Skip to content

Commit b322235

Browse files
subhtksubhtk
committed
Added monitoring and querying section to ZTWIM
1 parent a9d5e41 commit b322235

File tree

6 files changed

+274
-0
lines changed

6 files changed

+274
-0
lines changed

‎_topic_maps/_topic_map.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1273,6 +1273,8 @@ Topics:
12731273
File: zero-trust-manager-configuration
12741274
- Name: Zero Trust Workload Identity Manager release notes
12751275
File: zero-trust-manager-release-notes
1276+
- Name: Monitoring Zero Trust Workload Identity Manager
1277+
File: zero-trust-manager-monitoring
12761278
---
12771279
Name: Authentication and authorization
12781280
Dir: authentication

‎modules/zero-trust-manager-enable-metrics-agent.adoc‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/zer_trust_workload_identity_manager/zero-trust-manager-monitoring.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="zero-trust-manager-enable-metrics-agent_{context}"]
7+
= Configuring metrics collection for SPIRE agent by using a Service Monitor
8+
9+
The SPIRE Agent operand exposes metrics by default on port `9402` at the `/metrics` endpoint. You can configure metrics collection for the SPIRE Agent by creating a `ServiceMonitor` custom resource (CR), which enables Prometheus Operator to collect custom metrics.
10+
11+
.Prerequisites
12+
13+
* You have access to the cluster as a user with the `cluster-admin` cluster role.
14+
* You have installed the {zero-trust-full}.
15+
* You have deployed the SPIRE Agent operand in the cluster.
16+
* You have enabled the user workload monitoring.
17+
18+
.Procedure
19+
20+
. Create the `ServiceMonitor` CR:
21+
22+
.. Create the YAML file that defines `ServiceMonitor` CR:
23+
+
24+
.Example `servicemonitor-spire-agent.yaml` file
25+
[source,yaml]
26+
----
27+
apiVersion: monitoring.coreos.com/v1
28+
kind: ServiceMonitor
29+
metadata:
30+
labels:
31+
app.kubernetes.io/name: agent
32+
app.kubernetes.io/instance: spire
33+
name: spire-agent-metrics
34+
namespace: zero-trust-workload-identity-manager
35+
spec:
36+
endpoints:
37+
- port: metrics
38+
interval: 30s
39+
path: /metrics
40+
selector:
41+
matchLabels:
42+
app.kubernetes.io/name: agent
43+
app.kubernetes.io/instance: spire
44+
namespaceSelector:
45+
matchNames:
46+
- zero-trust-workload-identity-manager
47+
----
48+
49+
.. Create the `ServiceMonitor` CR by running the following command:
50+
+
51+
[source,terminal]
52+
----
53+
$ oc create -f servicemonitor-spire-agent.yaml
54+
----
55+
+
56+
After the `ServiceMonitor` CR is created, the user workload Prometheus instance begins metrics collection from the SPIRE Agent. The collected metrics are labeled with `job="spire-agent"`.
57+
58+
.Verification
59+
60+
. In the {product-title} web console, navigate to *Observe* → *Targets*.
61+
62+
63+
. In the *Label* filter field, enter the following label to filter the metrics targets:
64+
+
65+
[source,terminal]
66+
----
67+
$ service=spire-agent
68+
----
69+
70+
. Confirm that the *Status* column shows `Up` for the `spire-agent-metrics` entry.

