25 Commits

Author SHA1 Message Date
taylanbakircioglu 613ed0bf99 fix(security): patch CRITICAL Dependabot findings (python-jose 3.4.0, jspdf 4.2.1)
- python-jose[cryptography] 3.3.0 -> 3.4.0 (CVE-2024-33663 algorithm
  confusion) in backend + api-gateway. App uses HS256 only; encode/decode
  API unchanged; 3.3.0<->3.4.0 tokens cross-verifiable (rolling-deploy safe).
- jspdf 4.0.0 -> 4.2.1 (CVE-2026-31938 HTML injection in new-window paths)
  in frontend; @babel/runtime bumped 7.28.4 -> 7.28.6 (required by jspdf
  4.2.1). App uses only new jsPDF()/autoTable()/doc.save() — vulnerable
  output path not used.

Verified: jose roundtrip + cross-version, frontend npm build, backend &
frontend docker images, and Kubernetes (kind) jose 3.4.0 + frontend serve.
No feature/UI behavior change; backward compatible.
2026-06-03 01:35:06 +03:00
taylanbakircioglu 6e503368f7 feat: L7 (Application Level) observability — Service Map, Trace Explorer, APM, Beyla
- Grafana Beyla DaemonSet for kernel-level HTTP/gRPC/DNS capture (passive,
  zero application changes, W3C traceparent header propagation)
- flowfish-l7-collector in-cluster bridge: OTLP receiver + buffered pull API
- L7 Ingestion Service: K8s service-proxy poll → enrich → RabbitMQ
- ClickHouse l7_http_flows / l7_grpc_flows / l7_dns_flows + APM RED MVs
- Neo4j L7Workload nodes + SAME_WORKLOAD cross-cluster bridges
- New pages: Service Map, Trace Explorer, APM Services List, APM Service Detail
- Analysis Wizard now supports L4 / L7 / Both modes with HTTP/gRPC/DNS picks
- Integration Hub gains L7 dependency summary + tree-summary integrations
- Multi-Cluster Management: dual-agent install (Inspector Gadget L4 + Beyla L7),
  runtime OpenShift detection so SCCs auto-install with kubectl too
- ServiceMap edge → Trace Explorer drill-down with virtual_trace_id correlation
- Docs: new L7 architecture diagram, README L7 sections, 3 new screenshots
2026-05-14 10:09:15 +03:00
taylanbakircioglu 3783763aa8 feat: configurable CIDR ranges, improved map drawer & noise filtering
- Add Settings UI for managing SDN pod CIDR ranges with backend API
- Propagate network config from Settings through orchestrator/gRPC to ingestion service
- Improve map drawer: correct Service node labels, simplify IP display
- Add aggregated workload drawer with pod details table, cluster badges
- Filter sdn-infrastructure noise entries in Integration Hub dependency summaries
- Maintain full backward compatibility with hardcoded CIDR defaults

Made-with: Cursor
2026-04-09 17:12:14 +03:00
taylanbakircioglu 3467d52639 fix: preserve existing events-buffer-length on large clusters
The upgrade script now defaults to the current buffer value when it is
>= 8192, instead of always recommending 8192. Reducing buffer on busy
clusters causes eBPF ring buffer overflow and lost events. Also warns
if user manually enters a value below the minimum.

Made-with: Cursor
2026-04-08 13:01:39 +03:00
taylanbakircioglu 016a30a2f7 fix: make upgrade script compatible with non-OpenShift platforms
Replace 'kubectl whoami' (OpenShift-only) with platform-aware auth check:
oc uses 'whoami', kubectl uses 'cluster-info' + 'config current-context'.
Ensures script works on Rancher, EKS, AKS, GKE, and vanilla Kubernetes.

Made-with: Cursor
2026-04-08 10:10:56 +03:00
taylanbakircioglu c54ba11942 fix: update GADGET_IMAGE env var during upgrade and in deployment template
The upgrade script now updates the GADGET_IMAGE environment variable
alongside the container image (step 2/5). Also fixes the deployment
template to include version tag in GADGET_IMAGE value, ensuring
OCI gadget module pulls use the correct version.

