home-docker/archive/netflow-simple.yaml

apiVersion: v1
kind: Namespace
metadata:
  name: home-apps
---
apiVersion: v1
kind: Service
metadata:
  name: netflow-simple
  namespace: home-apps
  labels:
    app: netflow-simple
spec:
  type: NodePort
  ports:
    - port: 2055
      targetPort: 2055
      nodePort: 30055
      protocol: UDP
      name: flows
    - port: 6343
      targetPort: 6343
      nodePort: 30343
      protocol: UDP
      name: sflow
  selector:
    app: netflow-simple
---
apiVersion: v1
kind: Service
metadata:
  name: netflow-simple-metrics
  namespace: home-apps
  labels:
    app: netflow-simple
    component: metrics
spec:
  ports:
    - port: 8080
      targetPort: 8080
      protocol: TCP
      name: metrics
  selector:
    app: netflow-simple
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: netflow-simple
  namespace: home-apps
  labels:
    app: netflow-simple
spec:
  replicas: 1
  selector:
    matchLabels:
      app: netflow-simple
  template:
    metadata:
      labels:
        app: netflow-simple
    spec:
      containers:
        - name: goflow2
          image: netsampler/goflow2:latest
          ports:
            - containerPort: 2055
              protocol: UDP
              name: flows
            - containerPort: 6343
              protocol: UDP
              name: sflow
            - containerPort: 8080
              protocol: TCP
              name: metrics
          args:
            - "-listen=netflow://:2055,sflow://:6343"
            - "-addr=:8080"
            - "-transport=file"
            - "-format=json"
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: 300m
              memory: 256Mi
---
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: netflow-simple
  namespace: home-apps
  labels:
    app: netflow-simple
    release: prometheus # this makes the service monitor discoverable by prometheus
spec:
  selector:
    matchLabels:
      app: netflow-simple
      component: metrics
  endpoints:
    - port: metrics
      interval: 30s
      path: /metrics
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: router-setup-guide
  namespace: home-apps
data:
  README.md: |
    # Network Flow Monitoring with GoFlow2

    ## Your GoFlow2 flow collector is ready!

    **Collector endpoints**:
    - NetFlow: 192.168.1.2:30055 (UDP)
    - sFlow: 192.168.1.2:30343 (UDP)
    - Prometheus Metrics: Port-forward to access /metrics

    ## Configure your network devices:

    ### Method 1: Router NetFlow Export
    Configure your router to export flows to:
    - **Server**: 192.168.1.2
    - **Port**: 30055 (NodePort mapped to 2055)
    - **Version**: NetFlow v5, v9, or IPFIX

    ### Method 2: Router sFlow Export
    Configure your router to export sFlow to:
    - **Server**: 192.168.1.2
    - **Port**: 30343 (NodePort mapped to 6343)
    - **Version**: sFlow v5

    ### Method 3: ASUS Router Setup
    1. Open router web interface (usually http://192.168.1.1)
    2. Go to **Adaptive QoS** > **Traffic Monitor**
    3. Enable **"Enable Traffic Monitor"**
    4. Set export settings:
       - **NetFlow Server**: 192.168.1.2
       - **Port**: 30055

    ## Accessing GoFlow2 metrics:

    ```bash
    # Access Prometheus metrics
    kubectl port-forward -n home-apps svc/netflow-simple-metrics 8080:8080
    # Then visit http://localhost:8080/metrics

    # View logs (JSON formatted flow data)
    kubectl logs -n home-apps deployment/netflow-simple -c goflow2 -f
    ```

    ## Verify it's working:

    ```bash
    # Check if GoFlow2 is receiving flows
    kubectl logs -n home-apps deployment/netflow-simple -c goflow2 -f

    # Check services
    kubectl get svc -n home-apps | grep netflow

    # Test Prometheus metrics
    kubectl port-forward -n home-apps svc/netflow-simple-metrics 8080:8080
    # Then curl http://localhost:8080/metrics
    ```

    ## Features:

    - **Native Prometheus integration**: Metrics available at /metrics endpoint
    - **Lightweight Go implementation**: More reliable and efficient than ntopng
    - **Multiple protocols**: Supports sFlow v5, NetFlow v5/v9, IPFIX
    - **JSON output**: Flow data logged as structured JSON
    - **Scalable architecture**: Designed for high-volume flow processing

    ## GoFlow2 vs ntopng:

    - **Better reliability**: GoFlow2 is purpose-built for flow collection
    - **Lower resource usage**: More efficient memory and CPU usage
    - **Better Prometheus integration**: Native metrics without web scraping
    - **Protocol support**: Better handling of NetFlow templates and sFlow
    - **Simpler deployment**: No web UI complexity or login requirements

    ## Troubleshooting:

    1. **No flows received?**
       - Check router/device flow export configuration
       - Verify network connectivity to 192.168.1.2:30055 (NetFlow) or 30343 (sFlow)
       - Check firewall rules
       - Ensure flow export format is supported (sFlow v5, NetFlow v5/v9, IPFIX)

    2. **Test UDP connectivity:**
       ```bash
       # Test NetFlow port
       nc -u 192.168.1.2 30055
       # Test sFlow port
       nc -u 192.168.1.2 30343
       ```

    3. **Metrics not appearing in Prometheus?**
       - Check ServiceMonitor is correctly configured
       - Verify Prometheus is scraping the /metrics endpoint on port 8080
       - Check GoFlow2 logs for startup errors

    4. **GoFlow2 startup issues?**
       - Check container logs for binding errors
       - Verify ports are not conflicting
       - Ensure sufficient memory allocation

    ## Supported flow protocols:
    - sFlow v5
    - NetFlow v5/v9
    - IPFIX
    - Cisco NSEL (via IPFIX)

    ## Flow data format:
    GoFlow2 outputs JSON formatted flow records to stdout, which can be viewed via kubectl logs.
    Each flow record contains standardized fields like src_addr, dst_addr, proto, bytes, packets, etc.