netobserv.io

What It Is

NetObserv is a set of network observability components for Kubernetes / OpenShift. It uses eBPF agents to generate network flows at the kernel level, then enriches them through a configurable pipeline that understands Kubernetes semantics. The data can ultimately be exported as logs, metrics, Kafka, IPFIX, and more, with topology views, traffic views, overview dashboards, and a CLI. In OpenShift, it is distributed as the Network Observability Operator.

Core Capabilities

Based on the documentation, NetObserv covers several key areas for cluster network troubleshooting: north-south / east-west traffic identification, DNS name tracking, subnet labels for external traffic, flow matrix, IPsec encryption/decryption status, packet drops, RTT, network events, UDN mapping, and Packet Translation. The latter can further correlate virtual access to a Kubernetes Service with the actual backend Pod, helping identify the real service endpoint behind load balancing. The CLI supports on-demand capture of flows and packets, with filters such as peer IP, port, protocol, and node selector.

Deployment, Ecosystem, and Documentation

The project is explicitly described as fully open-source. It can be used independently or deployed via a Kubernetes Operator. Its ecosystem integrations are fairly broad, covering PrometheusRules, Istio demo, Loki, Kafka, IPFIX, OpenTelemetry, Wireshark, OVN-Kubernetes, libreswan/IPsec, and more. However, some capabilities are CNI-dependent, such as network policy event monitoring. Features such as UDN are also described as Developer Preview / TechPreview, so their maturity should be validated before production adoption. The collected documentation includes many commands, YAML examples, and troubleshooting scenarios, making the hands-on guides fairly detailed, but it does not show a complete API reference or compatibility matrix.

Pricing and Support

The source material does not provide commercial pricing; it only states that the project is fully open-source and available on GitHub. If used through Red Hat OpenShift, OpenShift subscriptions and support may be involved, but the collected text does not specify any SLA, paid tiers, or payment methods.

Pros, Cons, and Who It’s For

Its strengths are being non-intrusive, having strong Kubernetes semantics, and covering a wide range of troubleshooting dimensions. It is well suited to platform engineering, SRE, networking, and security teams. Its limitations are that it focuses mainly on Kubernetes/OpenShift scenarios, with limited information on traditional network adaptation; full capture or sampling=1 may also create resource pressure. The source material does not mention accessibility from China. GitHub, Quay, and Red Hat-related images and documentation may be unstable on mainland Chinese networks, so users should verify this themselves. Alternatives worth considering include Cilium Hubble, Pixie, Kiali, and OpenTelemetry Collector.