Using the Red Hat build of Cryostat Operator to configure Cryostat

Procedure

1. On your Red Hat OpenShift web console, click Operators > Installed Operators.
2. From the list of available operators, select Red Hat build of Cryostat.
3. Click the Details tab.

4. In the Provided APIs section, the Cryostat and Cluster Cryostat custom resources (CRs) are available. Select one of the following options:

   • To create a single-namespace Cryostat instance, select Cryostat, then click Create instance.
   • To create a multi-namespace instance of Cryostat, select Cluster Cryostat, then click Create instance.

5. To configure the minimal property, choose one of the following options:

   1. Click the Form view radio button.

      1. Set the Minimal Deployment switch to true. You must also enter a value in the Name field.

         Figure 1.1. Toggling the Minimal Deployment switch to true

         

         View larger image

         

      2. Click Create. Depending on the type of instance you created, the instance opens under one of the following tabs:

         • If you created a single-namespace Cryostat instance, the instance is available under the Cryostat tab on the Operator details page.
         • If you created a Cluster Cryostat instance, the instance is available under the Cluster Cryostat tab on the Operator details page.

   2. Click the YAML view radio button.

      1. Change the value for the minimal property to true in the spec: key set.

         Example of configuring the minimal property

         --
         apiVersion: operator.cryostat.io/v1beta1
         kind: Cryostat
         metadata:
           name: cryostat-sample
         spec:
           minimal: true
         --

         Copy to Clipboard Toggle word wrap

      2. Click Save.

Verification

1. From the Red Hat OpenShift web console, select the project where you created your Cryostat instance or the project you chose as the Install Namespace of your Cluster Cryostat instance.
2. Navigate to Workloads → Deployments.
3. From the list of deployments, select the deployment that matches the name of your Cryostat or Cluster Cryostat instance. A Deployment details page opens on your web console.
4. Navigate to the Containers section. A single listed container indicates that the Red Hat build of Cryostat Operator has deployed your Cryostat application as a minimal deployment.

Procedure

1. Navigate to Operators > Installed Operators on your OpenShift web console.
2. From the list of available operators, select Red Hat build of Cryostat.
3. Click the Details tab.

4. In the Provided APIs section, the Cryostat and Cluster Cryostat custom resources (CRs) are available. Select one of the following options:

   • To create a single-namespace Cryostat instance, select Cryostat, then click Create instance.
   • To create a multi-namespace instance of Cryostat, select Cluster Cryostat, then click Create instance.

5. To configure the enableCertManager property, choose one of the following options:

   1. Click the Form view radio button.

      1. Set the Enable cert-manager Integration switch to false, and then enter a value in the Name field.

         Figure 1.2. Toggling the Enable cert-manager Integration switch to false

         

         View larger image

         

      2. Click Create. Depending on the type of instance you created, the instance opens under one of the following tabs:

         • If you created a single-namespace Cryostat instance, the instance is available under the Cryostat tab on the Operator details page.
         • If you created a Cluster Cryostat instance, the instance is available under the Cluster Cryostat tab on the Operator details page.

   2. Click the YAML view radio button.

      1. In the spec: key set of the YAML file, change the enableCertManager property to false.

         Example of configuring the spec: key set in a YAML file

         --
         apiVersion: operator.cryostat.io/v1beta1
         kind: Cryostat
         metadata:
           name: cryostat-sample
         spec:
           enableCertManager: false
         --

         Copy to Clipboard Toggle word wrap

      2. Click the Save button.

         The Red Hat build of Cryostat Operator automatically restarts your Cryostat application, enabling the application to run with the updated enableCertManager property configuration.

Verification

1. Select your Cryostat or Cluster Cryostat instance:

   • If you created a Cryostat instance, select your Cryostat instance from the Cryostat tab on the Operator details page.
   • If you created a Cluster Cryostat instance, select your Cluster Cryostat instance from the Cluster Cryostat tab on the Operator details page.
2. Navigate to the Cryostat Conditions table.

3. Verify that the TLSSetupComplete condition is set to true and that the Reason column for this condition is set to CertManagerDisabled. This indicates that you have set the enableCertManager property to false.

   Figure 1.3. Example showing the TLSSetupComplete condition set to true

   

   View larger image

   

Procedure

1. To download a default event template, navigate to your Cryostat web console and from the Events menu, click Downloads.

   Note

   Event templates are in XML format and have a file name extension of .jfc.

2. Optional: If you want a custom event template, edit the downloaded default event template by using a text editor or XML editor to configure the template to meet your needs.
3. Log in to your Red Hat OpenShift web console by entering the oc login command in your CLI.

