SUSE Support

Here When You Need Us

Use REST API call to retrieve connections displayed on Network Activity view

This document (000020938) is provided subject to the disclaimer at the end of this document.

Resolution

Customer find the connection details are useful but there is not way to obtain the full list from the WebUI.

  • Use the following script to obtain the full connection list and their full details.
_controllerIP_=
_controllerPORT_=

_TOKEN_=`curl -ks -H "Content-Type: application/json" -d '{"password": {"username": "admin", "password": "admin"}}' "https://$_controllerIP_:$_controllerPORT_/v1/auth" | jq -r '.token.token'`
#echo $_TOKEN_
_CONVERSATIONS_=$(curl -ks -H "Content-Type: application/json" -H "X-Auth-Token: $_TOKEN_" "https://$_controllerIP_:$_controllerPORT_/v1/conversation")
#echo full conversations
#echo $_CONVERSATIONS_ | jq -c .
_CONVERSATION_LEN_=$(echo $_CONVERSATIONS_ | jq '.conversations | length')
for i in `seq 0 $((( _CONVERSATION_LEN_-1 )))`; do
_CTRL_FROMid_=`echo $_CONVERSATIONS_ | jq -r --arg index "$i" '.conversations[$index|tonumber].from'`
_CTRL_TOid_=`echo $_CONVERSATIONS_ | jq -r --arg index "$i" '.conversations[$index|tonumber].to'`
echo conversation detail from = $_CTRL_FROMid_, to = $_CTRL_TOid_\n
curl -ks -H "Content-Type: application/json" -H "X-Auth-Token: $_TOKEN_""https://$_controllerIP_:$_controllerPORT_/v1/conversation/$_CTRL_FROMid_/$_CTRL_TOid_" >> details.txt
done
 

Update the controller variables, username, and password for the cluster. 

_CONVERSATIONS_ return the full list of conversations; below is an example of one conversation.  The from and to either references workload IDs or hosts.

{
"applications": [],
"bytes": 0,
"event_type": [],
"from": "961e4b06c54e7fda419f624ab81577ad5306aec687ba5cea92c35a7d2f1028c4",
"policy_action": "allow",
"ports": [
    "tcp/6443"
],
"protocols": [
"tcp"
],
"sessions": 1,
"severity": "",
"to": "6d8475a224f37ef38aeb961d65401fbf6d370319a5e3072f50987a10f964a662"
}
 

For each conversation, the for loop will pull the details. You can probably cross reference workloadID to the /v1/workload/:id and  filter conversation parameters to reduce the number of details calls.

[UPDATE]

Using the REST API, the first call is still "GET /v1/workload", the second call is "GET /v1/conversation/:from/:to", for example,
 
GET /v1/conversation/fd0ed65ecc265826f2ec580012ca5d8b4e1c92e1351ccb2939035ba6431fdbc2/external
 
where fd0ed6... is the container ID. This API will give back all external IPs, (only one in the following example).
 
{
    "conversation": {
        "applications": [
            "HTTP"
        ],
        "bytes": 2355914,
        "entries": [
            {
                "Server": "",
                "application": "HTTP",
                "bytes": 2355914,
                "client_ip": "192.168.35.118",
                "last_seen_at": "2021-06-15T02:04:51Z",
                "mapped_port": "tcp/8068",
                "policy_action": "allow",
                "policy_id": 10012,
                "port": "tcp/8068",
                "server_ip": "10.96.17.98",
                "sessions": 228,
                "severity": "",
                "threat_name": "",
                "xff": false
            }
        ],
        "event_type": [],
        "from": {
            "author": "",
            "cap_change_mode": true,
            "cap_quarantine": true,
            "cap_sniff": true,
            "children": [],
            "display_name": "prometheus-deployment-5f75d96555-wz2qg",
            "domain": "default",
            "host_id": "k43:FPWZ:IWZG:HI45:YV2S:RPGB:AP76:ENQ3:MPUR:YGDO:JEQL:PQQE:IG2F",
            "host_name": "k43",
            "id": "fd0ed65ecc265826f2ec580012ca5d8b4e1c92e1351ccb2939035ba6431fdbc2",
            "image": "k8s.gcr.io/pause:3.2",
            "image_id": "80d28bedfe5dec59da9ebf8e6260224ac9008ab5c11dbbe16ee3ba3e4439ac2c",
            "kind": "container",
            "name": "k8s_POD_prometheus-deployment-5f75d96555-wz2qg_default_075e2208-2251-426f-8983-f90bd6f9be17_0",
            "platform_role": "",
            "pod_name": "prometheus-deployment-5f75d96555-wz2qg",
            "policy_mode": "Discover",
            "privileged": false,
            "profile_mode": "Discover",
            "run_as_root": true,
            "scan_summary": {
                "base_os": "",
                "cvedb_create_time": "",
                "high": 0,
                "medium": 0,
                "result": "",
                "scanned_at": "",
                "scanned_timestamp": 0,
                "scanner_version": "",
                "status": ""
            },
            "service": "prometheus-deployment.default",
            "service_group": "nv.prometheus-deployment.default",
            "service_mesh": false,
            "service_mesh_sidecar": false,
            "state": "discover"
        },
        "policy_action": "allow",
        "protocols": [
            "tcp"
        ],
        "sessions": 228,
        "severity": "",
        "to": {
            "author": "",
            "cap_change_mode": false,
            "cap_quarantine": false,
            "cap_sniff": false,
            "children": null,
            "display_name": "external",
            "domain": "",
            "host_id": "",
            "host_name": "",
            "id": "external",
            "image": "",
            "image_id": "",
            "kind": "nv_service",
            "name": "external",
            "platform_role": "",
            "pod_name": "",
            "privileged": false,
            "run_as_root": false,
            "scan_summary": null,
            "service": "",
            "service_group": "external",
            "service_mesh": false,
            "service_mesh_sidecar": false,
            "state": "connected"
        }
    }
}

 

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.

  • Document ID:000020938
  • Creation Date: 18-Jan-2023
  • Modified Date:18-Jan-2023
    • SUSE NeuVector

< Back to Support Search

For questions or concerns with the SUSE Knowledgebase please contact: tidfeedback[at]suse.com

tick icon

SUSE Support Forums

Get your questions answered by experienced Sys Ops or interact with other SUSE community experts.

tick icon

Support Resources

Learn how to get the most from the technical support you receive with your SUSE Subscription, Premium Support, Academic Program, or Partner Program.

tick icon

Open an Incident

Open an incident with SUSE Technical Support, manage your subscriptions, download patches, or manage user access.