OSDOCS-14862 NETOBSERV 1.9 Features, Bugs, Known Issues

[gwynnemonahan]

https://issues.redhat.com/browse/OSDOCS-14862 NETOBSERV 1.9 Features, Bugs, Known Issues

Version(s):
Merge to only the no-1.9 branch - no cherrypicks are required.
I will open one PR against main to incorporate all of the NetObserv content just before its GA.

Issue:
https://issues.redhat.com/browse/OSDOCS-14862

Link to docs preview:

• 1.9 Release notes: https://94440--ocpdocs-pr.netlify.app/openshift-enterprise/latest/observability/network_observability/network-observability-operator-release-notes.html#network-observability-operator-release-notes-1-9_network-observability-operator-release-notes-v1-9
• 1.9 New features and enhancements: https://94440--ocpdocs-pr.netlify.app/openshift-enterprise/latest/observability/network_observability/network-observability-operator-release-notes.html#new-features-and-enhancements
• 1.9 Notable technical changes https://94440--ocpdocs-pr.netlify.app/openshift-enterprise/latest/observability/network_observability/network-observability-operator-release-notes.html#notable-technical-changes-1-9_network-observability-operator-release-notes-v1-9
• 1.9 Technology preview features: https://94440--ocpdocs-pr.netlify.app/openshift-enterprise/latest/observability/network_observability/network-observability-operator-release-notes.html#network-observability-technology-preview-1-9_network-observability-operator-release-notes-v1-9
• 1.9 CVEs: https://94440--ocpdocs-pr.netlify.app/openshift-enterprise/latest/observability/network_observability/network-observability-operator-release-notes.html#network-observability-operator-CVE-1-9_network-observability-operator-release-notes-v1-9
• 1.9 Bug fixes: https://94440--ocpdocs-pr.netlify.app/openshift-enterprise/latest/observability/network_observability/network-observability-operator-release-notes.html#network-observability-operator-1-9-bug-fixes_network-observability-operator-release-notes-v1-9
• 1.9 Known issues: https://94440--ocpdocs-pr.netlify.app/openshift-enterprise/latest/observability/network_observability/network-observability-operator-release-notes.html#network-observability-operator-1-9-known-issues_network-observability-operator-release-notes-v1-9

QE review:

• QE has approved this change.

Additional information:
06/24/2025:

See #95159. All content from previously merged PRs vanished from the no-1.9 branch, and are appearing in any open PR against no-1.9. Hopefully merging 95159 and a rebase will resolve things.

[ocpdocs-previewbot]

🤖 Wed Jul 02 14:32:57 - Prow CI generated the docs preview:

https://94440--ocpdocs-pr.netlify.app/openshift-enterprise/latest/observability/network_observability/network-observability-operator-release-notes.html
https://94440--ocpdocs-pr.netlify.app/openshift-enterprise/latest/observability/network_observability/observing-network-traffic.html

[memodi]

/cc @memodi

[jotak]

thanks @gwynnemonahan LGTM

[gwynnemonahan]

/label peer-review-needed

[gwynnemonahan]

Advisory is available, link has been added, prompting new checks.

PR also needed rebasing.

[stevsmit]

Mostly good. Smaller nits.

[openshift-ci]

@gwynnemonahan: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[gwynnemonahan]

/label merge-review-needed

[JoeAldinger]

No big deal breakers, but some suggestions that might help.

[JoeAldinger]

Suggested change

	With this release, you can create filters to reduce the number of generated network flows and the resource usage of Network Observability components.
	With this release, you can create filters to reduce the number of generated network flows and the resource usage of Network Observability components. The following filters can be configured:

[JoeAldinger]

Suggested change

You can configure the following filters:

[JoeAldinger]

I agree with Steven here and think this needs to be updated if not for this release for future. If you aren't going to use the definition list these at least need nouns after the literals. I think command is the correct noun for all of these.

[JoeAldinger]

Suggested change

* The `NetworkEvents` feature in Network Observability 1.9 has been updated to work with the newer Linux kernel of {product-title} 4.19. This update breaks compatibility with older kernels. As a result, the `NetworkEvents` feature can only be used with {product-title} 4.19. If you are using this feature with Network Observability 1.8 and {product-title} 4.18, consider avoiding a Network Observability upgrade or upgrading Network Observability to 1.9 and {product-title} to 4.19.

