Discovery of application relationships in clusters
Systems that determine relationships between network components of a cluster using packet filters are disclosed. A system can identify objects that implement services of a cluster and network connections associated with respective pairs of the objects. The system can also filter out network connections from the identified network connections. The filtering can remove connections between source objects and destination objects based on the destination objects lacking any components that implement a service in cluster. The filtering can also retain network connections between source objects and destination objects based on the source objects including components that implement at least one service, and based on the second destination object including components that implement at least one service. Additionally, the system can generate relationship maps and network topologies using the determined relationships.
1. A non-transitory computer readable medium comprising instructions which, when executed by one or more hardware processors, causes performance of operations comprising:
executing a query to identify a set of components that implement one or more services or workloads;
executing a trace operation to identify a plurality of network connections associated with respective pairs of objects;
filtering out at least one network connection from the plurality of network connections to obtain a filtered plurality of network connections at least by:
identifying a first network connection of the plurality of network connections, the first network connection being initiated by a first source object for connecting with a first destination object;
responsive to determining that the first destination object does not comprise any of the set of components that implement at least one service of the one or more services: removing the first network connection from the plurality of network connections;
identifying a second network connection of the plurality of network connections, the second network connection being initiated by a second source object for connecting with a second destination object;
responsive to determining that the second destination object comprises a first component of the set of components that implement at least one service of the one or more services: retaining the second network connection in the plurality of network connections for including in the filtered plurality of network connections; and
mapping relationships between the services and/or workloads in the one or more services or workloads based on the filtered plurality of network connections at least by:
identifying a service or workload implemented by the first component comprised in the second destination object associated with the second network connection; and
determining a relationship, between (a) the second source object and (b) the service or workload implemented by the first component, to include in the relationship map.
2. The medium of claim 1 , wherein the query comprises a request for objects of a particular set of one or more types.
3. The medium of claim 1 , filtering out at least one network connection from the plurality of network connections to obtain the filtered plurality of network connections further comprises:
responsive at least to determining that the second source object does not comprises a third component of the set of components implementing at least one service or workload of the one or more services or workloads, excluding the second network connection in the plurality of network connections from the filtered plurality of network connections.
4. The medium of claim 1 , filtering out at least one network connection from the plurality of network connections to obtain the filtered plurality of network connections further comprises:
responsive at least to determining that the second destination object comprises a third component of the set of components that does not implement at least one service of the one or more services, excluding the second network connection in the plurality of network connections from the filtered plurality of network connections.
5. The medium of claim 1 , wherein executing the query to identify the set of components that implement the at least one service of the one or more services comprises:
determining services to which one or more pods of a cluster belongs based on a mapping from an identifier of the cluster, a namespace of the cluster, and identifiers of the one or more pods to the services and the namespace.
6. The medium of claim 1 , wherein executing the query to identify the set of components that implement the at least one service of the one or more services comprises:
determining workload types respectively controlling one or more pods in a cluster based on a mapping from an identifier of the cluster, a namespace of the cluster, and identifiers of the one or more pods to workload types and the namespace.
7. The medium of claim 1 , wherein executing the query to identify the set of components that implement the at least one service of the one or more services comprises:
determining respective combinations of IP addresses and ports of at least one service of a plurality of services based on a mapping from an identifier of a cluster, a namespace of the cluster, IP addresses of the at least one service of a plurality of services, and ports of the at least one service of a plurality of services and a namespace of the cluster.
8. The medium of claim 1 , wherein executing the query to identify the set of components that implement the at least one service of the one or more services comprises:
determining respective IP addresses of the at least one service of a plurality of services executing in a cluster based on a mapping from an identifier of the cluster and IP addresses of the at least one service of a plurality of services to respective identifiers of the at least one service of a plurality of services and a namespace of the cluster.
9. The medium of claim 1 , wherein executing the query to identify the set of components that implement the at least one service of the one or more services comprises:
determining IP addresses of one or more pods in a cluster based on a mapping from an identifier of the cluster and the IP addresses to the one or more pods and a namespace of the cluster.
10. A method comprising:
executing a query to identify a set of components that implement one or more services or workloads;
executing a trace operation to identify a plurality of network connections associated with respective pairs of objects;
filtering out at least one network connection from the plurality of network connections to obtain a filtered plurality of network connections at least by:
identifying a first network connection of the plurality of network connections, the first network connection being initiated by a first source object for connecting with a first destination object;
responsive to determining that the first destination object does not comprise any of the set of components that implement at least one service of the one or more services: removing the first network connection from the plurality of network connections;
identifying a second network connection of the plurality of network connections, the second network connection being initiated by a second source object for connecting with a second destination object;
responsive to determining that the second destination object comprises a first component of the set of components that implement at least one service of the one or more services: retaining the second network connection in the plurality of network connections for including in the filtered plurality of network connections; and
mapping relationships between the services and/or workloads in the one or more services or workloads based on the filtered plurality of network connections at least by:
identifying a service or workload implemented by the first component comprised in the second destination object associated with the second network connection; and
determining a relationship, between (a) the second source object and (b) the service or workload implemented by the first component, to include in the relationship map.
11. The method of claim 10 , wherein the query comprises a request for objects of a particular set of one or more types.
12. The method of claim 10 , filtering out at least one network connection from the plurality of network connections to obtain the filtered plurality of network connections further comprises:
responsive at least to determining that the second source object does not comprises a third component of the set of components implementing at least one service or workload of the one or more services or workloads, excluding the second network connection in the plurality of network connections from the filtered plurality of network connections.