‎modules/zero-trust-manager-enable-metrics-server.adoc‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/zer_trust_workload_identity_manager/zero-trust-manager-monitoring.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="zero-trust-manager-enable-metrics-server_{context}"]
7+
= Configuring metrics collection for SPIRE server by using a Service Monitor
8+
9+
The SPIRE Server operand exposes metrics by default on port `9402` at the `/metrics` endpoint. You can configure metrics collection for the SPIRE Server by creating a `ServiceMonitor` custom resource (CR) that enables Prometheus Operator to collect custom metrics.
10+
11+
.Prerequisites
12+
13+
* You have access to the cluster as a user with the `cluster-admin` cluster role.
14+
* You have installed the {zero-trust-full}.
15+
* You have deployed the SPIRE Server operand in the cluster.
16+
* You have enabled the user workload monitoring.
17+
18+
.Procedure
19+
20+
. Create the `ServiceMonitor` CR:
21+
22+
.. Create the YAML file that defines `ServiceMonitor` CR:
23+
+
24+
.Example `servicemonitor-spire-server` file
25+
[source,yaml]
26+
----
27+
apiVersion: monitoring.coreos.com/v1
28+
kind: ServiceMonitor
29+
metadata:
30+
labels:
31+
app.kubernetes.io/name: server
32+
app.kubernetes.io/instance: spire
33+
name: spire-server-metrics
34+
namespace: zero-trust-workload-identity-manager
35+
spec:
36+
endpoints:
37+
- port: metrics
38+
interval: 30s
39+
path: /metrics
40+
selector:
41+
matchLabels:
42+
app.kubernetes.io/name: server
43+
app.kubernetes.io/instance: spire
44+
namespaceSelector:
45+
matchNames:
46+
- zero-trust-workload-identity-manager
47+
----
48+
49+
.. Create the `ServiceMonitor` CR by running the following command:
50+
+
51+
[source,terminal]
52+
----
53+
$ oc create -f servicemonitor-spire-server.yaml
54+
----
55+
+
56+
After the `ServiceMonitor` CR is created, the user workload Prometheus instance begins metrics collection from the SPIRE Server. The collected metrics are labeled with `job="spire-server"`.
57+
58+
.Verification
59+
60+
. In the {product-title} web console, navigate to *Observe* → *Targets*.
61+
62+
63+
. In the *Label* filter field, enter the following label to filter the metrics targets:
64+
+
65+
[source,terminal]
66+
----
67+
$ service=spire-server
68+
----
69+
70+
. Confirm that the *Status* column shows `Up` for the `spire-server-metrics` entry.

‎modules/zero-trust-manager-enable-monitoring.adoc‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/zero_trust_workload_identity_manager/zero-trust-manager-monitoring.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="zero-trust-manager-enable-monitoring_{context}"]
7+
= Enabling user workload monitoring
8+
9+
You can enable monitoring for user-defined projects by configuring user workload monitoring in the cluster.
10+
11+
.Prerequisites
12+
13+
* You have access to the cluster as a user with the `cluster-admin` cluster role.
14+
15+
.Procedure
16+
17+
. Create the `cluster-monitoring-config.yaml` file to define and configure the `ConfigMap`:
18+
+
19+
[source,yaml]
20+
----
21+
apiVersion: v1
22+
kind: ConfigMap
23+
metadata:
24+
name: cluster-monitoring-config
25+
namespace: openshift-monitoring
26+
data:
27+
config.yaml: |
28+
enableUserWorkload: true
29+
----
30+
31+
. Apply the `ConfigMap` by running the following command:
32+
+
33+
[source,terminal]
34+
----
35+
$ oc apply -f cluster-monitoring-config.yaml
36+
----
37+
38+
39+
.Verification
40+
41+
* Verify that the monitoring components for user workloads are running in the `openshift-user-workload-monitoring` namespace:
42+
+
43+
[source,terminal]
44+
----
45+
$ oc -n openshift-user-workload-monitoring get pod
46+
----
47+
+
48+
.Example output
49+
[source,text]
50+
----
51+
NAME READY STATUS RESTARTS AGE
52+
prometheus-operator-6cb6bd9588-dtzxq 2/2 Running 0 50s
53+
prometheus-user-workload-0 6/6 Running 0 48s
54+
prometheus-user-workload-1 6/6 Running 0 48s
55+
thanos-ruler-user-workload-0 4/4 Running 0 42s
56+
thanos-ruler-user-workload-1 4/4 Running 0 42s
57+
----
58+
59+
The status of the pods such as `prometheus-operator`, `prometheus-user-workload`, and `thanos-ruler-user-workload` must be `Running`.

