Skip to content

Commit 289d0cc

Browse files
aravipraaravipra
committed
OSDOCS-14993: Adding monitoring cert-manager metrics section”
:wq
1 parent c02e51a commit 289d0cc

File tree

4 files changed

+238
-1
lines changed

4 files changed

+238
-1
lines changed

‎modules/cert-manager-configure-metrics-scraping.adoc

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/cert_manager_operator/cert-manager-monitoring.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="cert-manager-configure-metrics-scraping_{context}"]
7+
= Configuring metrics scraping for cert-manager operand by using a ServiceMonitor
8+
9+
The cert-manager operand exposes metrics by default on port `9402` at the `/metrics` service endpoint. You can configure metrics collection for the cert-manager operands by creating a `ServiceMonitor` or `PodMonitor` Custom Resource (CR) that enables Prometheus Operator to collect custom metrics.
10+
11+
.Prerequisites
12+
13+
* You have access to the cluster as a user with the `cluster-admin` role.
14+
* You have installed the {cert-manager-operator}.
15+
* You have deployed the cert-manager operand in the cluster.
16+
* You have enabled the user workload monitoring.
17+
18+
.Procedure
19+
20+
. Create the `cert-manager` YAML file that defines the `ServiceMonitor` CR:
21+
+
22+
.Example `cert-manager` file
23+
[source,yaml]
24+
----
25+
apiVersion: monitoring.coreos.com/v1
26+
kind: ServiceMonitor
27+
metadata:
28+
labels:
29+
app: cert-manager
30+
app.kubernetes.io/instance: cert-manager
31+
app.kubernetes.io/name: cert-manager
32+
name: cert-manager
33+
namespace: cert-manager
34+
spec:
35+
endpoints:
36+
- honorLabels: false
37+
interval: 60s
38+
path: /metrics
39+
scrapeTimeout: 30s
40+
targetPort: 9402
41+
selector:
42+
matchExpressions:
43+
- key: app.kubernetes.io/name
44+
operator: In
45+
values:
46+
- cainjector
47+
- cert-manager
48+
- webhook
49+
- key: app.kubernetes.io/instance
50+
operator: In
51+
values:
52+
- cert-manager
53+
- key: app.kubernetes.io/component
54+
operator: In
55+
values:
56+
- cainjector
57+
- controller
58+
- webhook
59+
----
60+
61+
. Create the `ServiceMonitor` CR by running the following command:
62+
+
63+
[source,terminal]
64+
----
65+
$ oc apply -f cert-manager.yaml
66+
----
67+
+
68+
After the `ServiceMonitor` CR is created, the user workload Prometheus instance begins metrics collection from the cert-manager operands. The collected metrics are labeled with `job="cert-manager"`,`job="cert-manager-cainjector"`, and `job="cert-manager-webhook"`.
69+
70+
.Verification
71+
72+
. The following can be used to verify the Prometheus Targets in the web console:
73+
74+
.. In the {product-title} web console, navigate to *Observe* → *Targets*.
75+
76+
.. In the *Label* filter field, enter the following label to filter the metrics targets:
77+
+
78+
[source,terminal]
79+
----
80+
$ service=cert-manager
81+
----
82+
83+
.. Confirm that the *Status* column shows `Up` for the `cert-manager` entry.
84+
85+
. Verify that the cert-manager services are running in the cert-manager namespace by running the following command:
86+
+
87+
[source,terminal]
88+
----
89+
$ oc -n cert-manager get service
90+
----
91+
+
92+
.Example output
93+
[source,terminal]
94+
----
95+
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
96+
cert-manager ClusterIP 172.30.199.12 <none> 9402/TCP 54s
97+
cert-manager-cainjector ClusterIP 172.30.148.41 <none> 9402/TCP 63s
98+
cert-manager-webhook ClusterIP 172.30.100.46 <none> 443/TCP,9402/TCP 62s
99+
----