* The `NetworkEvents` feature in Network Observability 1.9 has been updated to work with the newer Linux kernel of {product-title} 4.19. This update breaks compatibility with older kernels. As a result, the `NetworkEvents` feature can only be used with {product-title} 4.19. If you are using this feature with Network Observability 1.8 and {product-title} 4.18, consider avoiding a Network Observability upgrade or upgrade to Network Observability 1.9 and {product-title} to 4.19.

[JoeAldinger]

What are these parameters, fields, values, CR? Can you add nouns to help the user understand what these are?

[JoeAldinger]

69-71 seem redundant to me if you are going to use the TP snippet.

[JoeAldinger]

Suggested change

	* Previously, users could not sort flows by *Bytes* or *Packets* in the *Traffic* flows view of the Console plugin. With this update, users can sort flows by *Bytes* and *Packets*.(link:https://issues.redhat.com/browse/NETOBSERV-2239[*NETOBSERV-2239*])
	* Previously, users could not sort flows by *Bytes* or *Packets* in the *Traffic* flows view of the Console plugin. With this update, users can sort flows by *Bytes* and *Packets*. (link:https://issues.redhat.com/browse/NETOBSERV-2239[*NETOBSERV-2239*])

[JoeAldinger]

Suggested change

	* Previously, some of the warnings sent from the Operator validation webhook could lack clarity, such as when not mentioning exactly which feature causes the warning, or what needed to be done. With this update, some of these messages have been reviewed and amended to make them more actionable. (link:https://issues.redhat.com/browse/NETOBSERV-2178[*NETOBSERV-2178*])
	* Previously, some of the warnings sent from the Operator validation webhook could lack clarity on what needed to be done. With this update, some of these messages have been reviewed and amended to make them more actionable. (link:https://issues.redhat.com/browse/NETOBSERV-2178[*NETOBSERV-2178*])

[JoeAldinger]

Suggested change

* Previously, when using conversation tracking (`logTypes: Conversations` or `logTypes: All` in the `FlowCollector` resource), the *Traffic* rates metrics visible in the dashboards were flawed, wrongly showing an out-of-control increase in traffic. Now, the metrics show more accurate traffic rates. However, note that in `Conversations` and `EndedConversations` modes, these metrics are still not 100% accurate as they don't include long-standing connections. This information has been added to the documentation. The default mode `logTypes: Flows`, is recommended to avoid this kind of inaccuracy. (link:https://issues.redhat.com/browse/NETOBSERV-1955[*NETOBSERV-1955*])

* Previously, when using conversation tracking (`logTypes: Conversations` or `logTypes: All` in the `FlowCollector` resource), the *Traffic* rates metrics visible in the dashboards were flawed, wrongly showing an out-of-control increase in traffic. Now, the metrics show more accurate traffic rates. However, note that in `Conversations` and `EndedConversations` modes, these metrics are still not completely accurate as they do not include long-standing connections. This information has been added to the documentation. The default mode `logTypes: Flows` is recommended to avoid these inaccuracy. (link:https://issues.redhat.com/browse/NETOBSERV-1955[*NETOBSERV-1955*])

[JoeAldinger]

Suggested change

* In some rare cases, the eBPF agent is unable to appropriately correlate flows with the involved interfaces when running in privileged modes with several network namespaces. A large part of these issues have been identified and resolved in this release, but some inconsistencies remain, especially with the `ens5` interface. (link:https://issues.redhat.com/browse/NETOBSERV-2287[*NETOBSERV-2287*])

* In some rare cases, the eBPF agent is unable to appropriately correlate flows with the involved interfaces when running in `privileged` modes with several network namespaces. A large part of these issues have been identified and resolved in this release, but some inconsistencies remain, especially with the `ens5` interface. (link:https://issues.redhat.com/browse/NETOBSERV-2287[*NETOBSERV-2287*])

[JoeAldinger]

merge review completed.