Use REST API call to retrieve connections displayed on Network Activity view
This document (000020938) is provided subject to the disclaimer at the end of this document.
Resolution
Customer find the connection details are useful but there is not way to obtain the full list from the WebUI.
- Use the following script to obtain the full connection list and their full details.
_controllerIP_= _controllerPORT_= _TOKEN_=`curl -ks -H "Content-Type: application/json" -d '{"password": {"username": "admin", "password": "admin"}}' "https://$_controllerIP_:$_controllerPORT_/v1/auth" | jq -r '.token.token'` #echo $_TOKEN_ _CONVERSATIONS_=$(curl -ks -H "Content-Type: application/json" -H "X-Auth-Token: $_TOKEN_" "https://$_controllerIP_:$_controllerPORT_/v1/conversation") #echo full conversations #echo $_CONVERSATIONS_ | jq -c . _CONVERSATION_LEN_=$(echo $_CONVERSATIONS_ | jq '.conversations | length') for i in `seq 0 $((( _CONVERSATION_LEN_-1 )))`; do _CTRL_FROMid_=`echo $_CONVERSATIONS_ | jq -r --arg index "$i" '.conversations[$index|tonumber].from'` _CTRL_TOid_=`echo $_CONVERSATIONS_ | jq -r --arg index "$i" '.conversations[$index|tonumber].to'` echo conversation detail from = $_CTRL_FROMid_, to = $_CTRL_TOid_\n curl -ks -H "Content-Type: application/json" -H "X-Auth-Token: $_TOKEN_""https://$_controllerIP_:$_controllerPORT_/v1/conversation/$_CTRL_FROMid_/$_CTRL_TOid_" >> details.txt done
Update the controller variables, username, and password for the cluster.
_CONVERSATIONS_ return the full list of conversations; below is an example of one conversation. The from and to either references workload IDs or hosts.
{ "applications": [], "bytes": 0, "event_type": [], "from": "961e4b06c54e7fda419f624ab81577ad5306aec687ba5cea92c35a7d2f1028c4", "policy_action": "allow", "ports": [ "tcp/6443" ], "protocols": [ "tcp" ], "sessions": 1, "severity": "", "to": "6d8475a224f37ef38aeb961d65401fbf6d370319a5e3072f50987a10f964a662" }
For each conversation, the for loop will pull the details. You can probably cross reference workloadID to the /v1/workload/:id and filter conversation parameters to reduce the number of details calls.
[UPDATE]
Using the REST API, the first call is still "GET /v1/workload", the second call is "GET /v1/conversation/:from/:to", for example,GET /v1/conversation/fd0ed65ecc265826f2ec580012ca5d8b4e1c92e1351ccb2939035ba6431fdbc2/external
where fd0ed6... is the container ID. This API will give back all external IPs, (only one in the following example).
{ "conversation": { "applications": [ "HTTP" ], "bytes": 2355914, "entries": [ { "Server": "", "application": "HTTP", "bytes": 2355914, "client_ip": "192.168.35.118", "last_seen_at": "2021-06-15T02:04:51Z", "mapped_port": "tcp/8068", "policy_action": "allow", "policy_id": 10012, "port": "tcp/8068", "server_ip": "10.96.17.98", "sessions": 228, "severity": "", "threat_name": "", "xff": false } ], "event_type": [], "from": { "author": "", "cap_change_mode": true, "cap_quarantine": true, "cap_sniff": true, "children": [], "display_name": "prometheus-deployment-5f75d96555-wz2qg", "domain": "default", "host_id": "k43:FPWZ:IWZG:HI45:YV2S:RPGB:AP76:ENQ3:MPUR:YGDO:JEQL:PQQE:IG2F", "host_name": "k43", "id": "fd0ed65ecc265826f2ec580012ca5d8b4e1c92e1351ccb2939035ba6431fdbc2", "image": "k8s.gcr.io/pause:3.2", "image_id": "80d28bedfe5dec59da9ebf8e6260224ac9008ab5c11dbbe16ee3ba3e4439ac2c", "kind": "container", "name": "k8s_POD_prometheus-deployment-5f75d96555-wz2qg_default_075e2208-2251-426f-8983-f90bd6f9be17_0", "platform_role": "", "pod_name": "prometheus-deployment-5f75d96555-wz2qg", "policy_mode": "Discover", "privileged": false, "profile_mode": "Discover", "run_as_root": true, "scan_summary": { "base_os": "", "cvedb_create_time": "", "high": 0, "medium": 0, "result": "", "scanned_at": "", "scanned_timestamp": 0, "scanner_version": "", "status": "" }, "service": "prometheus-deployment.default", "service_group": "nv.prometheus-deployment.default", "service_mesh": false, "service_mesh_sidecar": false, "state": "discover" }, "policy_action": "allow", "protocols": [ "tcp" ], "sessions": 228, "severity": "", "to": { "author": "", "cap_change_mode": false, "cap_quarantine": false, "cap_sniff": false, "children": null, "display_name": "external", "domain": "", "host_id": "", "host_name": "", "id": "external", "image": "", "image_id": "", "kind": "nv_service", "name": "external", "platform_role": "", "pod_name": "", "privileged": false, "run_as_root": false, "scan_summary": null, "service": "", "service_group": "external", "service_mesh": false, "service_mesh_sidecar": false, "state": "connected" } } }
Disclaimer
This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.
- Document ID:000020938
- Creation Date: 18-Jan-2023
- Modified Date:18-Jan-2023
-
- SUSE NeuVector
For questions or concerns with the SUSE Knowledgebase please contact: tidfeedback[at]suse.com