‎modules/cert-manager-enable-user-workload-monitor.adoc

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/cert_manager_operator/cert-manager-monitoring.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="cert-manager-enable-user-workload-monitor_{context}"]
7+
= Enabling user workload monitoring
8+
9+
You can enable monitoring for user-defined projects by configuring user workload monitoring in the cluster. For more information, see "Configuring user workload monitoring".
10+
11+
.Prerequisites
12+
13+
* You have access to the cluster as a user with the `cluster-admin` role.
14+
15+
.Procedure
16+
17+
. Create the `cluster-monitoring-config.yaml` YAML file:
18+
+
19+
.Example `cluster-monitoring-config.yaml` file
20+
+
21+
[source,yaml]
22+
----
23+
apiVersion: v1
24+
kind: ConfigMap
25+
metadata:
26+
name: cluster-monitoring-config
27+
namespace: openshift-monitoring
28+
data:
29+
config.yaml: |
30+
enableUserWorkload: true
31+
----
32+
33+
. Apply the `ConfigMap` by running the following command:
34+
+
35+
[source,terminal]
36+
----
37+
$ oc apply -f cluster-monitoring-config.yaml
38+
----
39+
40+
.Verification
41+
42+
. Verify that the monitoring components for user workloads are running in the `openshift-user-workload-monitoring` namespace by running the following command:
43+
+
44+
[source,terminal]
45+
----
46+
$ oc -n openshift-user-workload-monitoring get pod
47+
----
48+
+
49+
.Example output
50+
[source,terminal]
51+
----
52+
NAME READY STATUS RESTARTS AGE
53+
prometheus-operator-6cb6bd9588-dtzxq 2/2 Running 0 50s
54+
prometheus-user-workload-0 6/6 Running 0 48s
55+
prometheus-user-workload-1 6/6 Running 0 48s
56+
thanos-ruler-user-workload-0 4/4 Running 0 42s
57+
thanos-ruler-user-workload-1 4/4 Running 0 42s
58+
----
59+
60+
The status of the pods such as `prometheus-operator`, `prometheus-user-workload`, and `thanos-ruler-user-workload` must be `Running`.

‎modules/cert-manager-query-metrics-operand.adoc

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/cert_manager_operator/cert-manager-monitoring.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="cert-manager-query-metrics-operand_{context}"]
7+
= Querying metrics for the cert-manager operand
8+
9+
As a cluster administrator, or as a user with view access to all namespaces, you can query cert-manager operand metrics by using the {product-title} web console or the command line. For more information see "Accessing metrics".
10+
11+
.Prerequisites
12+
13+
* You have access to the cluster as a user with the `cluster-admin` role.
14+
* You have installed the {cert-manager-operator}.
15+
* You have deployed the cert-manager operands in the cluster.
16+
* You have enabled monitoring and metrics collection by creating `ServiceMonitor` object.
17+
18+
.Procedure
19+
20+
. Get your own token by running the following command:
21+
+
22+
[source,terminal]
23+
----
24+
$ (oc whoami -t)
25+
----
26+
27+
. Get the token for a specific service account by running the following command:
28+
+
29+
[source,terminal]
30+
----
31+
$ TOKEN=$(oc create token prometheus-k8s -n openshift-monitoring)
32+
----
33+
34+
. Get the OpenShift API route for Thanos Querier by running the following command:
35+
+
36+
[source,terminal]
37+
----
38+
$ URL=$(oc get route thanos-querier -n openshift-monitoring -o=jsonpath='{.status.ingress[0].host}')
39+
----
40+
41+
. Query the metrics by running the following command:
42+
+
43+
[source,terminal]
44+
----
45+
$ curl -s -k -H "Authorization: Bearer $TOKEN" https://$URL/api/v1/query --data-urlencode 'query={job="cert-manager"}' | jq
46+
----
47+
48+
.Verification
49+
50+
. In the {product-title} web console, navigate to *Observe* → *Metrics*.
51+
52+
. In the *Label* filter field, enter the following label to filter the metrics of each operand:
53+
+
54+
[source,terminal]
55+
----
56+
$ {job="<JobLabel>"}
57+
----
58+
59+
. Confirm that the *Status* column shows `Up` for the `cert-manager` entry.

‎security/cert_manager_operator/cert-manager-monitoring.adoc

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,4 +17,23 @@ include::modules/cert-manager-enable-metrics.adoc[leveloffset=+1]
1717
* xref:../../observability/monitoring/configuring-user-workload-monitoring/configuring-metrics-uwm.adoc#setting-up-metrics-collection-for-user-defined-projects_configuring-metrics-uwm[Setting up metrics collection for user-defined projects]
1818
1919
// Querying metrics for the {cert-manager-operator}
20-
include::modules/cert-manager-query-metrics.adoc[leveloffset=+1]
20+
include::modules/cert-manager-query-metrics.adoc[leveloffset=+1]
21+
22+
// Enabling user workload monitoring for the cert-manager operand
23+
include::modules/cert-manager-enable-user-workload-monitor.adoc[leveloffset=+1]
24+
25+
[role="_additional-resources"]
26+
.Additional resources
27+
28+
* xref:../../observability/monitoring/configuring-user-workload-monitoring/preparing-to-configure-the-monitoring-stack-uwm.adoc#configurable-monitoring-components_preparing-to-configure-the-monitoring-stack-uwm[Configuring user workload monitoring]
29+
30+
// Configuring metrics scraping for the cert-manager operand
31+
include::modules/cert-manager-configure-metrics-scraping.adoc[leveloffset=+1]
32+
33+
// Querying metrics for the cert-manager operand
34+
include::modules/cert-manager-query-metrics-operand.adoc[leveloffset=+1]
35+
36+
[role="_additional-resources"]
37+
.Additional resources
38+
39+
* xref:../../observability/monitoring/accessing-metrics/accessing-metrics-as-an-administrator.adoc#accessing-metrics[Accessing metrics]

0 commit comments

Comments
 (0)