Made-with: Cursor
2026-04-08 10:08:33 +03:00
taylanbakircioglu e007bcf2b9 fix: correct jsonpath double-brace escaping in upgrade script
Python f-string {{{{ produced {{ in bash output, but kubectl/oc jsonpath
requires single braces {.field}. This caused all cluster state queries
to return "unknown" and "0/0" pods during upgrade.

Made-with: Cursor
2026-04-08 09:47:57 +03:00
taylanbakircioglu f445a96d05 fix: use case-insensitive admin role check in settings
The update_analysis_limits endpoint had an inline case-sensitive role
check ('Admin'/'Super Admin') instead of using the existing
check_admin_role helper which is case-insensitive. Frontend Settings
page had the same issue, showing Read-Only Mode for users with
lowercase 'admin' role in their JWT token.

Made-with: Cursor
2026-04-07 14:38:17 +03:00
taylanbakircioglu b27cb93795 feat: make gadget upgrade script interactive and safer, apply pending fixes
Upgrade script now interactively prompts for namespace, target version,
registry, memory limit, and buffer length with validation at each step.
Also includes pending fixes: sync gRPC method, migration dollar-quoting,
and double-v prefix in gadget version display.

Made-with: Cursor
2026-04-07 14:08:31 +03:00
taylanbakircioglu 38a5411eb8 feat: Gadget memory optimization, continuous analysis controls, v0.50.1 upgrade support, Flowfish v2.5.0
- Reduce Inspektor Gadget memory limit from 12Gi to 6Gi with buffer optimization (16384->8192)
- Add InspektorGadgetHighMemory (>3Gi) and CriticalMemory (>5Gi) Prometheus alerts
- Add configurable event ingestion rate limiting via Settings UI (ingestion_rate_limit_per_second)
- Update /analysis-limits/defaults endpoint to read from DB with Pydantic fallback
- Orchestrator fetches rate limit via isolated HTTP call (avoids cross-thread async issues)
- Ingestion service uses session-based rate limit with >0 comparison (fixes or-operator semantic bug)
- Add gadget_version (field 22) and max_events_per_second (field 23) to protobuf StartCollectionRequest
- Sync backend/proto with proto/ (add GadgetError message to backend copy)
- Upgrade Inspektor Gadget from v0.48.0 to v0.50.1 across all references
- Dynamic OCI image tagging: cluster-specific gadget_version flows through gRPC to ingestion service
- Fix get_cluster_sync SQL to include gadget_version column
- Fix NULL gadget_version causing protobuf TypeError (row[10] or '' pattern)
- Add GET /clusters/{id}/gadget-upgrade-script endpoint with cluster-specific parameters
- Add GadgetUpgradeModal and semver-based upgrade badge to Cluster Management page
- Add upgrade available indicator to Dashboard OperationsTab
- Include supported_gadget_version in GET /clusters response
- Update cluster_validator minimum supported version from v0.18 to v0.46.0
- Add ingestion_rate_limit_per_second to migration seed data and auto_stop_monitor fallback
- Improve AnalysisWizard Rolling Window and Recurring mode descriptions
- Add GADGET_SUPPORTED_VERSION and GADGET_MIN_SUPPORTED_VERSION to backend config
- Fix hardcoded "1.0.0" version in backend root/info endpoints to use __full_version__
- Replace grep -oP with POSIX grep -oE in upgrade script (macOS compatibility)
- Add ConfigMap events-buffer-length optimization step to upgrade script
- Add GADGET_VERSION sed substitution to prepare-manifests.sh
- Bump Flowfish version from 2.4.0 to 2.5.0
- Update pipeline GADGET_VERSION variable and all documentation references

Made-with: Cursor
2026-04-07 13:07:04 +03:00
taylanbakircioglu b65077c62a fix: use self.repository instead of self.event_repository in EventService histogram method
The EventService stores the repository as self.repository (not
self.event_repository), matching all other methods in the class.

