mbp-1128: Add Network Observability with NooBaa-backed Loki by pmatouse · Pull Request #165 · validatedpatterns/layered-zero-trust

pmatouse · 2026-07-23T09:50:15Z

feat: add Network Observability with NooBaa-backed Loki

Install Loki and Network Observability operators via a storage-dependent
feature fragment, and deploy LokiStack plus FlowCollector using NooBaa
storage.

Signed-off-by: Petr Matousek pmatouse@redhat.com

Install Loki and Network Observability operators via a storage-dependent feature fragment, and deploy LokiStack plus FlowCollector using NooBaa storage. Signed-off-by: Petr Matousek <pmatouse@redhat.com>

mlorenzofr

overall it's very good, but some small changes need to be made

mlorenzofr · 2026-07-23T14:35:26Z

+  namespace: netobserv-loki
+  name: loki
+  size: 1x.extra-small
+  storageClassName: gp3-csi


This is AWS platform-specific. We should leave it empty and use the default StorageClass

mlorenzofr · 2026-07-23T14:36:26Z

+    secret:
+      name: {{ .Values.loki.storageSecretName }}
+      type: s3
+  storageClassName: {{ .Values.loki.storageClassName }}


We should look for a way to automatically detect the default storageClass, or fail if the storageClass is null, thus forcing the user to define it manually

mlorenzofr · 2026-07-23T14:43:50Z

+            - |
+              # NooBaa OBC creates a Secret (keys) + ConfigMap (bucket/host/port)
+              # with the same name as the claim — not all keys live in the Secret.
+              set -e


we already run bash with the -e argument, we don't need set it again within the script

mlorenzofr · 2026-07-23T14:52:10Z

You've committed the changes to enable the netobserv functionality
The original file from the main branch should be restored, and the configuration added within comments

that was an error from e2e testing facepalm

p-rog · 2026-07-23T17:39:24Z

+{{- $sc -}}
+{{- else -}}
+{{- $default := "" -}}
+{{- range (lookup "storage.k8s.io/v1" "StorageClass" "" "").items | default list -}}


I've tested this in OCP 4.22 and using Helm lookup to find the default StorageClass works with helm install but fails in ArgoCD because ArgoCD's Helm renderer doesn't support lookup. I had to set loki.storageClassName explicitly via an ArgoCD helm parameter override.

If I'm not wrong, when storageClassName is omitted from the LokiStack CR, the Loki Operator uses the cluster's default StorageClass automatically (https://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.5/html/installing_logging/verifying-cluster-prerequisites).

You can update the lokistack.yaml to make storageClassName conditional (see my next comment).

I am getting (Argo sync)

LokiStack.loki.grafana.com "loki" is invalid: spec.storageClassName: Required value

OCP 4.21/Loki Operator 6.6 omitting it is rejected

may be true for some Logging/Loki versions or for helm install paths, but under Argo it looks like the API requires the field

p-rog · 2026-07-23T17:40:14Z

+    secret:
+      name: {{ .Values.loki.storageSecretName }}
+      type: s3
+  storageClassName: {{ include "netobserv.lokiStorageClassName" . }}


You can make it conditional to address my earlier comment:

{{- with (include "netobserv.lokiStorageClassName" .) }} storageClassName: {{ . }} {{- end }}

p-rog

Overall LGTM

I left one suggestion which I found when I was testing it at OCP 4.22.
Additionally, it would be great to add network policies to the Network Observability feature, to follow ZT methodology. You can test my network policy architect skill :)

pmatouse · 2026-07-29T12:15:45Z

Additionally, it would be great to add network policies to the Network Observability feature, to follow ZT methodology. You can test my network policy architect skill :)

I've added the the network policies

Use Helm lookup for the default StorageClass when possible; require an explicit value under Argo CD. LokiStack CRD rejects an omitted field.

Enable FlowCollector operator NPs for netobserv/privileged, and add least-privilege policies for netobserv-loki.

mlorenzofr

Overall okay, it's almost ready for LGTM in my opinion, just a couple of minor things.

