of one entry in pod.spec.resourceClaims of the Pod where this field is used. It makes that resource available inside a container.	true
request	string	Request is the name chosen for a request in the referenced claim. If empty, everything from the claim is made available, otherwise only the result of this request.	false

FlowCollector.spec.processor.service

^{↩ Parent}

Service configuration, only used when spec.deploymentModel is Service.

Name	Type	Description	Required
tlsType	enum	Select the type of TLS configuration: - `Disabled` to not configure TLS for the endpoint. Disabling TLS results in a less secure deployment model. - `Provided` to manually provide the key and certificate references. - `Auto` (default) to enable automatically based on the running environment. - `Auto-mTLS` to preconfigure mTLS. See also: https://github.com/netobserv/netobserv-operator/blob/main/docs/TLS.md. Enum: Disabled, Provided, Auto, Auto-mTLS Default: Auto	true
providedCertificates	object	TLS or mTLS configuration when `type` is set to `Provided`.	false

FlowCollector.spec.processor.service.providedCertificates

^{↩ Parent}

TLS or mTLS configuration when type is set to Provided.

Name	Type	Description	Required
caFile	object	Reference to the CA file.	false
clientCert	object	TLS client certificate reference, used for mTLS. Leave unset for simple TLS.	false
serverCert	object	TLS server certificate reference.	false

FlowCollector.spec.processor.service.providedCertificates.caFile

^{↩ Parent}

Reference to the CA file.

Name	Type	Description	Required
file	string	File name within the config map or secret.	false
name	string	Name of the config map or secret containing the file.	false
namespace	string	Namespace of the config map or secret containing the file. If omitted, the default is to use the same namespace as where NetObserv is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. Default:	false
type	enum	Type for the file reference: `configmap` or `secret`. Enum: configmap, secret	false

FlowCollector.spec.processor.service.providedCertificates.clientCert

^{↩ Parent}

TLS client certificate reference, used for mTLS. Leave unset for simple TLS.

Name	Type	Description	Required
certFile	string	`certFile` defines the path to the certificate file name within the config map or secret.	false
certKey	string	`certKey` defines the path to the certificate private key file name within the config map or secret. Omit when the key is not necessary.	false
name	string	Name of the config map or secret containing certificates.	false
namespace	string	Namespace of the config map or secret containing certificates. If omitted, the default is to use the same namespace as where NetObserv is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. Default:	false
type	enum	Type for the certificate reference: `configmap` or `secret`. Enum: configmap, secret	false

FlowCollector.spec.processor.service.providedCertificates.serverCert

^{↩ Parent}

TLS server certificate reference.

Name	Type	Description	Required
certFile	string	`certFile` defines the path to the certificate file name within the config map or secret.	false
certKey	string	`certKey` defines the path to the certificate private key file name within the config map or secret. Omit when the key is not necessary.	false
name	string	Name of the config map or secret containing certificates.	false
namespace	string	Namespace of the config map or secret containing certificates. If omitted, the default is to use the same namespace as where NetObserv is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. Default:	false
type	enum	Type for the certificate reference: `configmap` or `secret`. Enum: configmap, secret	false

FlowCollector.spec.processor.slicesConfig

^{↩ Parent}

Global configuration managing FlowCollectorSlices custom resources.

Name	Type	Description	Required
enable	boolean	`enable` determines if the FlowCollectorSlice feature is enabled. If not, all resources of kind FlowCollectorSlice are simply ignored. Default: false	true
collectionMode	enum	`collectionMode` determines how the FlowCollectorSlice custom resources impacts the flow collection process: - When set to `AlwaysCollect`, all flows are collected regardless of the presence of FlowCollectorSlice. - When set to `AllowList`, only the flows related to namespaces where a FlowCollectorSlice resource is present, or configured via the global `namespacesAllowList`, are collected. Enum: AlwaysCollect, AllowList Default: AlwaysCollect	false
namespacesAllowList	[]string	`namespacesAllowList` is a list of namespaces for which flows are always collected, regardless of the presence of FlowCollectorSlice in those namespaces. An entry enclosed by slashes, such as `/openshift-.*/`, is matched as a regular expression. This setting is ignored if `collectionMode` is different from `AllowList`.	false

FlowCollector.spec.processor.subnetLabels

^{↩ Parent}

subnetLabels allows to define custom labels on subnets and IPs and, for supported vendors, to enable automatic labeling of recognized subnets, which is used to identify cluster external traffic. When a subnet matches the source or destination IP of a flow, a corresponding field is added: SrcSubnetLabel or DstSubnetLabel.