‎modules/zero-trust-manager-query-metrics.adoc‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/zero_trust_workload_identity_manager/zero-trust-manager-monitoring.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="zero-trust-manager-query-metrics_{context}"]
7+
= Querying metrics for the {zero-trust-full}
8+
9+
As a cluster administrator, or as a user with view access to all namespaces, you can query SPIRE Agent and SPIRE Server metrics by using the {product-title} web console or the command line. The query retrieves all the metrics collected from the SPIRE components that match the specified job labels.
10+
11+
.Prerequisites
12+
13+
* You have access to the cluster as a user with the `cluster-admin` role.
14+
* You have installed the {zero-trust-full}.
15+
* You have deployed the SPIRE Server and SPIRE Agent operands in the cluster.
16+
* You have enabled monitoring and metrics collection by creating `ServiceMonitor` objects.
17+
18+
.Procedure
19+
20+
. In the query field, enter the following PromQL expression to query SPIRE Server metrics:
21+
+
22+
[source,promql]
23+
----
24+
{job="spire-server"}
25+
----
26+
27+
. In the query field, enter the following PromQL expression to query SPIRE Agent metrics.
28+
+
29+
[source,promql]
30+
----
31+
{job="spire-agent"}
32+
----

‎security/zero_trust_workload_identity_manager/zero-trust-manager-monitoring.adoc‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
:_mod-docs-content-type: ASSEMBLY
2+
[id="zero-trust-manager-monitoring"]
3+
= Monitoring {zero-trust-full}
4+
include::_attributes/common-attributes.adoc[]
5+
:context: zero-trust-manager-monitoring
6+
7+
toc::[]
8+
9+
By default, the SPIRE Server and SPIRE Agent components of the {zero-trust-full} emit metrics. You can configure OpenShift Monitoring to collect these metrics by using the Prometheus Operator format.
10+
11+
// Enabling metrics for the {zero-trust-full}
12+
13+
include::modules/zero-trust-manager-enable-monitoring.adoc[leveloffset=+1]
14+
15+
[role="_additional-resources"]
16+
.Additional resources
17+
18+
* xref:../../observability/monitoring/configuring-user-workload-monitoring/preparing-to-configure-the-monitoring-stack-uwm.adoc#configurable-monitoring-components_preparing-to-configure-the-monitoring-stack-uwm[Configuring user workload monitoring]
19+
20+
include::modules/zero-trust-manager-enable-metrics-server.adoc[leveloffset=+1]
21+
22+
[role="_additional-resources"]
23+
.Additional resources
24+
25+
* xref:../../observability/monitoring/configuring-user-workload-monitoring/configuring-metrics-uwm.adoc#setting-up-metrics-collection-for-user-defined-projects_configuring-metrics-uwm[Setting up metrics collection for user-defined projects]
26+
27+
28+
include::modules/zero-trust-manager-enable-metrics-agent.adoc[leveloffset=+1]
29+
30+
[role="_additional-resources"]
31+
.Additional resources
32+
33+
* xref:../../observability/monitoring/configuring-user-workload-monitoring/preparing-to-configure-the-monitoring-stack-uwm.adoc#configurable-monitoring-components_preparing-to-configure-the-monitoring-stack-uwm[Configuring user workload monitoring]
34+
35+
// Querying metrics for the {zero-trust-full}
36+
include::modules/zero-trust-manager-query-metrics.adoc[leveloffset=+1]
37+
38+
[role="_additional-resources"]
39+
.Additional resources
40+
41+
* xref:../../observability/monitoring/accessing-metrics/accessing-metrics-as-an-administrator.adoc#accessing-metrics[Accessing metrics]

0 commit comments

Comments
 (0)