Look up Network Observer configuration options¶

Configure the Skupper Network Observer, which enables the network console.

Console access parameters¶

Configure access to the Network Observer console using Ingress or OpenShift Routes.

Ingress¶

Path	Type	Default	Description
`ingress.enabled`	bool	`false`	Enable Kubernetes Ingress resource
`ingress.className`	string	`""`	IngressClass name (e.g., `nginx`, `traefik`)
`ingress.annotations`	map	`{}`	Annotations for Ingress resource
`ingress.hosts`	array	`[]`	Host configurations
`ingress.hosts[].host`	string	-	Hostname
`ingress.hosts[].paths`	array	-	Path configurations
`ingress.hosts[].paths[].path`	string	-	URL path
`ingress.hosts[].paths[].pathType`	string	-	`Prefix`, `Exact`, or `ImplementationSpecific`
`ingress.tls`	array	`[]`	TLS configurations
`ingress.tls[].secretName`	string	-	TLS certificate Secret name
`ingress.tls[].hosts`	array	-	Hostnames for this certificate

Notes: - Backend always uses HTTPS (re-encryption required) - Controller must support TLS backend

Route (OpenShift)¶

Path	Type	Default	Description
`route.enabled`	bool	`false`	Enable OpenShift Route resource
`route.host`	string	`""`	Explicit hostname
`route.subdomain`	string	`""`	Subdomain for automatic FQDN
`route.annotations`	map	`{}`	Route annotations
`route.labels`	map	`{}`	Route labels

Notes: - Automatically uses reencrypt TLS termination - Use host OR subdomain, not both - OpenShift only

Authentication options¶

Configure the authentication strategy for the Network Observer console.

Authentication strategy¶

Path	Type	Default	Description
`auth.strategy`	string	`"basic"`	Authentication strategy: `basic`, `openshift`, `none`

Basic Authentication¶

Path	Type	Default	Description
`auth.basic.create`	bool	`true`	Auto-generate htpasswd Secret with random password
`auth.basic.secretName`	string	`""`	Existing htpasswd Secret name (requires `htpasswd` key)

Generated credentials: - Username: skupper - Password: Random 16-character string (stored in Secret)

OpenShift OAuth¶

Path	Type	Default	Description
`auth.openshift.createCookieSecret`	bool	`true`	Auto-generate session cookie secret
`auth.openshift.cookieSecretName`	string	`""`	Existing cookie Secret name
`auth.openshift.serviceAccount.create`	bool	`true`	Create ServiceAccount for OAuth
`auth.openshift.serviceAccount.nameOverride`	string	`""`	Custom ServiceAccount name

Requirements: - OpenShift cluster - RBAC permissions for delegated authentication

TLS certificate requirements¶

Configure how TLS certificates are provisioned for the Network Observer.

TLS certificate options¶

Path	Type	Default	Description
`tls.skupperIssued`	bool	`true`	Use Skupper controller CA (default)
`tls.openshiftIssued`	bool	`false`	Use OpenShift Service CA
`tls.secretName`	string	`""`	Existing TLS Secret name

Priority: secretName > openshiftIssued > skupperIssued

Methods: - Skupper-issued: Auto-provisioned by controller, uses same CA as inter-site links - OpenShift Service CA: Platform-issued, automatic rotation - External: Manual management, Secret type kubernetes.io/tls

Router connection settings¶

Configure how the Network Observer connects to the Skupper router.

Router connection settings¶

Path	Type	Default	Description
`router.endpoint`	string	`"amqps://skupper-router-local"`	AMQP endpoint URL
`router.certificate.create`	bool	`true`	Auto-create client certificate
`router.certificate.nameOverride`	string	`""`	Custom certificate name

Notes: - Endpoint must use amqps:// scheme - Client certificate provisioned by Skupper controller - Certificate mounted at /etc/messaging/

Runtime behavior properties¶

Configure command-line flags and runtime behavior for the Network Observer container.

Extra arguments¶

Path	Type	Default	Description
`extraArgs`	array	`[]`	Command-line flags for observer container

Available flags¶

Flag	Type	Default	Description
`-enable-console`	bool	`true`	Enable web console UI
`-flow-record-ttl`	duration	`15m`	Flow record retention time
`-cors-allow-all`	bool	`false`	Allow all CORS origins (dev only)
`-vanflow-logging-profile`	string	`silent`	Vanflow logging: `silent`, `minimal`, `moderate`, `all`

Example:

extraArgs:
  - -flow-record-ttl=1h
  - -vanflow-logging-profile=minimal

Prometheus parameters¶

The Prometheus container supports custom configuration and tuning options.

