otterize / network-mapper

Map Kubernetes traffic: in-cluster, to the Internet, and to AWS IAM and export as text, intents, or an image
Apache License 2.0
612 stars 23 forks source link

Validate that packet belongs to resolved pod by verifying timestamp #116

Closed NetanelBollag closed 1 year ago

NetanelBollag commented 1 year ago

This PR makes the mapper ignores results from deleted pods or pods that have been terminated. This is to mitigate a rare risk of inaccurate data being discovered in AWS. EKS may reuse IP addresses and when configuring the node group with more pods per node than recommended and rapidly deleting\creating pods the chances for reuse increase.

We also ignore the result if the resolved Pod is terminated since controller-run time cache updates can be received in meaningful delay when cluster resources are exhausted. This means that a new communication seen only when the pod is terminated will be ignored, but it's important mitigation to avoid resolving inaccurate data.

This PR also increases the default timeout of sniffer reporting to make sure the mapper will receive the data even in high-latency communication.