Network egress: undeclared egress and blocked egress
Run the commands below from the installation directory. See Run operator commands for how ./lens reaches the running installation and copies files into it.
A flow log is the network’s own account of what a workload tried to reach. Your Kubernetes network (Cilium, through Hubble) or your cloud network (AWSAWSAmazon Web Services: a cloud platform whose account and resource exports NovusLens can read. VPCVPCVirtual private cloud: a private network defined inside a cloud provider's infrastructure. Flow Logs) records each connection and whether it was forwarded or dropped. NovusLens reads that export, joins each sending workload to a cellCellA box on the map that stands for a team, service, supplier or AI agent. It is a unit you can inspect, not necessarily a department or a person. through your mapping, and compares the destinations with the egressEgressTraffic leaving a system or network for another destination. the mapping declares for that cell.
| FindingFindingA difference in the records that needs a decision. It includes its sources and can describe a slow handoff, disputed fact or missing owner. | What it means |
|---|---|
| Undeclared egress | The network forwarded traffic from the cell to a destination its declared egress does not include. It fires only where the declaration names the destination as excluded, or where the declaration says its list is complete |
| Blocked egress | The network dropped connection attempts from the cell. The record comes from the network, which is where the confinement held |
Blocked egress is not a gatewayGatewayA service that accepts requests and passes them into another system. The Mycelium gateway gives NovusLens access to the mesh. decision. A connection the network dropped never reached a gateway, so no gateway saw it, permitted it or refused it. Only network telemetryTelemetryMeasurements and activity records sent by a running system, such as ticket timings, network traffic or workflow results. can show it. A gateway’s own decisions are a different record, from a different observer, and appear through agent evidence. The two are never merged, and a blocked-egress finding never says that a gateway refused anything.
The declaration stands. An undeclared-egress finding does not change the declared egress. The declaration and the measurement are kept side by side, and the difference is for the cell’s owner to look into. It is evidence, not a diagnosis.
An incomplete list proves nothing. If the declaration is not marked complete, a destination it does not list is shown as review required, not as a finding. See Review required.
Read the coverage before you read the findings. Every finding carries what the export covered: its time window, how many flows could be attributed to a cell, and its gaps. Lines that could not be read, VPC NODATA and SKIPDATA intervals, Hubble lost events, and sending workloads the mapping does not cover are all counted. A mapped cell with no flow in the export is named as silent. Silence means the export shows nothing from it. It does not mean nothing was sent.
Limits. NovusLens can only compare destinations with the declaration you gave it, so the result is only as complete as that declaration. Providers may sample or aggregate flows before export. A VPC flow record covers a whole aggregation interval, not one connection. AWS does not log traffic to the instance metadata service or the Amazon DNS resolver, so its absence from a VPC export shows nothing either way.
To run it. Acquire the export, then run the correction command, which records the observations and raises the findings:
./lens exec -- sh -c 'cat > /tmp/flows.jsonl' < flows.jsonl
./lens connectors acquire --org <org> --kind network-flow --format hubble --flow-log /tmp/flows.jsonl --mapping egress.json
./lens connectors correct --org <org>These findings stay open until someone resolves them. A later export that no longer shows the traffic does not close them, because traffic that was not seen has not necessarily stopped.