Name	Type	Description	Required
autoDetect	boolean	`autoDetect` allows, when set to `true`, to detect automatically the machines, pods and services subnets based on vendor-specific configuration. It requires a vendor-specific implementation. Indirectly, this is a way to accurately detect external traffic: flows that are not labeled for those subnets are external to the cluster. Enabled by default.	false
customLabels	[]object	`customLabels` allows you to customize subnets and IPs labeling, such as to identify cluster external workloads or web services. External subnets must be labeled with the prefix `EXT:`, or not labeled at all, in order to work with default quick filters and some metrics examples provided. If `autoDetect` is disabled or your Kubernetes vendor has no auto-detection implemented, it is recommended to manually configure labels for the cluster subnets, to distinguish internal traffic from external traffic. If `autoDetect` is enabled, `customLabels` overrides the detected subnets when they overlap.	false
openShiftAutoDetect	boolean	`openShiftAutoDetect` allows, when set to `true`, to detect automatically the machines, pods and services subnets based on vendor-specific configuration. Indirectly, this is a way to accurately detect external traffic: flows that are not labeled for those subnets are external to the cluster. Deprecated: use autoDetect instead.	false

FlowCollector.spec.processor.subnetLabels.customLabels[index]

^{↩ Parent}

SubnetLabel allows to label subnets and IPs, such as to identify cluster-external workloads or web services.

Name	Type	Description	Required
cidrs	[]string	List of CIDRs, such as `["1.2.3.4/32"]`.	true
name	string	Label name, used to flag matching flows. External subnets must be labeled with the prefix `EXT:`, or not labeled at all, in order to work with default quick filters and some metrics examples provided.	true

FlowCollector.spec.prometheus

^{↩ Parent}

prometheus defines Prometheus settings, such as querier configuration used to fetch metrics from the Console plugin.

Name	Type	Description	Required
querier	object	Prometheus querying configuration, such as client settings, used in the Console plugin.	false

FlowCollector.spec.prometheus.querier

^{↩ Parent}

Prometheus querying configuration, such as client settings, used in the Console plugin.

Name	Type	Description	Required
mode	enum	`mode` must be set according to the type of Prometheus installation that stores NetObserv metrics: - Use `Auto` to try configuring automatically for known vendors. - Use `Manual` for a manual setup. Enum: Manual, Auto Default: Auto	true
enable	boolean	When `enable` is `true`, the Console plugin queries flow metrics from Prometheus instead of Loki whenever possible. It is enabled by default: set it to `false` to disable this feature. The Console plugin can use either Loki or Prometheus as a data source for metrics (see also `spec.loki`), or both. Not all queries are transposable from Loki to Prometheus. Hence, if Loki is disabled, some features of the plugin are disabled as well, such as getting per-pod information or viewing raw flows. If both Prometheus and Loki are enabled, Prometheus takes precedence and Loki is used as a fallback for queries that Prometheus cannot handle. If they are both disabled, the Console plugin is not deployed. Default: true	false
manual	object	Prometheus configuration for `Manual` mode.	false
timeout	string	`timeout` is the read timeout for console plugin queries to Prometheus. A timeout of zero means no timeout. Default: 30s	false

FlowCollector.spec.prometheus.querier.manual

^{↩ Parent}

Prometheus configuration for Manual mode.

Name	Type	Description	Required
alertManager	object	AlertManager configuration. This is used in the console to query silenced alerts, for displaying health information.	false
forwardUserToken	boolean	Set `true` to forward logged in user token in queries to Prometheus	false
tls	object	TLS client configuration for Prometheus URL.	false
url	string	`url` is the address of an existing Prometheus service to use for querying metrics. Default: http://prometheus:9090	false

FlowCollector.spec.prometheus.querier.manual.alertManager

^{↩ Parent}

AlertManager configuration. This is used in the console to query silenced alerts, for displaying health information.