4. Create a ConfigMap resource from the event template by entering the following command in your CLI. You must issue the command in the path where you want to deploy your Cryostat application. You can use this resource to store an event template file that is inside the cluster where you run your Cryostat instance.

   Example of creating a ConfigMap resource by using the CLI

   $ oc create configmap <template_name> --from-file=<path_to_custom_event_template>

   Copy to Clipboard Toggle word wrap

5. On your Red Hat OpenShift web console, click Operators > Installed Operators.
6. From the list of available operators, select Red Hat build of Cryostat.

7. Under the Details tab on the Operator details page, create a Cryostat or Cluster Cryostat instance.

   1. In the Provided APIs section, the Cryostat and Cluster Cryostat custom resources (CRs) are available. Select one of the following options:

      • To create a single-namespace Cryostat instance, select Cryostat, then click Create instance.
      • To create a multi-namespace instance of Cryostat, select Cluster Cryostat, then click Create instance.

8. Choose one of the following options to upload an event template in XML format into a resource:

   1. Click the Form view radio button.

      1. Navigate to the Event Templates section of the Cryostat or Cluster Cryostat instance.
      2. From the Event Templates menu, click Add Event Template. An Event Templates section opens on your Red Hat OpenShift console.

      3. From the Config Map Name drop-down list, select the ConfigMap resource that contains your event template.

         Figure 1.4. Event Templates option for a Cryostat instance

         

         View larger image

         
      4. In the Filename field, enter the name of the .jfc file that is contained within your ConfigMap.
      5. To generate a Cryostat or a Cluster Cryostat instance with your custom event template, click Create.

   2. Click the YAML view radio button.

      1. Specify any custom event templates for the eventTemplates property. This property points the Red Hat build of Cryostat Operator to your ConfigMap, so that the Red Hat build of Cryostat Operator can read the event template.

         Example of specifying custom event templates for the eventTemplates property

         --
         apiVersion: operator.cryostat.io/v1beta1
         kind: Cryostat
         metadata:
           name: cryostat-sample
         spec:
           eventTemplates:
           - configMapName: custom-template1
             filename: my-template1.jfc
           - configMapName: custom-template2
             filename: my-template2.jfc
         --

         Copy to Clipboard Toggle word wrap

         Important

         You must select the name of a ConfigMap, which is associated with your Cryostat or Cluster Cryostat instance, from the configMapName drop-down list. Additionally, you must specify a key associated with the ConfigMap in the filename field.

         The Red Hat build of Cryostat Operator can now provide the custom event template as an XML file to your Cryostat application. Your custom event template opens alongside default event templates in your Cryostat web console.

Verification

1. On the Cryostat web console, click Events from the menu. If an Authentication Required window opens on your web console, enter your credentials and click Save.

2. Under the Event Templates tab, check if your custom event template shows in the list of available event templates.

   Figure 1.5. Example of a listed custom event template under the Event Templates tab

   

   View larger image

   

Procedure

1. On your Red Hat OpenShift web console, click Operators > Installed Operators.
2. From the list of available operators, select Red Hat build of Cryostat.
3. On the Operator details page, click the Details tab.

4. In the Provided APIs section, the Cryostat and Cluster Cryostat custom resources (CRs) are available. Select one of the following options:

   1. To create a single-namespace Cryostat instance, select Cryostat, then click Create instance.
   2. To create a multi-namespace instance of Cryostat, select Cluster Cryostat, then click Create instance.

5. To configure a TLS certificate, choose one of the following options:

   1. Click the Form view radio button.

      1. In the Name field, specify a name for the instance of Cryostat that you want to create.

      2. Expand the Trusted TLS Certificates option, then click Add Trusted TLS Certificate. A list of options displays on your Red Hat OpenShift web console.

         Figure 1.6. The Trusted TLS Certificates option

         

         View larger image

         

      3. Select a TLS secret from the Secret Name list. The Certificate Key field is optional.

         Note

         You can remove a TLS certificate by clicking Remove Trusted TLS Certificate.

      4. Click Create. Depending on the type of instance you created, the instance opens under one of the following tabs:

         • If you created a single-namespace Cryostat instance, the instance is available under the Cryostat tab on the Operator details page.
         • If you created a Cluster Cryostat instance, the instance is available under the Cluster Cryostat tab on the Operator details page.

   2. Click the YAML view radio button.

      1. Specify your secret, which is located in the same namespace as your Cryostat application, in the secretName property of the trustedCertSecrets array.

