observe: Support `-f` and `--first` at the same time

[pchaigno]

Supporting those two flags at the same time would allow us to write for example:

hubble observe -f --first 1 -t drop:140 && cilium sysdump

That would trigger the collection of a sysdump only as soon as a specific kind of packet drop is noticed.

In the meantime, it's possible to achieve the same with:

grep -m 1 "DROPPED" <(hubble observe -t drop:140 -f) && cilium sysdump

[sladyn98]

@pchaigno I would like to contribute to this, could you provide me with some code pointers

[kaworu]

Hi @sladyn98 thanks for the interest!

Currently, in Hubble "follow mode" the server will never close the gRPC stream. If I understand correctly, the proposition is to add support for "an exit condition" to follow mode (in the issue description the condition being once one flow is returned, expressed by --first 1). It means that the task will require two PRs: one against the Hubble server at https://github.com/cilium/cilium and one against the Hubble client (this repository).

The first step would be to remove the safe guards we have around the current incompatibility of "follow" and "first", see here for Hubble server and here for the client.

Then, the server must implement the feature, probably moving this check before the if r.follow branch.

Finally, the feature will need some test (see this one for example) and validation from @pchaigno (please add him as a reviewer!).

[glibsm]

I find the combination of --first and --follow confusing, since when combined it completely changes the meaning of --follow.

Perhaps rather than overloading the combination, we can think of a new flag that would make it clear that we're going to follow the output until something is found.