Configuration File¶

Path	Type	Default	Description
`prometheus.config`	string	embedded	Complete `prometheus.yml` content

Default scrape config:

scrape_configs:
  - job_name: 'network-observer'
    static_configs:
      - targets: ['localhost:8080']

Command-Line Flags¶

Path	Type	Default	Description
`prometheus.extraArgs`	array	`[]`	Additional Prometheus flags

Common flags: - --storage.tsdb.retention.time=<duration> - --storage.tsdb.retention.size=<bytes> - --query.max-samples=<int>

Example:

prometheus:
  extraArgs:
    - --storage.tsdb.retention.time=15d
    - --storage.tsdb.retention.size=10GB

Extra Volumes and Mounts¶

Path	Type	Default	Description
`prometheus.extraVolumes`	array	`[]`	Additional volumes (Kubernetes volume spec)
`prometheus.extraVolumeMounts`	array	`[]`	Volume mount points (Kubernetes volumeMount spec)

Example:

prometheus:
  extraVolumes:
    - name: extra-config
      configMap:
        name: prometheus-rules
  extraVolumeMounts:
    - name: extra-config
      mountPath: /etc/prometheus/rules

Configure persistent storage¶

By default, Prometheus uses ephemeral storage (emptyDir). For persistent time-series data, enable a PersistentVolumeClaim.

Persistence Options¶

Path	Type	Default	Description
`prometheus.persistence.enabled`	bool	`false`	Enable persistent storage
`prometheus.persistence.storageClass`	string	`""`	StorageClass name (empty = default)
`prometheus.persistence.size`	string	`8Gi`	PVC size
`prometheus.persistence.accessModes`	array	`["ReadWriteOnce"]`	PVC access modes

Behavior: - Disabled: Uses emptyDir (ephemeral) - Enabled: Creates PVC, uses Recreate deployment strategy

Prerequisites

A StorageClass that can provision PersistentVolumes, or a default StorageClass configured in your cluster

Procedure

Configure persistence in your values file:

prometheus:
  persistence:
    enabled: true
    storageClass: ""   # Use default StorageClass
    size: 8Gi
    accessModes:
      - ReadWriteOnce

Apply the values to your Network Observer deployment.
Verify the PersistentVolumeClaim is bound:
```
kubectl get pvc
```

Example output:

NAME                                    STATUS   VOLUME                                     CAPACITY   ACCESS MODES   STORAGECLASS   AGE
skupper-network-observer-prometheus-0   Bound    pvc-a1b2c3d4-e5f6-7890-abcd-ef1234567890   8Gi        RWO            standard       2m

When persistence is enabled, the Deployment uses a Recreate update strategy to ensure the single read-write volume can attach cleanly during pod updates.

Resource request and limit values¶

Resource requests and limits can be configured for each container in the Pod.

Network Observer Container¶

Path	Type	Default	Description
`containerResources.networkObserver.requests.cpu`	string	-	CPU request
`containerResources.networkObserver.requests.memory`	string	-	Memory request
`containerResources.networkObserver.limits.cpu`	string	-	CPU limit
`containerResources.networkObserver.limits.memory`	string	-	Memory limit

Prometheus Container¶

Path	Type	Default	Description
`containerResources.prometheus.requests.cpu`	string	-	CPU request
`containerResources.prometheus.requests.memory`	string	-	Memory request
`containerResources.prometheus.limits.cpu`	string	-	CPU limit
`containerResources.prometheus.limits.memory`	string	-	Memory limit

Proxy Container¶

Path	Type	Default	Description
`containerResources.proxy.requests.cpu`	string	-	CPU request
`containerResources.proxy.requests.memory`	string	-	Memory request
`containerResources.proxy.limits.cpu`	string	-	CPU limit
`containerResources.proxy.limits.memory`	string	-	Memory limit

Example:

containerResources:
  networkObserver:
    requests:
      cpu: 200m
      memory: 512Mi
    limits:
      cpu: 1000m
      memory: 1Gi
  prometheus:
    requests:
      cpu: 500m
      memory: 1Gi
    limits:
      cpu: 2000m
      memory: 4Gi
  proxy:
    requests:
      cpu: 50m
      memory: 64Mi
    limits:
      cpu: 200m
      memory: 256Mi

Container image settings¶

Configure container image repositories, tags, and pull policies for each component.

Network Observer Image¶

Path	Type	Default	Description
`image.repository`	string	-	Image repository
`image.tag`	string	chart appVersion	Image tag
`image.pullPolicy`	string	`Always`	Pull policy

Prometheus Image¶

Path	Type	Default	Description
`prometheus.repository`	string	-	Image repository
`prometheus.tag`	string	`v3.11.3`	Image tag
`prometheus.pullPolicy`	string	`IfNotPresent`	Pull policy

NGINX Proxy Image¶

Path	Type	Default	Description
`nginx.repository`	string	-	Image repository
`nginx.tag`	string	`1.31.0-alpine`	Image tag
`nginx.pullPolicy`	string	`IfNotPresent`	Pull policy
`nginx.command`	array	`[]`	Override default command

Used when auth.strategy is basic or none.

OpenShift OAuth Proxy Image¶

Path	Type	Default	Description
`openshiftOauthProxy.repository`	string	-	Image repository
`openshiftOauthProxy.tag`	string	`4.22.0`	Image tag
`openshiftOauthProxy.pullPolicy`	string	`IfNotPresent`	Pull policy

Used when auth.strategy is openshift.

Supported labels and annotations¶

Configure labels and annotations applied to Network Observer resources.

