INGRESS TRAFFIC CLASSIFICATION IN CONTAINER NETWORK CLUSTERS

Some embodiments of the invention provide a method for identifying and generating visualizations of ingress data traffic flows to a workload cluster in a software-defined network (SDN). From multiple data traffic flows associated with a particular cluster of destination workloads in the SDN, the method identifies a set of ingress data traffic flows destined to the particular cluster of destination workloads. For each identified ingress data traffic flow, the method identifies a service from a set of services through which the ingress data traffic flow reached the particular cluster of destination workloads. The method generates a visualization for display through a user interface (UT), the visualization comprising (i) representations of each workload in the particular cluster of destination workloads, (ii) representations of the set of services through which the set of ingress data traffic flows reach the particular cluster of destination workloads, and (iii) a representation of the set of ingress data traffic flows terminating on the particular cluster of destination workloads.