Chapter 15. Monitoring RHACS

Procedure

1. On the OpenShift Container Platform web console, go to the Ecosystem Installed Operators page.
2. Select the RHACS Operator from the list of installed Operators.
3. Click on the Central tab.
4. From the list of Central instances, click on a Central instance for which you want to enable monitoring.

5. Click on the YAML tab and update the YAML configuration as shown in the following example:

   monitoring:
       openshift:
           enabled: false

   Copy to Clipboard Toggle word wrap

Procedure

1. Update the configuration file with the following value:

   monitoring.openshift.enabled: false

   Copy to Clipboard Toggle word wrap
2. Run the helm upgrade command and specify the configuration files.

Procedure

1. On the OpenShift Container Platform web console, go to the Ecosystem Installed Operators page.
2. Select the Red Hat Advanced Cluster Security for Kubernetes Operator from the list of installed Operators.
3. Click on the Central tab.
4. From the list of Central instances, click on a Central instance for which you want to enable monitoring for.

5. Click on the YAML tab and update the YAML configuration:

   • For monitoring Central, enable the central.monitoring.exposeEndpoint configuration option for the Central custom resource.
   • For monitoring Scanner, enable the scanner.monitoring.exposeEndpoint configuration option for the Central custom resource.
6. Click Save.

Procedure

1. Create a new servicemonitor.yaml file with the following content:

   apiVersion: monitoring.coreos.com/v1
   kind: ServiceMonitor
   metadata:
     name: prometheus-stackrox
     namespace: stackrox
   spec:
     endpoints:
       - interval: 30s
         port: monitoring
         scheme: http
     selector:
       matchLabels:
         app.kubernetes.io/name: <stackrox-service>

   Copy to Clipboard Toggle word wrap

   where:

   app.kubernetes.io/name:<stackrox-service>

   Specifies the name of the service to monitor. The label must match with the Service resource that you want to monitor. For example, central or scanner.

2. Apply the YAML to the cluster:

   $ oc apply -f servicemonitor.yaml

   Copy to Clipboard Toggle word wrap

Procedure

1. Perform role mapping to ensure that the Prometheus server can access the Central API with a service account token:

   1. Create and assign a role with the appropriate permission set and scope.

   2. Add a role mapping to the machine access configuration by using the following service account information:

      type	KUBE_SERVICE_ACCOUNT
      key	sub
      value	system:serviceaccount:stackrox:prometheus-server

2. Verify that the Prometheus custom resource (CR) contains the following information:

   # ...
     serviceAccountName: prometheus-server
     volumes:
     - name: prometheus-token
       projected:
         sources:
         - serviceAccountToken:
             path: token
             expirationSeconds: 3600
     volumeMounts:
     - name: prometheus-token
       mountPath: /var/run/secrets/tokens
       readOnly: true
     additionalScrapeConfigs:
       name: prometheus-additional-scrape-configs
       key: prometheus-additional.yaml
   # ...

   Copy to Clipboard Toggle word wrap

3. Create the additional scrape configuration secret by using the following content, for example:

   apiVersion: v1
   kind: Secret
   metadata:
     name: prometheus-additional-scrape-configs
     namespace: stackrox
   stringData:
     prometheus-additional.yaml: |
       - job_name: 'central-metrics'
         scheme: https
         metrics_path: /metrics
         bearer_token_file: /var/run/secrets/tokens/token
         tls_config:
           insecure_skip_verify: true
         static_configs:
         - targets: ['central.stackrox.svc.cluster.local:443']

   Copy to Clipboard Toggle word wrap

Prerequisites

1. You have configured Prometheus to scrape metrics from the Central service.

   For more information, see "Setting a Prometheus server scraping from Central service".

Procedure

1. Create the Perses data source by using the following content, for example:

   apiVersion: perses.dev/v1alpha1
   kind: PersesDatasource
   metadata:
     name: rhacs-datasource
     namespace: stackrox
   spec:
     client:
       tls:
         caCert:
           certPath: /ca/service-ca.crt
           type: file
         enable: true
     config:
       default: true
       display:
         name: RHACS Prometheus Datasource
       plugin:
         kind: PrometheusDatasource
         spec:
           proxy:
             kind: HTTPProxy
             spec:
               url: 'http://<PROMETHEUS_SERVICE_HOSTNAME>:<PROMETHEUS_SERVICE_PORT>'

   Copy to Clipboard Toggle word wrap

   where:

   <PROMETHEUS_SERVICE_HOSTNAME>

   Specifies the hostname of the Prometheus service in your cluster.

   • If Prometheus is installed by using the monitoring stack, the hostname might be, for example, prometheus-operated.stackrox.svc.cluster.local.
   • If Prometheus in installed by using the Prometheus Operator or another installation, the hostname might be something different.

   <PROMETHEUS_SERVICE_PORT>

   Specifies the port of the Prometheus service in your cluster. For example, 9090.

2. Create a Perses dashboard by using the following content, for example:

   apiVersion: perses.dev/v1alpha1
   kind: PersesDashboard
   metadata:
     name: sample-stackrox-dashboard-mini
     namespace: stackrox
   spec:
     display:
       name: Advanced Cluster Security / Sample
     panels:
       "total_policy_violations":
         kind: "Panel"
         spec:
           display:
             name: "Total policy violations"
           plugin:
             kind: "StatChart"
             spec:
               calculation: "last"
           queries:
             - kind: "TimeSeriesQuery"
               spec:
                 plugin:
                   kind: "PrometheusTimeSeriesQuery"
                   spec:
                     query: sum(rox_central_policy_violation_namespace_severity{Cluster=~'$Cluster',Namespace=~'$Namespace'})
   
     layouts:
       - kind: Grid
         spec:
           display:
             title: Policies
             collapse:
               open: true
           items:
             - content:
                 $ref: "#/spec/panels/total_policy_violations"
               "x": 0
               "y": 0
               "width": 6
               "height": 3
   
     variables:
       - kind: ListVariable
         spec:
           name: Cluster
           allowMultiple: true
           allowAllValue: true
           plugin:
             kind: PrometheusLabelValuesVariable
             spec:
               labelName: Cluster
   
       - kind: ListVariable
         spec:
           name: Namespace
           allowMultiple: true
           allowAllValue: true
           plugin:
             kind: PrometheusLabelValuesVariable
             spec:
               labelName: Namespace
     duration: 30d
     refreshInterval: 1m

   Copy to Clipboard Toggle word wrap

   This YAML creates a Perses dashboard in the stackrox namespace that shows a status panel for the total policy violations over the last 30 days, with variables for Cluster and Namespace, that refreshes every minute.