nassimsai/flow-processor repository overview

⁠Flow Processor — NetworkPolicy Intelligence System

Part of the NetworkPolicy Intelligence System (NPI)⁠.

⁠What it does

Polls Loki every 30 seconds for OVN-Kubernetes ACL drop events (collected cluster-wide by a Fluent Bit DaemonSet), parses them into structured flow records, and incrementally builds per-namespace-pair statistical baselines using Welford's online algorithm — no need to store raw history to compute running mean/variance.

Output feeds two downstream consumers:

• flow_events — individual flow records (TimescaleDB hypertable)
• flow_baseline — running statistics per (src_namespace, dst_namespace, dst_port) key, consumed by the Anomaly Detector for Z-score spike detection

Runs in drops-only mode by default to keep flow volume manageable at scale.

⁠Tech

Python 3.11 · Loki HTTP API · psycopg2 · TimescaleDB

⁠Quick start

docker pull nassimsai/flow-processor:v1.0-pfe2026

Requires: DATABASE_URL env var, network access to the cluster's Loki service.

⁠Source & full deployment guide

https://github.com/nassim-saii/netpol-intelligence⁠