Made-with: Cursor
2026-04-07 09:52:03 +03:00
taylanbakircioglu 4620eb4a4a feat: server-side event histogram for Events Timeline visualization
Replace client-side event bucketing (limited to 50 paginated events) with
server-side ClickHouse aggregation using toStartOfInterval(). This fixes
the timeline showing a single bar despite multiple analysis runs.

Backend:
- Add query_event_histogram() to timeseries-query with epoch-aligned
  bucket generation, capability_checks security filter, and count()-based
  empty table detection
- Add GET /events/histogram endpoints through all layers (timeseries-query,
  backend repository, service, router with analysis_id validation)

Frontend:
- Add getEventHistogram RTK Query hook with EventHistogram cache tag
- Replace client-side timelineData bucketing with server-side histogram
- Stacked bar colors (sorted by eventTypeConfig order for consistency)
- Clickable bars for time-range filtering (zoom-in)
- Loading skeleton, smart time labels (DD MMM HH:mm for multi-day),
  full event type legend filtered by presence, total event count in header
- event_types filter synced with histogram query

Documentation:
- Update CURRENT_ARCHITECTURE, DATA_SOURCES, ARCHITECTURE_DETAILED,
  services/README, and OpenAPI spec with /events/histogram endpoint

Made-with: Cursor
2026-04-06 15:47:49 +03:00
taylanbakircioglu 55c3dfcd41 fix: escape emptyDir braces in f-string to prevent SyntaxError
The config-generated emptyDir volume added inside an f-string
used literal {} which Python interprets as an empty expression.
Escaped to {{}} so it renders as {} in the generated script.

Made-with: Cursor
2026-04-02 10:36:25 +03:00
taylanbakircioglu 6a362c61cc feat: auto-detect container runtime socket in cluster setup scripts
Apply the same init container auto-detection to the setup script
generator (clusters.py). Both emptyDir and PVC DaemonSet variants
now detect K3s/RKE2/MicroK8s/standard containerd socket paths
automatically at pod startup.

Made-with: Cursor
2026-04-01 18:29:49 +03:00
taylanbakircioglu d1df2c31c5 chore: sanitize internal references in code examples and documentation
Made-with: Cursor
2026-03-29 21:41:41 +03:00
taylanbakircioglu 7c43e4c1b1 feat: annotation wildcard matching and openshift noise filter
Made-with: Cursor
2026-03-29 20:32:59 +03:00
taylanbakircioglu bcbef2b896 refactor: rename AI Integration Hub to Integration Hub with UX improvements
Made-with: Cursor
2026-03-29 19:56:13 +03:00
taylanbakircioglu be698d0b0c feat: add aggressive/conservative strategy for exclusion filter
Made-with: Cursor
2026-03-26 09:29:45 +03:00
taylanbakircioglu 7247f7a0f7 feat: add system pod exclusion filter for analyses
Made-with: Cursor
2026-03-25 19:01:15 +03:00
taylanbakircioglu 834ea93dec refactor: reorganize project structure, fix PostgreSQL schema ordering, remove broken override
Made-with: Cursor
2026-03-25 15:50:47 +03:00
taylanbakircioglu 4508a756bb docs: translate all documentation to English, update API docs with AI Integration Hub and annotation features
Made-with: Cursor
2026-03-25 14:27:37 +03:00
taylanbakircioglu 3f35f00b36 feat: add scheduled analysis, rolling window retention & cluster safety
Made-with: Cursor
2026-03-25 12:26:25 +03:00
taylanbakircioglu 16d249e7a3 feat: fix annotation ingestion via gRPC and enrich annotation display across UI
Made-with: Cursor
2026-03-24 15:04:21 +03:00
taylanbakircioglu fdc2ec4b7d feat: add pod annotations support, dependency stream API, and AI Integration Hub
Made-with: Cursor
2026-03-24 13:25:38 +03:00
taylanbakircioglu d7ca50b387 feat: Flowfish - eBPF-powered multi-cluster Kubernetes observability platform
Multi-cluster dependency mapping, real-time network monitoring,
impact analysis, and CI/CD integration capabilities.

Made-with: Cursor
2026-03-29 21:43:20 +03:00