OpenShift docs are moving and will soon only be available at docs.redhat.com, the home of all Red Hat product documentation. Explore the new docs experience today.
  1. Documentation
    2. history
×

Monitoring RHACS

You can monitor Red Hat Advanced Cluster Security for Kubernetes (RHACS) by using the built-in monitoring for Red Hat OpenShift or by using custom Prometheus monitoring.

If you use RHACS with Red Hat OpenShift, OpenShift Container Platform includes a preconfigured, preinstalled, and self-updating monitoring stack that provides monitoring for core platform components. RHACS exposes metrics to Red Hat OpenShift monitoring via an encrypted and authenticated endpoint.

Monitoring with Red Hat OpenShift

Monitoring with Red Hat OpenShift is enabled by default. No configuration is required for this default behavior.

If you have previously configured monitoring with the Prometheus Operator, consider removing your custom ServiceMonitor resources. RHACS ships with a pre-configured ServiceMonitor for Red Hat OpenShift monitoring. Multiple ServiceMonitors might result in duplicated scraping.

Monitoring with Red Hat OpenShift is not supported by Scanner. If you want to monitor Scanner, you must first disable the default Red Hat OpenShift monitoring. Then, configure custom Prometheus monitoring.

For more information on disabling Red Hat OpenShift monitoring, see "Disabling Red Hat OpenShift monitoring for Central services by using the RHACS Operator" or "Disabling Red Hat OpenShift monitoring for Central services by using Helm". For more information on configuring Prometheus, see "Monitoring with custom Prometheus".

Monitoring with custom Prometheus

Prometheus is an open-source monitoring and alerting platform. You can use it to monitor health and availability of Central and Sensor components of RHACS. When you enable monitoring, RHACS creates a new monitoring service on port number 9090 and a network policy allowing inbound connections to that port.

This monitoring service exposes an endpoint that is not encrypted by TLS and has no authorization. Use this only when you do not want to use Red Hat OpenShift monitoring.

Before you can use custom Prometheus monitoring, if you have Red Hat OpenShift, you must disable the default monitoring. If you are using Kubernetes, you do not need to perform this step.

Disabling Red Hat OpenShift monitoring for Central services by using the RHACS Operator

To disable the default monitoring by using the Operator, change the configuration of the Central custom resource as shown in the following example. For more information on configuration options, see "Central configuration options using the Operator" in the "Additional resources" section.

Procedure

  1. On the OpenShift Container Platform web console, go to the Operators → Installed Operators page.

  2. Select the RHACS Operator from the list of installed Operators.

  3. Click on the Central tab.

  4. From the list of Central instances, click on a Central instance for which you want to enable monitoring.

  5. Click on the YAML tab and update the YAML configuration as shown in the following example:

    monitoring:
    openshift:
        enabled: false

Disabling Red Hat OpenShift monitoring for Central services by using Helm

To disable the default monitoring by using Helm, change the configuration options in the central-services Helm chart. For more information on configuration options, see the documents in the "Additional resources" section.

Procedure

  1. Update the configuration file with the following value:

    monitoring.openshift.enabled: false

  2. Run the helm upgrade command and specify the configuration files.

Monitoring Central services by using the RHACS Operator

You can monitor Central services, Central and Scanner, by changing the configuration of the Central custom resource. For more information on configuration options, see "Central configuration options using the Operator" in the "Additional resources" section.

Procedure

  1. On the OpenShift Container Platform web console, go to the Operators → Installed Operators page.

  2. Select the Red Hat Advanced Cluster Security for Kubernetes Operator from the list of installed Operators.

  3. Click on the Central tab.

  4. From the list of Central instances, click on a Central instance for which you want to enable monitoring for.

  5. Click on the YAML tab and update the YAML configuration:

    • For monitoring Central, enable the central.monitoring.exposeEndpoint configuration option for the Central custom resource.

    • For monitoring Scanner, enable the scanner.monitoring.exposeEndpoint configuration option for the Central custom resource.

  6. Click Save.

Monitoring Central services by using Helm

You can monitor Central services, Central and Scanner, by changing the configuration options in the central-services Helm chart. For more information, see "Changing configuration options after deploying the central-services Helm chart" in the "Additional resources" section.

Procedure

  1. Update the values-public.yaml configuration file with the following values:

    central.exposeMonitoring: true
scanner.exposeMonitoring: true

  2. Run the helm upgrade command and specify the configuration files.

Monitoring Central by using Prometheus service monitor

If you are using the Prometheus Operator, you can use a service monitor to scrape the metrics from Red Hat Advanced Cluster Security for Kubernetes (RHACS).

If you are not using the Prometheus operator, you must edit the Prometheus configuration files to receive the data from RHACS.
Procedure

  1. Create a new servicemonitor.yaml file with the following content:

    apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: prometheus-stackrox
  namespace: stackrox
spec:
  endpoints:
    - interval: 30s
      port: monitoring
      scheme: http
  selector:
    matchLabels:
      app.kubernetes.io/name: <stackrox-service> (1)
    1 The labels must match with the Service resource that you want to monitor. For example, central or scanner.

  2. Apply the YAML to the cluster:

    $ oc apply -f servicemonitor.yaml (1)
    1 If you use Kubernetes, enter kubectl instead of oc.
Verification

  • Run the following command to check the status of service monitor:

    $ oc get servicemonitor --namespace stackrox (1)
    1 If you use Kubernetes, enter kubectl instead of oc.

Additional resources