Chapter 13. Monitoring with Prometheus

Procedure

1. On the OpenShift Container Platform web console, go to the Operators Installed Operators page.
2. Select the Red Hat Advanced Cluster Security for Kubernetes Operator from the list of installed Operators.
3. Click on the Central tab.
4. From the list of Central instances, click on a Central instance for which you want to enable monitoring for.

5. Click on the YAML tab and update the YAML configuration:

   • For monitoring Central, enable the central.monitoring.exposeEndpoint configuration option for the Central custom resource.

     Copy to Clipboard Toggle word wrap

     apiVersion: platform.stackrox.io/v1alpha1
     kind: Central
     ...
     spec:
       central:
         monitoring:
           exposeEndpoint: Enabled
     ...

   • For monitoring Scanner, enable the scanner.monitoring.exposeEndpoint configuration option for the Central custom resource.

     Copy to Clipboard Toggle word wrap

     apiVersion: platform.stackrox.io/v1alpha1
     kind: Central
     ...
     spec:
       scanner:
         monitoring:
           exposeEndpoint: Enabled
     ...

6. Click Save.

Procedure

1. Update the values-public.yaml configuration file with the following values:

   Copy to Clipboard Toggle word wrap

   central.exposeMonitoring: true
   scanner.exposeMonitoring: true

2. Run the helm upgrade command and specify the configuration files using the -f option:

   Copy to Clipboard Toggle word wrap

   $ helm upgrade -n stackrox \
     stackrox-central-services rhacs/central-services \
     -f <path_to_values_public.yaml>

   Note

   You can also specify configuration values using the --set or --set-file parameters. However, these options are not saved, and it requires you to manually specify all the options again whenever you make changes.

Procedure

1. Create a new servicemonitor.yaml file with the following content:

   Copy to Clipboard Toggle word wrap

   apiVersion: monitoring.coreos.com/v1
   kind: ServiceMonitor
   metadata:
     name: prometheus-stackrox
     namespace: stackrox
   spec:
     endpoints:
       - interval: 30s
         port: monitoring
         scheme: http
     selector:
       matchLabels:
         app.kubernetes.io/name: <stackrox-service> 

   1

   1

   The labels must match with the Service resource that you want to monitor. For example, central or scanner.

2. Apply the YAML to the cluster:

   Copy to Clipboard Toggle word wrap

   $ oc apply -f servicemonitor.yaml 

   1

   1

   If you use Kubernetes, enter kubectl instead of oc.

Procedure

1. Patch the services to expose the port number 9090.

   1. Patch the Sensor service:

      Copy to Clipboard Toggle word wrap

      $ oc -n stackrox patch svc/sensor -p '{"spec":{"ports":[{"name":"monitoring","port":9090,"protocol":"TCP","targetPort":9090}]}}' 

      1

      1

      If you use Kubernetes, enter kubectl instead of oc.

   2. Patch the Central service:

      Copy to Clipboard Toggle word wrap

      $ oc -n stackrox patch svc/central -p '{"spec":{"ports":[{"name":"monitoring","port":9090,"protocol":"TCP","targetPort":9090}]}}'

2. Modify network policies to allow ingress.

   Copy to Clipboard Toggle word wrap

   $ oc apply -f - <<EOF 

   1

   
   apiVersion: networking.k8s.io/v1
   kind: NetworkPolicy
   metadata:
     labels:
       app.kubernetes.io/name: stackrox
     name: allow-monitoring
     namespace: stackrox
   spec:
     ingress:
     - ports:
       - port: 9090
         protocol: TCP
     podSelector:
       matchExpressions:
       - {key: app, operator: In, values: [central, sensor, collector]}
     policyTypes:
     - Ingress
   EOF

   1

   If you use Kubernetes, enter kubectl instead of oc.