otterize / network-mapper

Map Kubernetes traffic: in-cluster, to the Internet, and to AWS IAM and export as text, intents, or an image
Apache License 2.0
612 stars 23 forks source link

Add support for reporting direct pod traffic from AWS ALB and similar ingress controllers to Otterize Cloud #235

Closed orishoshan closed 1 month ago

orishoshan commented 2 months ago

Description

When external traffic originates outside the cluster, the network mapper resolves the destination with the assumption that it is directed at a Service of type NodePort or type LoadBalancer. However, when an ingress controller that is hosted outside the cluster is used (such as AWS ALB), the traffic from outside the cluster can be directed at a particular Pod's IP.

Also supports detecting control plane as source. Fixes bug where destinations which were pods (and not Services) wasn't detected for incoming external traffic.

This PR adds logic for handling this case, such that the traffic is reporting to Otterize Cloud as originating from the Internet.