Name	Type	Description	Required
tls	object	TLS client configuration for Prometheus AlertManager URL.	false
url	string	`url` is the address of an existing Prometheus AlertManager service to use for querying alerts.	false

FlowCollector.spec.prometheus.querier.manual.alertManager.tls

^{↩ Parent}

TLS client configuration for Prometheus AlertManager URL.

Name	Type	Description	Required
caCert	object	`caCert` defines the reference of the certificate for the Certificate Authority.	false
enable	boolean	Enable TLS Default: false	false
insecureSkipVerify	boolean	`insecureSkipVerify` allows skipping client-side verification of the server certificate. If set to `true`, the `caCert` field is ignored. For security, this should not be used other than for testing or demo. Default: false	false
userCert	object	`userCert` defines the user certificate reference and is used for mTLS. When you use one-way TLS, you can ignore this property.	false

FlowCollector.spec.prometheus.querier.manual.alertManager.tls.caCert

^{↩ Parent}

caCert defines the reference of the certificate for the Certificate Authority.

Name	Type	Description	Required
certFile	string	`certFile` defines the path to the certificate file name within the config map or secret.	false
certKey	string	`certKey` defines the path to the certificate private key file name within the config map or secret. Omit when the key is not necessary.	false
name	string	Name of the config map or secret containing certificates.	false
namespace	string	Namespace of the config map or secret containing certificates. If omitted, the default is to use the same namespace as where NetObserv is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. Default:	false
type	enum	Type for the certificate reference: `configmap` or `secret`. Enum: configmap, secret	false

FlowCollector.spec.prometheus.querier.manual.alertManager.tls.userCert

^{↩ Parent}

userCert defines the user certificate reference and is used for mTLS. When you use one-way TLS, you can ignore this property.

Name	Type	Description	Required
certFile	string	`certFile` defines the path to the certificate file name within the config map or secret.	false
certKey	string	`certKey` defines the path to the certificate private key file name within the config map or secret. Omit when the key is not necessary.	false
name	string	Name of the config map or secret containing certificates.	false
namespace	string	Namespace of the config map or secret containing certificates. If omitted, the default is to use the same namespace as where NetObserv is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. Default:	false
type	enum	Type for the certificate reference: `configmap` or `secret`. Enum: configmap, secret	false

FlowCollector.spec.prometheus.querier.manual.tls

^{↩ Parent}

TLS client configuration for Prometheus URL.

Name	Type	Description	Required
caCert	object	`caCert` defines the reference of the certificate for the Certificate Authority.	false
enable	boolean	Enable TLS Default: false	false
insecureSkipVerify	boolean	`insecureSkipVerify` allows skipping client-side verification of the server certificate. If set to `true`, the `caCert` field is ignored. For security, this should not be used other than for testing or demo. Default: false	false
userCert	object	`userCert` defines the user certificate reference and is used for mTLS. When you use one-way TLS, you can ignore this property.	false

FlowCollector.spec.prometheus.querier.manual.tls.caCert

^{↩ Parent}

caCert defines the reference of the certificate for the Certificate Authority.

Name	Type	Description	Required
certFile	string	`certFile` defines the path to the certificate file name within the config map or secret.	false
certKey	string	`certKey` defines the path to the certificate private key file name within the config map or secret. Omit when the key is not necessary.	false
name	string	Name of the config map or secret containing certificates.	false
namespace	string	Namespace of the config map or secret containing certificates. If omitted, the default is to use the same namespace as where NetObserv is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. Default:	false
type	enum	Type for the certificate reference: `configmap` or `secret`. Enum: configmap, secret	false

FlowCollector.spec.prometheus.querier.manual.tls.userCert

^{↩ Parent}

userCert defines the user certificate reference and is used for mTLS. When you use one-way TLS, you can ignore this property.

