9.9. 监控 Red Hat OpenShift 的 cert-manager Operator

流程

1. 运行以下命令添加标签以启用集群监控：

   $ oc label namespace cert-manager openshift.io/cluster-monitoring=true

2. 创建服务监控器：

   1. 创建定义 Role、RoleBinding 和 ServiceMonitor 对象的 YAML 文件：

      monitoring.yaml 文件示例

      apiVersion: rbac.authorization.k8s.io/v1
      kind: Role
      metadata:
        name: prometheus-k8s
        namespace: cert-manager
      rules:
      - apiGroups:
        - ""
        resources:
        - services
        - endpoints
        - pods
        verbs:
        - get
        - list
        - watch
      ---
      apiVersion: rbac.authorization.k8s.io/v1
      kind: RoleBinding
      metadata:
        name: prometheus-k8s
        namespace: cert-manager
      roleRef:
        apiGroup: rbac.authorization.k8s.io
        kind: Role
        name: prometheus-k8s
      subjects:
      - kind: ServiceAccount
        name: prometheus-k8s
        namespace: openshift-monitoring
      ---
      apiVersion: monitoring.coreos.com/v1
      kind: ServiceMonitor
      metadata:
        labels:
          app: cert-manager
          app.kubernetes.io/component: controller
          app.kubernetes.io/instance: cert-manager
          app.kubernetes.io/name: cert-manager
        name: cert-manager
        namespace: cert-manager
      spec:
        endpoints:
        - interval: 30s
          port: tcp-prometheus-servicemonitor
          scheme: http
        selector:
          matchLabels:
            app.kubernetes.io/component: controller
            app.kubernetes.io/instance: cert-manager
            app.kubernetes.io/name: cert-manager

   2. 运行以下命令来创建 Role、RoleBinding 和 ServiceMonitor 对象：

      $ oc create -f monitoring.yaml

流程

1. 在 OpenShift Container Platform web 控制台中进入到 Observe Metrics。

2. 使用以下格式之一添加查询：

   • 指定端点：

     {instance="<endpoint>"} 1

     1

     将 <endpoint> 替换为 cert-manager 服务的端点值。您可以运行以下命令来找到端点值：oc describe service cert-manager -n cert-manager。

   • 指定 tcp-prometheus-servicemonitor 端口：

     {endpoint="tcp-prometheus-servicemonitor"}