Labels and annotations¶

Path	Type	Default	Description
`commonLabels`	map	`{}`	Labels on all resources
`commonAnnotations`	map	`{}`	Annotations on all resources
`podLabels`	map	`{}`	Labels on Pod resources only
`podAnnotations`	map	`{}`	Annotations on Pod resources only

Standard labels (always present): - app.kubernetes.io/name: network-observer - app.kubernetes.io/instance: <name> - app.kubernetes.io/version: <version> - app.kubernetes.io/managed-by: Helm or network-observer-operator

Example:

commonLabels:
  environment: production
  team: platform-engineering
  cost-center: "12345"

commonAnnotations:
  owner: "platform-team@company.com"
  docs: "https://wiki.company.com/network-observer"

podLabels:
  app.kubernetes.io/tier: monitoring

podAnnotations:
  prometheus.io/scrape: "false"

Service configuration parameters¶

Configure the Kubernetes Service that exposes the Network Observer.

Service settings¶

Path	Type	Default	Description
`service.type`	string	`ClusterIP`	Service type: `ClusterIP`, `LoadBalancer`, `NodePort`
`service.port`	int	`443`	External port

Notes: - targetPort always https (8443) - Metrics service always ClusterIP on port 9000

Security context constraints¶

Configure pod and container security contexts for the Network Observer.

Pod Security Context¶

Path	Type	Default	Description
`podSecurityContext.seccompProfile.type`	string	`RuntimeDefault`	Seccomp profile

Container Security Contexts¶

Path	Type	Default	Description
`.allowPrivilegeEscalation`	bool	`false`	Allow privilege escalation
`.capabilities.drop`	array	`["ALL"]`	Capabilities to drop

Available for: securityContext, prometheus.securityContext, nginx.securityContext, openshiftOauthProxy.securityContext

Resource naming conventions¶

Configure naming and label behavior for the Network Observer.

Name Overrides¶

Path	Type	Default	Description
`nameOverride`	string	`""`	Override chart name
`fullnameOverride`	string	`""`	Override full resource name

Skip Management Labels¶

Path	Type	Default	Description
`skipManagementLabels`	bool	`false`	Skip Skupper management labels

Metrics endpoint reference¶

The Network Observer serves Prometheus metrics on a dedicated HTTP listener, separate from the main API endpoint.

Listener Configuration: - Address: :9000 (container-wide) - Path: /metrics - Protocol: HTTP (no TLS/auth)

Service: - Name: <name>-metrics - Type: ClusterIP - Port: 9000 → 9000

Security: Cluster-internal only. Do not expose publicly.

Metrics Service¶

Property	Value
Listener address	`:9000`
Service name	`<release-name>-metrics`
Service port	`9000`
Metrics path	`/metrics`

The chart creates a second ClusterIP Service named <release-name>-metrics that targets the metrics listener on port 9000.

Scrape metrics¶

Configure your Prometheus instance or monitoring operator to scrape the metrics endpoint.

ServiceMonitor example (Prometheus Operator):

apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: skupper-network-observer
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: network-observer
  endpoints:
    - port: metrics
      path: /metrics

Static scrape configuration:

scrape_configs:
  - job_name: 'network-observer'
    static_configs:
      - targets: ['skupper-network-observer-metrics.default.svc:9000']

Security note: The metrics Service is ClusterIP by default and does not include the TLS proxy or authentication that protects the main console endpoint. Do not expose this Service publicly without additional access controls if your metrics contain sensitive data.

Troubleshooting reference¶

Use the following steps to verify that the Network Observer is running correctly.

Verify Services¶

Check that both Services are created:

kubectl get svc -l app.kubernetes.io/name=network-observer

Example output:

NAME                              TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)    AGE
skupper-network-observer          ClusterIP   10.96.123.45    <none>        443/TCP    5m
skupper-network-observer-metrics  ClusterIP   10.96.123.46    <none>        9000/TCP   5m

Test Metrics endpoint¶

From a pod in the same namespace:

kubectl run -it --rm curl --image=curlimages/curl --restart=Never -- curl -sS http://skupper-network-observer-metrics:9000/metrics

Example output:

# HELP skupper_network_observer_info Network Observer build information
# TYPE skupper_network_observer_info gauge
skupper_network_observer_info{version="2.2.0"} 1
...

Check Observer Logs¶

Look for the metrics listener startup message:

kubectl logs deployment/skupper-network-observer -c network-observer

Example output:

2025/03/15 10:23:45 Starting metrics server on :9000
2025/03/15 10:23:45 Starting API server on 127.0.0.1:8080

Verify Prometheus configuration¶

If the embedded Prometheus shows no data, check the ConfigMap:

kubectl get configmap skupper-network-observer-prometheus-config -o yaml

Ensure the prometheus.yml content is valid and the scrape target matches the observer's API listener (localhost:8080).

PersistentVolumeClaim Issues¶

If the pod remains in Pending state with persistence enabled:

kubectl describe pvc skupper-network-observer-prometheus-0

Look for events indicating StorageClass issues, volume provisioning failures, or capacity constraints.