Additionally:

Change its status from draft to ready for review.
Do a rebase to get the latest changes from the main branch and avoid conflicts.

mlorenzofr · 2026-08-03T14:01:27Z

+      project: hub
+      path: charts/netobserv
+      annotations:
+        argocd.argoproj.io/sync-wave: "42"


The override of loki.storageClassName is mandatory, let's add it here even if it's just with an example:

Suggested change

argocd.argoproj.io/sync-wave: "42"

argocd.argoproj.io/sync-wave: "42"

overrides:

- name: loki.storageClassName

value: "<YOUR-STORAGE-CLASS>"

mlorenzofr · 2026-08-03T14:07:20Z

+    #   project: hub
+    #   path: charts/netobserv
+    #   annotations:
+    #     argocd.argoproj.io/sync-wave: "42"  # Deploy after NooBaa storage backend


Suggested change

# argocd.argoproj.io/sync-wave: "42" # Deploy after NooBaa storage backend

# argocd.argoproj.io/sync-wave: "42" # Deploy after NooBaa storage backend

# overrides:

# - name: loki.storageClassName

# value: "" # Add your own storageClassName here

mlorenzofr · 2026-08-03T14:14:17Z

+          imagePullPolicy: IfNotPresent
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsNonRoot: true


Already set at pod-level

mlorenzofr · 2026-08-03T14:14:49Z

+            capabilities:
+              drop:
+                - ALL
+            seccompProfile:


Already set at pod-level

feat: add Network Observability with NooBaa-backed Loki

7528752

Install Loki and Network Observability operators via a storage-dependent feature fragment, and deploy LokiStack plus FlowCollector using NooBaa storage. Signed-off-by: Petr Matousek <pmatouse@redhat.com>

pmatouse marked this pull request as draft July 23, 2026 09:51

mlorenzofr requested review from mlorenzofr, p-rog and sabre1041 July 23, 2026 14:24

mlorenzofr requested changes Jul 23, 2026

View reviewed changes

pmatouse force-pushed the mbp-1128-network-observability branch from abcf24c to 091415e Compare July 23, 2026 16:45

p-rog reviewed Jul 23, 2026

View reviewed changes

pmatouse added 4 commits July 30, 2026 12:34

fix(netobserv): resolve LokiStack storageClassName for Helm and Argo

6429b8f

Use Helm lookup for the default StorageClass when possible; require an explicit value under Argo CD. LokiStack CRD rejects an omitted field.

fix(netobserv): harden OBC credentials Job error handling

2d36708

docs: comment netobserv enablement in values-hub

a515cf2

feat(netobserv): add NetworkPolicies for LokiStack namespace

04a245d

Enable FlowCollector operator NPs for netobserv/privileged, and add least-privilege policies for netobserv-loki.

pmatouse force-pushed the mbp-1128-network-observability branch from 89a748b to 04a245d Compare July 30, 2026 10:35

mlorenzofr requested changes Aug 3, 2026

View reviewed changes

pmatouse marked this pull request as ready for review August 3, 2026 14:27

-        argocd.argoproj.io/sync-wave: "42"
+        argocd.argoproj.io/sync-wave: "42"
+      overrides:
+        - name: loki.storageClassName
+          value: "<YOUR-STORAGE-CLASS>"

-    #     argocd.argoproj.io/sync-wave: "42"  # Deploy after NooBaa storage backend
+    #     argocd.argoproj.io/sync-wave: "42"  # Deploy after NooBaa storage backend
+    #   overrides:
+    #     - name: loki.storageClassName
+    #       value: ""  # Add your own storageClassName here

Uh oh!

Conversation

pmatouse commented Jul 23, 2026

Uh oh!

mlorenzofr left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pmatouse Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

p-rog left a comment

Choose a reason for hiding this comment

Uh oh!

pmatouse commented Jul 29, 2026

Uh oh!

mlorenzofr left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

pmatouse Jul 29, 2026 •

edited

Loading