NodeNetworkPolicy not creating logs

[notsrch]

Describe the bug
NodeNetworkPolicy type policies do not create logs in /var/log/antrea/networkpolicy/np.log even with enableLogging: true is set

To Reproduce
Create a NodeNetworkPolicy with enableLogging: true
Generate traffic

Expected
Log entry /var/log/antrea/networkpolicy/np.log similar to other ClusterNetworkPolicy

Actual behavior
Nothing is logged

Versions:

• Antrea version
  2.0.1
• Kubernetes version:
  v1.28.8+rke2r1
• Container runtime:
  containerd
• Linux kernel version on the Kubernetes Nodes (uname -r).
  6.4.0-150600.10-default
  -->

Additional context

[tnqn]

@notsrch traffic logging for NodeNetworkPolicy is not implemented, though it should be technically feasible.
@hongliangl could you confirm the feasibility? And before it's supported we should prevent this configuration and document it.

[hongliangl]

@notsrch traffic logging for NodeNetworkPolicy is not implemented, though it should be technically feasible. @hongliangl could you confirm the feasibility? And before it's supported we should prevent this configuration and document it.

Will investigate that.

[hongliangl]

Sorry for replying this late.

The data path of NodeNetworkPolicy is iptables, which supports logging matched packets information to system log (/var/log/syslog or /var/log/messages). Unfortunately, iptables does not natively support logging directly to a specific file. IMO, it is not easy for Antrea to read the corresponding log from the system log file.

It is easy for Antrea using iptables to log the packet information to system log if enableLogging of a ACNP is true, but it is not friendly to users. @tnqn

[tnqn]

The data path of NodeNetworkPolicy is iptables, which supports logging matched packets information to system log (/var/log/syslog or /var/log/messages). Unfortunately, iptables does not natively support logging directly to a specific file. IMO, it is not easy for Antrea to read the corresponding log from the system log file.

It is easy for Antrea using iptables to log the packet information to system log if enableLogging of a ACNP is true, but it is not friendly to users. @tnqn

Tools like rsyslog may redirect logs to specific files, but not sure whether it can be easily configured and works for all OS. If it's too complex, logging to syslog sounds not bad too as long as we document it clearly where to find the logs.

[notsrch]

For us at least, having it logged somewhere/anywhere is better then nothing. When having some deny NodeNetworkPolicy, it is near impossible to troubleshoot anything without some form of log as to the permit/deny action taken with traffic.