Chapter 13. Monitoring RHACS
You can monitor Red Hat Advanced Cluster Security for Kubernetes (RHACS) by using the built-in monitoring for Red Hat OpenShift or by using custom Prometheus monitoring.
If you use RHACS with Red Hat OpenShift, OpenShift Container Platform includes a preconfigured, preinstalled, and self-updating monitoring stack that provides monitoring for core platform components. RHACS exposes metrics to Red Hat OpenShift monitoring via an encrypted and authenticated endpoint.
13.1. Monitoring with Red Hat OpenShift
Monitoring with Red Hat OpenShift is enabled by default. No configuration is required for this default behavior.
If you have previously configured monitoring with the Prometheus Operator, consider removing your custom ServiceMonitor
resources. RHACS ships with a pre-configured ServiceMonitor
for Red Hat OpenShift monitoring. Multiple ServiceMonitors
might result in duplicated scraping.
Monitoring with Red Hat OpenShift is not supported by Scanner. If you want to monitor Scanner, you must first disable the default Red Hat OpenShift monitoring. Then, configure custom Prometheus monitoring.
For more information on disabling Red Hat OpenShift monitoring, see "Disabling Red Hat OpenShift monitoring for Central services by using the RHACS Operator" or "Disabling Red Hat OpenShift monitoring for Central services by using Helm". For more information on configuring Prometheus, see "Monitoring with custom Prometheus".
13.2. Monitoring with custom Prometheus
Prometheus is an open-source monitoring and alerting platform. You can use it to monitor health and availability of Central and Sensor components of RHACS. When you enable monitoring, RHACS creates a new monitoring service on port number 9090 and a network policy allowing inbound connections to that port.
This monitoring service exposes an endpoint that is not encrypted by TLS and has no authorization. Use this only when you do not want to use Red Hat OpenShift monitoring.
Before you can use custom Prometheus monitoring, if you have Red Hat OpenShift, you must disable the default monitoring. If you are using Kubernetes, you do not need to perform this step.
13.2.1. Disabling Red Hat OpenShift monitoring for Central services by using the RHACS Operator
To disable the default monitoring by using the Operator, change the configuration of the Central
custom resource as shown in the following example. For more information on configuration options, see "Central configuration options using the Operator" in the "Additional resources" section.
Procedure
-
On the OpenShift Container Platform web console, go to the Operators
Installed Operators page. - Select the RHACS Operator from the list of installed Operators.
- Click on the Central tab.
- From the list of Central instances, click on a Central instance for which you want to enable monitoring.
Click on the YAML tab and update the YAML configuration as shown in the following example:
monitoring: openshift: enabled: false
13.2.2. Disabling Red Hat OpenShift monitoring for Central services by using Helm
To disable the default monitoring by using Helm, change the configuration options in the central-services
Helm chart. For more information on configuration options, see the documents in the "Additional resources" section.
Procedure
Update the configuration file with the following value:
monitoring.openshift.enabled: false
-
Run the
helm upgrade
command and specify the configuration files.
13.2.3. Monitoring Central services by using the RHACS Operator
You can monitor Central services, Central and Scanner, by changing the configuration of the Central
custom resource. For more information on configuration options, see "Central configuration options using the Operator" in the "Additional resources" section.
Procedure
-
On the OpenShift Container Platform web console, go to the Operators
Installed Operators page. - Select the Red Hat Advanced Cluster Security for Kubernetes Operator from the list of installed Operators.
- Click on the Central tab.
- From the list of Central instances, click on a Central instance for which you want to enable monitoring for.
Click on the YAML tab and update the YAML configuration:
-
For monitoring Central, enable the
central.monitoring.exposeEndpoint
configuration option for theCentral
custom resource. -
For monitoring Scanner, enable the
scanner.monitoring.exposeEndpoint
configuration option for theCentral
custom resource.
-
For monitoring Central, enable the
- Click Save.
13.3. Monitoring Central services by using Helm
You can monitor Central services, Central and Scanner, by changing the configuration options in the central-services
Helm chart. For more information, see "Changing configuration options after deploying the central-services Helm chart" in the "Additional resources" section.
Procedure
Update the
values-public.yaml
configuration file with the following values:central.exposeMonitoring: true scanner.exposeMonitoring: true
-
Run the
helm upgrade
command and specify the configuration files.
13.3.1. Monitoring Central by using Prometheus service monitor
If you are using the Prometheus Operator, you can use a service monitor to scrape the metrics from Red Hat Advanced Cluster Security for Kubernetes (RHACS).
If you are not using the Prometheus operator, you must edit the Prometheus configuration files to receive the data from RHACS.
Procedure
Create a new
servicemonitor.yaml
file with the following content:apiVersion: monitoring.coreos.com/v1 kind: ServiceMonitor metadata: name: prometheus-stackrox namespace: stackrox spec: endpoints: - interval: 30s port: monitoring scheme: http selector: matchLabels: app.kubernetes.io/name: <stackrox-service> 1
- 1
- The labels must match with the
Service
resource that you want to monitor. For example,central
orscanner
.
Apply the YAML to the cluster:
$ oc apply -f servicemonitor.yaml 1
- 1
- If you use Kubernetes, enter
kubectl
instead ofoc
.
Verification
Run the following command to check the status of service monitor:
$ oc get servicemonitor --namespace stackrox 1
- 1
- If you use Kubernetes, enter
kubectl
instead ofoc
.