         Example of specifying a secret in the trustedCertSecrets array

         --
         apiVersion: operator.cryostat.io/v1beta1
         kind: Cryostat
         metadata:
           name: cryostat-sample
         spec:
           trustedCertSecrets:
           - secretName: my-tls-secret
         --

         Copy to Clipboard Toggle word wrap

      2. Optional: Change the certificateKey property value to the application’s X.509 certificate file name. If you do not change the value, the certificateKey property defaults to tls.crt.

         Example of changing the certificateKey property’s value

         --
         apiVersion: operator.cryostat.io/v1beta1
         kind: Cryostat
         metadata:
           name: cryostat-sample
         spec:
           trustedCertSecrets:
           - secretName: my-tls-secret
             certificateKey: ca.crt
         --

         Copy to Clipboard Toggle word wrap

      3. Click Save.

         The Red Hat build of Cryostat Operator automatically restarts your Cryostat instance with the configured security settings.

Verification

1. Determine that all your application pods exist in the same OpenShift cluster namespace as your Cryostat pod by issuing the following command in your CLI:

   $ oc get pods

   Copy to Clipboard Toggle word wrap
2. Log in to the web console of your Cryostat instance.
3. On the Dashboard menu for your Cryostat instance, select a target JVM from the Target list.

4. In the navigation menu on the Cryostat web console, select Recordings. On the Authentication Required dialog window, enter your secret’s credentials and then select Save to provide your credentials to the target JVM.

   Note

   If the selected target has password authentication enabled for JMX connections, you must provide the JMX credentials for the target JVM when prompted for a connection.

   Cryostat connects to your application through the authenticated JMX connection. You can now use the Recordings and Events functions to monitor your application’s JFR data.

Procedure

1. On your Red Hat OpenShift web console, click Operators > Installed Operators.

2. From the list of available operators, select Red Hat build of Cryostat.

   1. Click the Details tab.

3. In the Provided APIs section, the Cryostat and Cluster Cryostat custom resources (CRs) are available. Select one of the following options:

   • To create a single-namespace Cryostat instance, select Cryostat, then click Create instance.
   • To create a multi-namespace instance of Cryostat, select Cluster Cryostat, then click Create instance.

4. To change storage settings for your Cryostat application, choose one of the following options:

   1. Click the Form view radio button.

      1. Navigate to the Storage Options section, and enter a value in the Name field.
      2. Expand Storage Options and click Empty Dir. An expanded selection of options opens on your Red Hat OpenShift web console.

      3. Set the Enabled switch to true.

         Figure 1.7. Example showing the Empty Dir switch set to true

         

         View larger image

         

      4. Click Create. Depending on the type of instance you created, the instance opens under one of the following tabs:

         • If you created a single-namespace Cryostat instance, the instance is available under the Cryostat tab on the Operator details page.
         • If you created a Cluster Cryostat instance, the instance is available under the Cluster Cryostat tab on the Operator details page.

   2. Click the YAML view radio button.

      1. In the spec: key set of the YAML file, add the storageOptions definition and set the emptyDir property to true.

         Example showing the emptyDir property set as true

         --
         apiVersion: operator.cryostat.io/v1beta1
         kind: Cryostat
         metadata:
           name: cryostat-sample
         spec:
           storageOptions:
             emptyDir:
               enabled: true
               medium: "Memory"
               sizeLimit: 1Gi
         --

         Copy to Clipboard Toggle word wrap

      2. Optional: Set values for the medium and sizeLimit properties.
      3. Click the Save button. The Red Hat build of Cryostat Operator creates an EmptyDir volume for storage instead of creating a PVC for your Cryostat instance.

Procedure

1. From the Red Hat OpenShift web console, click Operators > Installed Operators.
2. From the list of available operators, select Red Hat build of Cryostat.
3. Click Provided APIs > Create. The Red Hat build of Cryostat Operator does not create a service account for the Report sidecar pods. Instead, these pods use default service accounts in their own namespaces.

4. To configure a security context, complete one of the following options:

   1. Click YAML view. From the spec: element, edit the securityOptions and reportOptions properties to match your security requirements.

      Example configuration for a security context

      apiVersion: operator.cryostat.io/v1beta1
      kind: Cryostat
      metadata:
        name: cryostat-sample
      spec:
        securityOptions:
          podSecurityContext:
            runAsNonRoot: true
            seccompProfile:
              type: RuntimeDefault
          coreSecurityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            runAsUser: 1001
          dataSourceSecurityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
          grafanaSecurityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
        reportOptions:
          replicas: 1
          podSecurityContext:
            runAsNonRoot: true
            seccompProfile:
              type: RuntimeDefault
          reportsSecurityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            runAsUser: 1001

      Copy to Clipboard Toggle word wrap

   2. Expand Advanced Configurations to open additional options on your Red Hat OpenShift web console.

      Figure 2.1. The Advanced configuration menu options

      

      View larger image

      
   3. Expand Core Security Context. From the available list of options, define settings for your security context.
5. Click Create.
6. Repeat step one through five for Data Source Security Context, Grafana Security Context, and Pod Security Context as appropriate.

