Network Intelligence | Kvisor

⚠️
Warning
The Cast AI Kubernetes Security feature set is undergoing significant changes. Some features shown in this documentation are being deprecated and others are moving to the cluster view in the console. Screenshots and navigation paths may not reflect the current product. Updated documentation is in progress.

This guide explains how to use network intelligence features.

Netflow list

Netflow is a network-related metric that tracks sent and received traffic in bytes. Unlike VPC flow logs, it contains rich Kubernetes context.

In the Netflow list, you can find various Kubernetes cluster network metrics.

The combination of dynamic grouping and advanced CEL—based search makes it easy to find the top cross-zone, cross-namespace, traffic to the Internet, and unexpected spikes.

Search examples

Find cross-zone traffic within the Kubernetes cluster. You can also group sources and destinations by zone only.

zone != "" && dst_zone != "" && zone != dst_zone

Find traffic to the internet.

dst_workload_kind=="internet"

Find any traffic from source namespaces.

ns in ["metrics", "kube-system"]

Find any traffic from source to destination namespaces.

ns == "metrics" && dst_ns == "kube-system"

Find GitLab runners containers that process traffic to the internet. For this search, you can group sources by process only. It can also be helpful to sort by received traffic to see the impact on possible NAT processing impact.

ns == "gitlab" && dst_workload_kind == "internet"

Find traffic from the source namespace and pod name prefix.

ns == "gitlab" && pod_name.startsWith("runner-")

All available search fields

CEL search can combine multiple available fields for Netflow metadata.

Property	Type	Description
protocol	Enum	Available values for the protocol are `udp` and `tcp`
process	string	Source container Linux process name.
container_name	string	Source Kubernetes container name.
pod_name	string	Source Kubernetes pod name.
ns	string	Source Kubernetes namespace.
zone	string	Source node zone.
workload_name	string	Source Kubernetes workload name.
workload_kind	string	Source Kubernetes workload kind.
node_name	string	Source Kubernetes node name.
addr	string	Source IP address
dst_domain	string	Destination DNS domain. This field is the best effort and may not always be present.
dst_pod_name	string	Destination Kubernetes pod name.
dst_ns	string	Destination Kubernetes namespace.
dst_workload_name	string	Destination Kubernetes workload kind or other name for special kinds
dst_workload_kind	string	Destination Kubernetes workload kind or special kinds such as `private` for any unknown private IPs and `internet` for any public IP.
dst_node_name	string	Destination Kubernetes node name.

How to enable Netflow collection

The Netflow collection is implemented with Cast AI Kvisor agent and can be installed via the helm chart.

📘
Which upgrade method to use
The Helm commands on this page use the umbrella chart (castai-helm/castai) by default. If you need to use a different method:
castctl: To upgrade all Cast AI components at once without managing Helm flags:
castctl castware upgrade
This preserves your existing configuration. See the castctl documentation for installation and authentication instructions.
Individual charts: If you installed each component as a separate Helm release (e.g., for ArgoCD or custom GitOps), replace the release name and chart reference with the component-specific ones (e.g., castai-workload-autoscaler and castai-helm/castai-workload-autoscaler) and remove the autoscaler.castai-workload-autoscaler. value prefix.
Not sure which method you used? Run helm list -n castai-agent. A single release named castai means umbrella chart; separate releases like castai-workload-autoscaler mean individual charts.

helm upgrade castai castai-helm/castai -n castai-agent --reset-then-reuse-values \
  --set autoscaler.castai-kvisor.castai.apiKey=<your-api-token> \
  --set autoscaler.castai-kvisor.castai.clusterID=<your-cluster-id> \
  --set autoscaler.castai-kvisor.agent.enabled=true \
  --set autoscaler.castai-kvisor.agent.extraArgs.netflow-enabled=true

📘
Note
If you have egressd running it should be uninstalled.