[Proposal] A new PacketSampling CRD

[hangyan]

Describe what you are trying to solve

Traceflow works well for network flow diagnose, but sometimes users may want to take a look into the raw packet in the flow. Currently, antrea lacks the ability to capture raw packet in live traffic.

Describe the solution you have in mind

Add a new CRD to support the packet sampling future. This future will allow user to capture raw packet data for further diagnose.

apiVersion: crd.antrea.io/v1alpha1
kind: PacketSampling
metadata:
  name: tf-test
spec:
  timeout: 60             # a hard limit for all sampling session
  type: FirstNSampling    # support one type first
  parameters: 
    number: 15            # the number of packets to be captured
  source:                 # same selector as Traceflow
    namespace: default
    pod: tcp-sts-0
  destination:
    namespace: default
    pod: tcp-sts-2   
  packet:
    ipHeader: 
      protocol: 6 
    transportHeader:
      tcp:
        srcPort: 10000 
        dstPort: 80 
  fileServer:
    url: sftp://youtestdomain.com:22/root/test
  authentication:
    authType: “BasicAuthenticaion“
    authSecret:
      name: support-bundle-secret
      namespace: default

Describe how your solution impacts user flows

The default (first supported) capture method will have great peformance impact on user flows, see #5345 (comment)

Describe the main design/architecture of your solution

design doc

Alternative solutions that you considered

extend the current Traceflow CRD
Test plan

Additional context

[luolanzone]

@hangyan please help to estimate the implementation efforts for the new design, and help to confirm if this can be included in Antrea 1.14 or not. Thanks.

[hangyan]

@shi0rik0 Please take a look if you are interested.

[github-actions]

This issue is stale because it has been open 90 days with no activity. Remove stale label or comment, or this will be closed in 90 days

[github-actions]

This issue is stale because it has been open 90 days with no activity. Remove stale label or comment, or this will be closed in 90 days