Name	Type	Description	Required
certFile	string	`certFile` defines the path to the certificate file name within the config map or secret.	false
certKey	string	`certKey` defines the path to the certificate private key file name within the config map or secret. Omit when the key is not necessary.	false
name	string	Name of the config map or secret containing certificates.	false
namespace	string	Namespace of the config map or secret containing certificates. If omitted, the default is to use the same namespace as where NetObserv is deployed. If the namespace is different, the config map or the secret is copied so that it can be mounted as required. Default:	false
type	enum	Type for the certificate reference: `configmap` or `secret`. Enum: configmap, secret	false

FlowCollector.status

^{↩ Parent}

FlowCollectorStatus defines the observed state of FlowCollector

Name	Type	Description	Required
conditions	[]object	`conditions` represents the latest available observations of an object's state	true
components	object	`components` reports the status of operator-managed components (agent, processor, plugin).	false
integrations	object	`integrations` reports the status of external integrations (Loki, monitoring, exporters).	false
namespace	string	Namespace where console plugin and flowlogs-pipeline have been deployed. Deprecated: annotations are used instead	false

FlowCollector.status.conditions[index]

^{↩ Parent}

Condition contains details for one aspect of the current state of this API Resource.

Name	Type	Description	Required
lastTransitionTime	string	lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. Format: date-time	true
message	string	message is a human readable message indicating details about the transition. This may be an empty string.	true
reason	string	reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.	true
status	enum	status of the condition, one of True, False, Unknown. Enum: True, False, Unknown	true
type	string	type of condition in CamelCase or in foo.example.com/CamelCase.	true
observedGeneration	integer	observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. Format: int64 Minimum: 0	false

FlowCollector.status.components

^{↩ Parent}

components reports the status of operator-managed components (agent, processor, plugin).

Name	Type	Description	Required
agent	object	`agent` reports the status of the eBPF agent component.	false
plugin	object	`plugin` reports the status of the console plugin component.	false
processor	object	`processor` reports the status of the flowlogs-pipeline component.	false

FlowCollector.status.components.agent

^{↩ Parent}

agent reports the status of the eBPF agent component.

Name	Type	Description	Required
state	enum	`state` reports the overall health of the component. Enum: Ready, InProgress, Failure, Degraded, Unknown, Unused	true
desiredReplicas	integer	`desiredReplicas` is the desired number of replicas (for Deployments) or nodes (for DaemonSets). Format: int32	false
message	string	`message` is a human-readable description of the component's current state.	false
podIssues	string	`podIssues` is a summary of unhealthy pod issues (e.g., "3 pods CrashLoopBackOff: kafka connection refused").	false
readyReplicas	integer	`readyReplicas` is the number of ready replicas (for Deployments) or up-to-date nodes (for DaemonSets). Format: int32	false
reason	string	`reason` is a one-word CamelCase reason for the component's current state.	false
unhealthyPodCount	integer	`unhealthyPodCount` is the number of pods in a degraded state (CrashLoopBackOff, OOMKilled, etc.). Format: int32	false

FlowCollector.status.components.plugin

^{↩ Parent}

plugin reports the status of the console plugin component.

Name	Type	Description	Required
state	enum	`state` reports the overall health of the component. Enum: Ready, InProgress, Failure, Degraded, Unknown, Unused	true
desiredReplicas	integer	`desiredReplicas` is the desired number of replicas (for Deployments) or nodes (for DaemonSets). Format: int32	false
message	string	`message` is a human-readable description of the component's current state.	false
podIssues	string	`podIssues` is a summary of unhealthy pod issues (e.g., "3 pods CrashLoopBackOff: kafka connection refused").	false
readyReplicas	integer	`readyReplicas` is the number of ready replicas (for Deployments) or up-to-date nodes (for DaemonSets). Format: int32	false
reason	string	`reason` is a one-word CamelCase reason for the component's current state.	false
unhealthyPodCount	integer	`unhealthyPodCount` is the number of pods in a degraded state (CrashLoopBackOff, OOMKilled, etc.). Format: int32	false

FlowCollector.status.components.processor

^{↩ Parent}

processor reports the status of the flowlogs-pipeline component.

