To let Faddom connect to a Kubernetes cluster, you need to provide a kubeconfig file to allow access to the cluster APIs or AWS credentials for EKS. This will allow Faddom to see the Kubernetes cluster, if you also want to see the traffic inside the cluster, you need the nodes and set it up to send the sFlow traffic to Faddom. For details on using host sFlow our Capturing network traffic using agents guide.
To perform the Integration, you do the following
Go to Settings
Select Data Sources
Press on the Kubernetes icon
Provide the kubeconfig file or AWS EKS credentials
Note: Name needs to be identical to the name of your Kubernetes cluster. For example if the name is Faddom-Kubernetes this is what needs to be added
When you are using a kubeconfig file, the file should not contain references to other files on the file system. For example, you should use the client-certificate-data field to embed the certificate data in the file instead of using the client-certificate field which references an external file. Once you have added a configuration file, Faddom should be able to access the Kubernetes APIs to add information on the services running on that cluster.
Traffic Collection for Cilium and OpenShift
For clusters running Cilium or OpenShift, Faddom supports dedicated methods of traffic collection.
OpenShift
The NetFlow exporter is not enabled by default in OpenShift. To enable it, configure the Cluster Network Operator (CNO) with your Faddom server, sensor, or proxy as the collector IP.
Create a patch file with the following configuration:
spec:
exportNetworkFlows:
netFlow:
collectors:
- <FADDOM_IP>:<PORT>
Apply the configuration:
oc patch network.operator cluster --type merge -p "$(cat <file_name>.yaml)"
Verify the configuration was applied:
oc get network.operator cluster -o jsonpath="{.spec.exportNetworkFlows}"Prerequisites:
OpenShift CLI (
oc) installedLogged in with
cluster-adminprivilegesFaddom server, sensor, or proxy reachable from the cluster nodes
For full details, see the official Red Hat documentation on tracking network flows.
Cilium
Faddom collects traffic from Cilium clusters via Hubble Relay using a lightweight pod deployed on the cluster.
Prerequisites:
Cilium CNI with Hubble Relay enabled (hubble.relay.enabled=true)
Faddom server, sensor, or proxy reachable from the cluster
Internet access from cluster nodes to pull from Docker Hub (faddom/hubble-agent) (or a private registry for air-gapped installations)
Deployment:
Download the deployment files:
faddom-hubble-agent.yaml,deploy-faddom-hubble-agent.sh, and optionallynetwork-policy.yaml(for egress restriction) — see the bottom of this article for files.
Run the deployment script and follow the prompts:
./deploy-faddom-hubble-agent.shOr, to apply the manifest directly, first editfaddom-hubble-agent.yamland replaceSENSOR_IP_ADDRESSwith your Faddom sensor, proxy, or server IP, then run:kubectl apply -f faddom-hubble-agent.yaml
Configuration:
All settings are environment variables in the deployment YAML:
Environment Variable | Default | Description |
| (required) | IP or hostname of your Faddom sensor or proxy |
|
| Hubble Relay service DNS name |
|
| Hubble Relay service port |
|
| Set a unique value per cluster when multiple clusters send to the same sensor |
| (empty) | Optional JSON flow filters (see below) |
|
|
|
Updating the sensor IP:
kubectl -n faddom-discovery edit configmap faddom-hubble-agent-config kubectl -n faddom-discovery rollout restart deployment faddom-hubble-agent
Updating other settings (triggers automatic pod restart):
kubectl -n faddom-discovery set env deployment/faddom-hubble-agent FLOW_SAMPLE_RATE=10
Flow Filters (Optional):
Filters are applied at the Hubble Relay level before flows reach the agent. DROPPED and ERROR verdicts are always excluded automatically.
# Exclude DNS traffic HUBBLE_FLOW_FILTERS: '[{"destination_port": ["53"], "blacklist": true}]' # Exclude kube-system namespace HUBBLE_FLOW_FILTERS: '[{"source_pod": ["kube-system/"], "blacklist": true}]'Changing log level at runtime (no restart required):
kubectl -n faddom-discovery edit configmap faddom-hubble-agent-logging # Change level="INFO" to level="DEBUG" — takes effect within ~65 seconds
To uninstall:
kubectl delete namespace faddom-discovery