Chapter 11. Configuring automatic removal of nonactive clusters from RHACS
Red Hat Advanced Cluster Security for Kubernetes (RHACS) can automatically remove nonactive clusters so that you monitor active clusters only. You can set how long a cluster stays unreachable before removal, and label the clusters that you want to keep.
11.1. Overview of automatic cluster removal
RHACS provides the option to automatically remove nonactive clusters so that you can monitor active clusters only. You can configure the decommissioned cluster age and add labels to preserve specific clusters from removal.
Automatic removal of nonactive clusters from RHACS is disabled by default. To enable this setting, enter a nonzero number in the Decommissioned cluster age field, as described in the following procedure. The Decommissioned cluster age field indicates the number of days that a cluster can remain unreachable before it becomes nonactive. When a cluster is nonactive, the Clusters page displays the status of the cluster. Nonactive clusters show the unhealthy label and the window shows the number of days after which RHACS will remove the cluster if it continues to remain nonactive. After RHACS removes a cluster, an info log entry documents the action in the Central logs.
There is a 24-hour grace period after you enable this setting before RHACS removes any clusters. RHACS never removes the cluster that hosts Central.
11.2. Configuring cluster decommissioning
You can configure RHACS to automatically remove clusters in which Central has been unable to reach Sensor for a specified number of days. You can also label specific clusters so that RHACS does not remove them.
Procedure
-
In the RHACS portal, go to Platform Configuration
System Configuration. - In the System Configuration header, click Edit.
In the Cluster deletion section, you can configure the following fields:
-
Decommissioned cluster age: The number of days that a cluster is unreachable before it becomes eligible for removal from RHACS. If Central cannot reach Sensor on the cluster for this number of days, RHACS removes the cluster and all of its resources. To leave this feature disabled, which is the default behavior, enter
0in this field. To enable this feature, enter a nonzero number, such as90, to configure the number of unreachable days. Ignore clusters which have labels: To prevent RHACS from removing a cluster, you can configure a label by entering a key and value. RHACS does not remove clusters with this label, even if they have been unreachable for the number of days set in the Decommissioned cluster age field.
- Key: Enter the label to use for the cluster.
Value: Enter the value associated with the key.
For example, to preserve production clusters from removal, you can configure a key of
cluster-typeand a value ofproduction.NoteIn the Cluster deletion section, click Clusters which have Sensor Status: Unhealthy to go to the Clusters list page. This page shows nonactive clusters that are subject to removal and a time frame for the removal from RHACS.
-
Decommissioned cluster age: The number of days that a cluster is unreachable before it becomes eligible for removal from RHACS. If Central cannot reach Sensor on the cluster for this number of days, RHACS removes the cluster and all of its resources. To leave this feature disabled, which is the default behavior, enter
Click Save.
NoteTo view and configure this option by using the API, use the
decommissionedClusterRetentionsettings in the request payload for the/v1/configand/v1/config/privateendpoints. For more information, see the API documentation for theConfigServiceobject by navigating to HelpAPI reference in the RHACS portal.
11.3. Viewing nonactive clusters
Nonactive clusters are clusters that installed and performed a handshake with Central at least one time but have been unreachable by Sensor for a specified period of time. Use this procedure to view a list of these clusters.
Procedure
-
In the RHACS portal, go to Platform Configuration
System Configuration. In the Cluster deletion section, click Clusters which have Sensor Status: Unhealthy to go to the Clusters list page. This page shows nonactive clusters that are subject to removal from RHACS and a time frame for the removal.
NoteIf you enable this feature after a cluster becomes nonactive, the counting of days towards removal starts from the time the cluster became nonactive, not from the time that you enabled the feature. If there are any nonactive clusters that you do not want RHACS to remove, you can configure a label as described in "Configuring cluster decommissioning". The system ignores clusters with those labels when removing nonactive clusters.
'%20d='M201.5%20305.5c-13.8%200-24.9-11.1-24.9-24.6%200-13.8%2011.1-24.9%2024.9-24.9%2013.6%200%2024.6%2011.1%2024.6%2024.9%200%2013.6-11.1%2024.6-24.6%2024.6zM504%20256c0%20137-111%20248-248%20248S8%20393%208%20256%20119%208%20256%208s248%20111%20248%20248zm-132.3-41.2c-9.4%200-17.7%203.9-23.8%2010-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3%2055.4%2012.5c0%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.3%2024.9-24.9s-11.1-24.9-24.9-24.9c-9.7%200-18%205.8-22.1%2013.8l-61.2-13.6c-3-.8-6.1%201.4-6.9%204.4l-19.1%2086.4c-33.2%201.4-63.1%2011.3-85.5%2026.8-6.1-6.4-14.7-10.2-24.1-10.2-34.9%200-46.3%2046.9-14.4%2062.8-1.1%205-1.7%2010.2-1.7%2015.5%200%2052.6%2059.2%2095.2%20132%2095.2%2073.1%200%20132.3-42.6%20132.3-95.2%200-5.3-.6-10.8-1.9-15.8%2031.3-16%2019.8-62.5-14.9-62.5zM302.8%20331c-18.2%2018.2-76.1%2017.9-93.6%200-2.2-2.2-6.1-2.2-8.3%200-2.5%202.5-2.5%206.4%200%208.6%2022.8%2022.8%2087.3%2022.8%20110.2%200%202.5-2.2%202.5-6.1%200-8.6-2.2-2.2-6.1-2.2-8.3%200zm7.7-75c-13.6%200-24.6%2011.1-24.6%2024.9%200%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.1%2024.9-24.6%200-13.8-11-24.9-24.9-24.9z'/%3e%3c/svg%3e){kind=small}