Chapter 13. Monitoring RHACS
Chapter 13. Monitoring RHACS You can monitor Red Hat Advanced Cluster Security for Kubernetes (RHACS) by using the built-in monitoring for Red Hat OpenShift or by using custom Prometheus monitoring. If you use RHACS with Red Hat OpenShift, OpenShift Container Platform includes a preconfigured, preinstalled, and self-updating monitoring stack that provides monitoring for core platform components. RHACS exposes metrics to Red Hat OpenShift monitoring via an encrypted and authenticated endpoint. 13.1. Monitoring with Red Hat OpenShift Monitoring with Red Hat OpenShift is enabled by default. No configuration is required for this default behavior. Important If you have previously configured monitoring with the Prometheus Operator, consider removing your custom ServiceMonitor resources. RHACS ships with a pre-configured ServiceMonitor for Red Hat OpenShift monitoring. Multiple ServiceMonitors might result in duplicated scraping. Monitoring with Red Hat OpenShift is not supported by Scanner. If you want to monitor Scanner, you must first disable the default Red Hat OpenShift monitoring. Then, configure custom Prometheus monitoring. For more information on disabling Red Hat OpenShift monitoring, see "Disabling Red Hat OpenShift monitoring for Central services by using the RHACS Operator" or "Disabling Red Hat OpenShift monitoring for Central services by using Helm". For more information on configuring Prometheus, see "Monitoring with custom Prometheus". 13.2. Monitoring with custom Prometheus Prometheus is an open-source monitoring and alerting platform. You can use it to monitor health and availability of Central and Sensor components of RHACS. When you enable monitoring, RHACS creates a new monitoring service on port number 9090 and a network policy allowing inbound connections to that port. Note This monitoring service exposes an endpoint that is not encrypted by TLS and has no authorization. Use this only when you do not want to use Red Hat OpenShift monitoring. Before you can use custom Prometheus monitoring, if you have Red Hat OpenShift, you must disable the default monitoring. If you are using Kubernetes, you do not need to perform this step. 13.2.1. Disabling Red Hat OpenShift monitoring for Central services by using the RHACS Operator To disable the default monitoring by using the Operator, change the configuration of the Central custom resource as shown in the following example. For more information on configuration options, see "Central configuration options using the Operator" in the "Additional resources" section. Procedure On the OpenShift Container Platform web console, go to the Operators Installed Operators page. Select the RHACS Operator from the list of installed Operators. Click on the Central tab. From the list of Central instances, click on a Central instance for which you want to enable monitoring. Click on the YAML tab and update the YAML configuration as shown in the following example: monitoring: openshift: enabled: false 13.2.2. Disabling Red Hat OpenShift monitoring for Central services by using Helm To disable the default monitoring by using Helm, change the configuration options in the central-services Helm chart. For more information on configuration options, see the documents in the "Additional resources" section. Procedure Update the configuration file with the following value: monitoring.openshift.enabled: false Run the helm upgrade command and specify the configuration files. 13.2.3. Monitoring Central services by using the RHACS Operator You can monitor Central services, Central and Scanner, by changing the configuration of the Central custom resource. For more information on configuration options, see "Central configuration options using the Operator" in the "Additional resources" section. Procedure On the OpenShift Container Platform web console, go to the Operators Installed Operators page. Select the Red Hat Advanced Cluster Security for Kubernetes Operator from the list of installed Operators. Click on the Central tab. From the list of Central instances, click on a Central instance for which you want to enable monitoring for. Click on the YAML tab and update the YAML configuration: For monitoring Central, enable the central.monitoring.exposeEndpoint configuration option for the Central custom resource. For monitoring Scanner, enable the scanner.monitoring.exposeEndpoint configuration option for the Central custom resource. Click Save . 13.3. Monitoring Central services by using Helm You can monitor Central services, Central and Scanner, by changing the configuration options in the central-services Helm chart. For more information, see "Changing configuration options after deploying the central-services Helm chart" in the "Additional resources" section. Procedure Update the values-public.yaml configuration file with the following values: central.exposeMonitoring: true scanner.exposeMonitoring: true Run the helm upgrade command and specify the configuration files. 13.3.1. Monitoring Central by using Prometheus service monitor If you are using the Prometheus Operator, you can use a service monitor to scrape the metrics from Red Hat Advanced Cluster Security for Kubernetes (RHACS). Note If you are not using the Prometheus operator, you must edit the Prometheus configuration files to receive the data from RHACS. Procedure Create a new servicemonitor.yaml file with the following content: apiVersion: monitoring.coreos.com/v1 kind: ServiceMonitor metadata: name: prometheus-stackrox namespace: stackrox spec: endpoints: - interval: 30s port: monitoring scheme: http selector: matchLabels: app.kubernetes.io/name: <stackrox-service> 1 1 The labels must match with the Service resource that you want to monitor. For example, central or scanner . Apply the YAML to the cluster: USD oc apply -f servicemonitor.yaml 1 1 If you use Kubernetes, enter kubectl instead of oc . Verification Run the following command to check the status of service monitor: USD oc get servicemonitor --namespace stackrox 1 1 If you use Kubernetes, enter kubectl instead of oc . 13.4. Additional resources Central configuration options using the Operator Changing configuration options after deploying the central-services Helm chart Helm documentation
monitoring: openshift: enabled: false monitoring.openshift.enabled: false central.exposeMonitoring: true scanner.exposeMonitoring: true apiVersion: monitoring.coreos.com/v1 kind: ServiceMonitor metadata: name: prometheus-stackrox namespace: stackrox spec: endpoints: - interval: 30s port: monitoring scheme: http selector: matchLabels: app.kubernetes.io/name: <stackrox-service> 1 oc apply -f servicemonitor.yaml 1 oc get servicemonitor --namespace stackrox 1