Control normalization in network introspection API

[ovalenti]

Description

With normalization always enabled, the introspection API cannot be used to retrieve all IP addresses. So we add a parameter to disable it.

Link to the updated documentation: https://github.com/stackrox/collector/blob/ovalenti/conn_introspection_no_normalize/docs/troubleshooting.md#network-endpoint

Checklist

• Investigated and inspected CI test results
• Tested the behavior manually at least once (deployed the image built from CI and query the endpoint with normalize=false
• Updated documentation accordingly

[JoukoVirtanen]

[nit] Should be insensitive to capitalization.

[JoukoVirtanen]

Can you improve the PR description to show how this can be used, and show example output with and without normalization? Also can you explain how you tested it? Did you deploy ACS with this collector version?

[ovalenti]

@JoukoVirtanen Thanks for the review :)

Added a link to the updated doc in the PR description. This contains a usage example with corresponding result.

[JoukoVirtanen]

I have tested this. I checked out the master branch of stackrox/stackrox. Ran ./deploy/k8s/deploy-local.sh. Edited the collector ds to change the image to this one and added

        - name: ROX_COLLECTOR_INTROSPECTION_ENABLE
          value: "true"

to the list of environment variables.

Ran

kubectl -n stackrox port-forward ds/collector 8080:8080 &

 curl "http://localhost:8080/state/network/connection?normalize=false" | jq
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0Handling connection for 8080
100  7494  100  7494    0     0  38040      0 --:--:-- --:--:-- --:--:-- 38040
{
  "0e34df2d0a19": [
    {
      "active": false,
      "from": "10.60.11.5/32",
      "l4proto": "TCP",
      "port": 8080
    },
    {
      "active": false,
      "from": "10.60.11.5/32",
      "l4proto": "TCP",
      "port": 8080
    }
  ],
  "11b9ddc4cdb1": [
    {
      "active": true,
      "l4proto": "TCP",
      "port": 443,
      "to": "10.118.53.1/32"
    }
  ],
  "16467eed6e8f": [
    {
      "active": false,
      "from": "10.60.11.5/32",
      "l4proto": "TCP",
      "port": 8443
    },

$ curl "http://localhost:8080/state/network/connection?normalize=true" | jq
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0Handling connection for 8080
100  4023  100  4023    0     0  21513      0 --:--:-- --:--:-- --:--:-- 21629
{
  "0e34df2d0a19": [
    {
      "active": false,
      "from": "10.60.11.5",
      "l4proto": "TCP",
      "port": 8080
    }
  ],
  "11b9ddc4cdb1": [
    {
      "active": true,
      "l4proto": "TCP",
      "port": 443,
      "to": "10.118.53.1"
    }
  ],
  "16467eed6e8f": [
    {
      "active": true,
      "l4proto": "TCP",
      "port": 443,
      "to": "10.118.53.166"
    },

[JoukoVirtanen]

Fixing the nit is optional.