7. Optional: If you are using the Report Generator service, you can also configure the security contexts for this service, as follows:

   1. From Report Options, expand Advanced Configurations.
   2. Expand Security Options. Define Reports Security Context and Pod Security Context as appropriate.

Procedure

1. Define a custom permission mapping in a ConfigMap object.

   Example of a ConfigMap containing the permission mapping

   apiVersion: v1
   kind: ConfigMap
   metadata:
     name: auth-properties
   data:
     auth.properties: |
       TARGET=pods,deployments.apps
       RECORDING=pods,pods/exec
       CERTIFICATE=deployments.apps,pods,cryostats.operator.cryostat.io
       CREDENTIALS=cryostats.operator.cryostat.io

   Copy to Clipboard Toggle word wrap

   To use custom permission mapping, a ClusterRole must exist and contain permissions for all Red Hat OpenShift objects listed in custom permission mapping.

   Example of a ClusterRole that contains the necessary rules

   apiVersion: rbac.authorization.k8s.io/v1
   kind: ClusterRole
   metadata:
     name: additional-oauth-client
   rules:
   - apiGroups:
     - operator.cryostat.io
     resources:
     - cryostats
     verbs:
     - create
     - patch
     - delete
     - get
   - apiGroups:
     - ""
     resources:
     - pods
     - pods/exec
     verbs:
     - create
     - patch
     - delete
     - get
   - apiGroups:
     - apps
     resources:
     - deployments
     verbs:
     - create
     - patch
     - delete
     - get

   Copy to Clipboard Toggle word wrap

   After you enter your credentials on the Red Hat OpenShift web console, the OAuth server uses your credentials and the specified scope to generate an API token.

2. Provide the authProperties spec in the Cryostat Custom Resource (CR) to reference the ConfigMap that holds the mapping content, and ClusterRole that defines RBAC access for those mapped Red Hat OpenShift resources.

   Example of a Cryostat CR with authProperties that define a custom permission mapping

   apiVersion: operator.cryostat.io/v1beta1
   kind: Cryostat
   metadata:
     name: cryostat-sample
   spec:
     authProperties:
   	configMapName: auth-properties
   	filename: auth.properties
   	clusterRoleName: oauth-cluster-role

   Copy to Clipboard Toggle word wrap

   Alternatively, you can open your Red Hat OpenShift web console, create a Cryostat instance, and define ClusterRole Name, ConfigMap Name, and Filename properties in the Authorization Properties option, which you can access in the Advanced configuration section.

   Figure 3.1. The Advanced configuration section on the OpenShift web console

   

   View larger image

   

Verification

1. From the Installed Operators menu, select your Cryostat instance.
2. Click the link in the Application URL section to access the login screen. The OAuth server redirects you to an OpenShift Container Platform login page.
3. Enter your credential details and then click Login. For the first time you log in through the OAuth server, an Authorize Access page opens on your web browser.
4. From the Requested Permissions option, confirm that the cluster role name matches the name that you specified in the Cryostat CR.

5. From the Authorize Access window, you can select the required checkboxes. For optimal Cryostat performance, select all checkboxes.

   Figure 3.2. The Authorize Access window that lists three permissions

   

   View larger image

   

   The Authorize Access window lists the following permissions:

   • User:check-access, which is a permission check that the internal Cryostat application requests. Permission provides a user with read-only access to view their privileges.
   • role:cryostat-operator-oauth-client:<namespace>, which is a permission check that the internal Cryostat application requests. Replace <namespace> with the name of your project name or your namespace from your CLI. Permission provides a user with access to complete any operations that the cryostat-operator-oauth-client role specifies, except access to escalate resources, such as secrets.
   • role:<user-define-clusterrole-name>:<namespace>: The clusterrole that you defined in the Cryostat CR spec. Replace <namespace> with the name of your project name or your namespace from your CLI. Permission provides a user with access to complete any operations that the additional-oauth-client role specifies, except escalating access to resources, such as secrets.

6. Choose one of the following options:

   1. Click Allow selected permissions if you want to accept the selected requested permissions.

   2. Click Deny button if you want to reject all requested permission options.

      Your web browser redirects you to the Cryostat web console, where you can monitor Java applications that are running in a Java Virtual Machine (JVM).