13. The method of claim 10 , filtering out at least one network connection from the plurality of network connections to obtain the filtered plurality of network connections further comprises:
responsive at least to determining that the second destination object comprises a third component of the set of components that does not implement at least one service of the one or more services, excluding the second network connection in the plurality of network connections from the filtered plurality of network connections.
14. The method of claim 10 , wherein executing the query to identify the set of components that implement the at least one service of the one or more services comprises:
determining services to which one or more pods of a cluster belongs based on a mapping from an identifier of the cluster, a namespace of the cluster, and identifiers of the one or more pods to the services and the namespace.
15. The method of claim 10 , wherein executing the query to identify the set of components that implement the at least one service of the one or more services comprises:
determining workload types respectively controlling one or more pods in a cluster based on a mapping from an identifier of the cluster, a namespace of the cluster, and identifiers of the one or more pods to workload types and the namespace.
16. The method of claim 10 , wherein executing the query to identify the set of components that implement the at least one service of the one or more services comprises:
determining respective combinations of IP addresses and ports of at least one service of a plurality of services based on a mapping from an identifier of a cluster, a namespace of the cluster, IP addresses of the at least one service of a plurality of services, and ports of the at least one service of a plurality of services and a namespace of the cluster.
17. The method of claim 10 , wherein executing the query to identify the set of components that implement the at least one service of the one or more services comprises:
determining respective IP addresses of the at least one service of a plurality of services executing in a cluster based on a mapping from an identifier of the cluster and IP addresses of the at least one service of a plurality of services to respective identifiers of the at least one service of a plurality of services and a namespace of the cluster.
18. The method of claim 10 , wherein executing the query to identify the set of components that implement the at least one service of the one or more services comprises:
determining IP addresses of one or more pods in a cluster based on a mapping from an identifier of the cluster and the IP addresses to the one or more pods and a namespace of the cluster.
19. A system comprising:
at least one device including a hardware processor
a non-transitory computer-readable storage device storing program instruction that, when executed by the hardware processor, configure the system to perform operations comprising:
executing a query to identify a set of components that implement one or more services or workloads;
executing a trace operation to identify a plurality of network connections associated with respective pairs of objects;
filtering out at least one network connection from the plurality of network connections to obtain a filtered plurality of network connections at least by:
identifying a first network connection of the plurality of network connections, the first network connection being initiated by a first source object for connecting with a first destination object;
responsive to determining that the first destination object does not comprise any of the set of components that implement at least one service of the one or more services: removing the first network connection from the plurality of network connections;
identifying a second network connection of the plurality of network connections, the second network connection being initiated by a second source object for connecting with a second destination object;
responsive to determining that the second destination object comprises a first component of the set of components that implement at least one service of the one or more services: retaining the second network connection in the plurality of network connections for including in the filtered plurality of network connections; and
mapping relationships between the services and/or workloads in the one or more services or workloads based on the filtered plurality of network connections at least by:
identifying a service or workload implemented by the first component comprised in the second destination object associated with the second network connection; and
determining a relationship, between (a) the second source object and (b) the service or workload implemented by the first component, to include in the relationship map.
20. The system of claim 19 , wherein the query comprises a request for objects of a particular set of one or more types.
21. The system of claim 19 , filtering out at least one network connection from the plurality of network connections to obtain the filtered plurality of network connections further comprises:
responsive at least to determining that the second source object does not comprises a third component of the set of components implementing at least one service or workload of the one or more services or workloads, excluding the second network connection in the plurality of network connections from the filtered plurality of network connections.
22. The system of claim 19 , filtering out at least one network connection from the plurality of network connections to obtain the filtered plurality of network connections further comprises:
responsive at least to determining that the second destination object comprises a third component of the set of components that does not implement at least one service of the one or more services, excluding the second network connection in the plurality of network connections from the filtered plurality of network connections.
23. The system of claim 19 , wherein executing the query to identify the set of components that implement the at least one service of the one or more services comprises:
determining services to which one or more pods of a cluster belongs based on a mapping from an identifier of the cluster, a namespace of the cluster, and identifiers of the one or more pods to the services and the namespace.
24. The system of claim 19 , wherein executing the query to identify the set of components that implement the at least one service of the one or more services comprises:
determining workload types respectively controlling one or more pods in a cluster based on a mapping from an identifier of the cluster, a namespace of the cluster, and identifiers of the one or more pods to workload types and the namespace.
25. The system of claim 19 , wherein executing the query to identify the set of components that implement the at least one service of the one or more services comprises:
determining respective combinations of IP addresses and ports of at least one service of a plurality of services based on a mapping from an identifier of a cluster, a namespace of the cluster, IP addresses of the at least one service of a plurality of services, and ports of the at least one service of a plurality of services and a namespace of the cluster.
26. The system of claim 19 , wherein executing the query to identify the set of components that implement the at least one service of the one or more services comprises:
determining respective IP addresses of the at least one service of a plurality of services executing in a cluster based on a mapping from an identifier of the cluster and IP addresses of the at least one service of a plurality of services to respective identifiers of the at least one service of a plurality of services and a namespace of the cluster.
27. The system of claim 19 , wherein executing the query to identify the set of components that implement the at least one service of the one or more services comprises:
determining IP addresses of one or more pods in a cluster based on a mapping from an identifier of the cluster and the IP addresses to the one or more pods and a namespace of the cluster.