Chapter 4. Cluster Observability Operator
The Cluster Observability Operator (COO) is an optional component of OpenShift Logging that provides UI visualization capabilities in the OpenShift web console. The COO enables you to query and view logs directly in your browser without external tools, and correlate logs with metrics and distributed traces.
4.1. What the Cluster Observability Operator provides
The Cluster Observability Operator adds observability visualization features to the OpenShift web console. When you install the COO alongside Vector and Loki, you can interact with your logs through built-in UI plugins rather than relying on external dashboards.
Core capabilities:
- Logs tab in the web console
- A dedicated "Logs" tab appears in the OpenShift web console where you can query logs using LogQL, filter by namespace or pod, and view log lines with syntax highlighting.
- LogQL query interface
- Query your Loki-stored logs directly in the browser using the LogQL query language. The interface provides query suggestions and helps you build label selectors.
- Observability UI plugins
The COO provides several UI plugins that enhance the OpenShift console:
- Logging UI plugin: Query and view logs
- Dashboards UI plugin: Visualize metrics
- Monitoring UI plugin: View alerts and Prometheus metrics
- Distributed tracing UI plugin: View trace data
- Troubleshooting UI plugin: Correlate signals to identify issues
- Signal correlation
- The COO includes Korrel8r, an open source project that correlates logs, metrics, and traces. Korrel8r helps you navigate from an alert to related logs, or from a log entry to related traces, making troubleshooting faster.
4.2. Multi-tenant monitoring capabilities
Beyond log visualization, the COO provides standalone, customizable monitoring stacks that complement the default OpenShift monitoring:
- Namespace-scoped monitoring
- Create independent monitoring stacks for specific namespaces or teams. Each stack has its own Prometheus instance, Alertmanager, and visualization.
- Standalone Prometheus instances
- Deploy multiple Prometheus instances that collect metrics independently. This is useful in multi-tenant environments where teams need separate monitoring configurations.
- Thanos Querier (optional)
- Query multiple Prometheus instances from a central location for a unified view across monitoring stacks.
- Alertmanager (optional)
- Configure alert routing and notification channels specific to each monitoring stack.
These multi-tenant capabilities enable platform teams to provide observability-as-a-service to application teams, where each team can customize their monitoring and alerting without affecting other teams.
4.3. Incident detection and correlation
The COO includes features for grouping related alerts and identifying root causes:
- Incident detection
- Automatically groups related alerts into incidents. Instead of seeing 20 individual alerts when a service fails, you see one incident with all related alerts grouped together.
- Korrel8r signal correlation
Navigates between different types of observability data:
- From an alert to the pod logs that triggered it
- From a log error message to related distributed traces
- From a metric spike to the audit logs showing who made configuration changes
This correlation reduces the time spent jumping between different tools and dashboards during troubleshooting.
4.4. COO in OpenShift Logging deployments
The Cluster Observability Operator is optional. You can deploy OpenShift Logging with Vector and Loki without installing the COO. In that case, you query Loki by using external tools such as Grafana or the Loki CLI.
Installing the COO is valuable when:
- You want to query logs without leaving the OpenShift web console
- You need to correlate logs with metrics and traces in one interface
- You are managing a multi-tenant cluster and want to provide namespace-scoped observability
- You prefer browser-based visualization over external dashboards
The COO is managed separately from the Vector and Loki operators. It has its own release cycle and can be installed or removed independently.
4.5. COO architecture
The Cluster Observability Operator manages several components:
- UI Plugin deployments
- Pods that serve the web console UI plugins for logging, dashboards, monitoring, and tracing visualization.
- Monitoring stacks
-
When you create a
MonitoringStackcustom resource, the COO deploys a Prometheus instance, optional Thanos Querier, and optional Alertmanager for that stack. - Korrel8r instance
- The signal correlation engine that understands the relationships between alerts, logs, metrics, and traces.
- Console plugin registration
- The COO automatically registers its UI plugins with the OpenShift web console so they appear in the interface without manual configuration.
'%20d='M201.5%20305.5c-13.8%200-24.9-11.1-24.9-24.6%200-13.8%2011.1-24.9%2024.9-24.9%2013.6%200%2024.6%2011.1%2024.6%2024.9%200%2013.6-11.1%2024.6-24.6%2024.6zM504%20256c0%20137-111%20248-248%20248S8%20393%208%20256%20119%208%20256%208s248%20111%20248%20248zm-132.3-41.2c-9.4%200-17.7%203.9-23.8%2010-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3%2055.4%2012.5c0%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.3%2024.9-24.9s-11.1-24.9-24.9-24.9c-9.7%200-18%205.8-22.1%2013.8l-61.2-13.6c-3-.8-6.1%201.4-6.9%204.4l-19.1%2086.4c-33.2%201.4-63.1%2011.3-85.5%2026.8-6.1-6.4-14.7-10.2-24.1-10.2-34.9%200-46.3%2046.9-14.4%2062.8-1.1%205-1.7%2010.2-1.7%2015.5%200%2052.6%2059.2%2095.2%20132%2095.2%2073.1%200%20132.3-42.6%20132.3-95.2%200-5.3-.6-10.8-1.9-15.8%2031.3-16%2019.8-62.5-14.9-62.5zM302.8%20331c-18.2%2018.2-76.1%2017.9-93.6%200-2.2-2.2-6.1-2.2-8.3%200-2.5%202.5-2.5%206.4%200%208.6%2022.8%2022.8%2087.3%2022.8%20110.2%200%202.5-2.2%202.5-6.1%200-8.6-2.2-2.2-6.1-2.2-8.3%200zm7.7-75c-13.6%200-24.6%2011.1-24.6%2024.9%200%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.1%2024.9-24.6%200-13.8-11-24.9-24.9-24.9z'/%3e%3c/svg%3e){kind=small}