Name	Type	Description	Required
state	enum	`state` reports the overall health of the component. Enum: Ready, InProgress, Failure, Degraded, Unknown, Unused	true
desiredReplicas	integer	`desiredReplicas` is the desired number of replicas (for Deployments) or nodes (for DaemonSets). Format: int32	false
message	string	`message` is a human-readable description of the component's current state.	false
podIssues	string	`podIssues` is a summary of unhealthy pod issues (e.g., "3 pods CrashLoopBackOff: kafka connection refused").	false
readyReplicas	integer	`readyReplicas` is the number of ready replicas (for Deployments) or up-to-date nodes (for DaemonSets). Format: int32	false
reason	string	`reason` is a one-word CamelCase reason for the component's current state.	false
unhealthyPodCount	integer	`unhealthyPodCount` is the number of pods in a degraded state (CrashLoopBackOff, OOMKilled, etc.). Format: int32	false

FlowCollector.status.integrations

^{↩ Parent}

integrations reports the status of external integrations (Loki, monitoring, exporters).

Name	Type	Description	Required
exporters	[]object	`exporters` reports the status of configured exporters.	false
loki	object	`loki` reports the status of the Loki integration.	false
monitoring	object	`monitoring` reports the status of monitoring (dashboards, ServiceMonitor, etc.).	false

FlowCollector.status.integrations.exporters[index]

^{↩ Parent}

FlowCollectorExporterStatus represents the status of a configured exporter.

Name	Type	Description	Required
name	string	`name` is a generated identifier for this exporter (e.g., "kafka-export-0"), derived from its type and position in spec.exporters.	true
state	enum	`state` reports the health of this exporter. Enum: Ready, InProgress, Failure, Degraded, Unknown	true
type	enum	`type` is the exporter type (Kafka, IPFIX, OpenTelemetry). Enum: Kafka, IPFIX, OpenTelemetry	true
message	string	`message` is a human-readable description of the exporter's current state.	false
reason	string	`reason` is a one-word CamelCase reason for the exporter's current state.	false

FlowCollector.status.integrations.loki

^{↩ Parent}

loki reports the status of the Loki integration.

Name	Type	Description	Required
state	enum	`state` reports the overall health of the component. Enum: Ready, InProgress, Failure, Degraded, Unknown, Unused	true
desiredReplicas	integer	`desiredReplicas` is the desired number of replicas (for Deployments) or nodes (for DaemonSets). Format: int32	false
message	string	`message` is a human-readable description of the component's current state.	false
podIssues	string	`podIssues` is a summary of unhealthy pod issues (e.g., "3 pods CrashLoopBackOff: kafka connection refused").	false
readyReplicas	integer	`readyReplicas` is the number of ready replicas (for Deployments) or up-to-date nodes (for DaemonSets). Format: int32	false
reason	string	`reason` is a one-word CamelCase reason for the component's current state.	false
unhealthyPodCount	integer	`unhealthyPodCount` is the number of pods in a degraded state (CrashLoopBackOff, OOMKilled, etc.). Format: int32	false

FlowCollector.status.integrations.monitoring

^{↩ Parent}

monitoring reports the status of monitoring (dashboards, ServiceMonitor, etc.).

Name	Type	Description	Required
state	enum	`state` reports the overall health of the component. Enum: Ready, InProgress, Failure, Degraded, Unknown, Unused	true
desiredReplicas	integer	`desiredReplicas` is the desired number of replicas (for Deployments) or nodes (for DaemonSets). Format: int32	false
message	string	`message` is a human-readable description of the component's current state.	false
podIssues	string	`podIssues` is a summary of unhealthy pod issues (e.g., "3 pods CrashLoopBackOff: kafka connection refused").	false
readyReplicas	integer	`readyReplicas` is the number of ready replicas (for Deployments) or up-to-date nodes (for DaemonSets). Format: int32	false
reason	string	`reason` is a one-word CamelCase reason for the component's current state.	false
unhealthyPodCount	integer	`unhealthyPodCount` is the number of pods in a degraded state (CrashLoopBackOff, OOMKilled, etc.). Format: int32	false