All Products
Search
Document Center

Container Service for Kubernetes:Java application monitoring

Last Updated:Sep 16, 2026

Application Real-Time Monitoring Service (ARMS) monitors Java applications that run in Container Service for Kubernetes (ACK) clusters through the ack-onepilot add-on. Install and authorize the add-on to diagnose issues in production significantly faster.

Background information

Application Real-Time Monitoring Service (ARMS) is an Alibaba Cloud application performance management (APM) product. In Container Service for Kubernetes (ACK), install and authorize the ack-onepilot add-on to monitor Java applications from end to end without modifying any code.

The add-on automatically discovers the application topology and application interfaces, and generates 3D topology maps. It monitors the interfaces and captures abnormal and slow transactions. Use this monitoring data to quickly locate faulty and slow interfaces, reproduce call parameters, detect memory leaks, and identify system bottlenecks. For more information about ARMS application monitoring, see What is application monitoring? What is application monitoring?

Prerequisites

  • A namespace is created. For more information, see Manage namespaces and resource quotas. This topic uses the arms-demo namespace as an example.

  • The version of the JDK is supported by Application Monitoring. ARMS supports the following JDK versions:

    • JDK 1.7.0+

      Important

      The ARMS agent V3.0.X and later will no longer support Java 7. If you are still using Java 7, we recommend that you upgrade your Java version. For more information, see Application Monitoring no longer supports Java 7.

    • JDK 1.8.0_25+

      Note
      • If you deploy applications in Kubernetes clusters, we recommend that you use JDK V1.8.0_191 or later.

      • Make sure that the JDK version is not 1.8.0_25 or 1.8.0_31. Otherwise, the ARMS agent may fail to be installed. In this case, we recommend that you upgrade JDK to the latest 1.8.X.

    • JDK 11.0.8+

    • JDK 17

  • ARMS is activated.

Step 1: Install the ARMS application monitoring add-on

Important

The legacy arms-pilot component is no longer maintained. ack-onepilot is its replacement and is fully compatible -- migration requires no changes to your application configuration. For migration steps, see Uninstall arms-pilot and install ack-onepilot.

Note

By default, the ack-onepilot add-on supports up to 1,000 pods. For every additional 1,000 pods in the cluster, increase the CPU resources for the add-on by 0.5 cores and the memory by 512 MB.

  1. Log on to the ACK console. In the left navigation pane, click Clusters.

  2. On the Clusters page, click the name of your cluster. In the left navigation pane, click Components and Add-ons .

  3. In the Logs and Monitoring section, find the ack-onepilot add-on and click Install on the add-on card.

  4. In the dialog box, configure the add-on parameters. (Recommended) Keep the default values. Click OK to complete the installation.

After the installation is complete, you can upgrade, configure, or uninstall the ack-onepilot add-on on the Add-ons page.

Step 2: Grant permissions to access ARMS resources

Whether you must grant permissions manually depends on whether the addon.arms.token Secret exists in the cluster. If the Secret exists, no authorization is required and you can skip to Step 3. If the Secret does not exist, grant the cluster permissions to access ARMS resources manually so that ARMS can monitor the applications in the cluster.

Note

When a cluster contains the addon.arms.token Secret, ARMS grants the cluster permissions to access ARMS resources automatically, without credentials. Most ACK managed cluster include the Secret by default, but ACK managed cluster created earlier might not.

Check whether the addon.arms.token Secret exists

  1. Log on to the ACK console. In the left navigation pane, click Clusters.

  2. On the Clusters page, click the name of your cluster. In the left navigation pane, click Configurations > Secrets.

  3. On the Secrets page, select kube-system from the Namespace drop-down list, and then check whether the addon.arms.token Secret is listed.

Grant permissions to access ARMS resources manually

Perform the following steps only if the addon.arms.token Secret does not exist in the cluster.

  1. Log on to the ACK console. In the left navigation pane, click Clusters.

  2. On the Clusters page, click the name of your cluster. In the left navigation pane, click Cluster Information.

  3. On the Basic Information tab, find the Cluster Resources section and click the link to the right of Worker RAM Role.

  4. On the Role page, click the Permissions tab, and then click Add Permissions.

  5. Set the permission to AliyunARMSFullAccess and then click OK.

Grant permissions for clusters integrated with Elastic Container Instance (ECI)

To monitor applications in ACK managed cluster that is integrated with ECI, grant the permissions on the RAM Quick Authorization page, and then restart all pods of the ack-onepilot add-on.

Step 3: Enable ARMS application monitoring for a Java application

Enable ARMS application monitoring when you create a Java application. The following steps create a Deployment from a YAML template in the ACK console.

  1. Log on to the ACK console. In the left navigation pane, click Clusters.

  2. On the Clusters page, click the name of your cluster. In the left navigation pane, click Workloads > Deployments.

  3. On the Deployments page, click Create from YAML.

  4. Select Sample Template, and then add the following labels to the spec.template.metadata section in the Template field (YAML format):

    labels:
      armsPilotAutoEnable: "on"
      armsPilotCreateAppName: "<your-deployment-name>"    # Replace <your-deployment-name> with the actual application name.
      # armsSecAutoEnable: "on"    # If you want to connect the application to Application Security, you must configure this parameter.

The armsPilotAutoEnable: "on" and armsPilotCreateAppName: "arms-k8s-demo" labels in the pod template of the Deployment enable ARMS application monitoring. The following YAML snippet shows where the labels are added in the pod template:

apiVersion: v1
kind: Namespace
metadata:
  name: arms-demo
---
apiVersion: apps/v1 # for versions before 1.8.0 use apps/v1beta1
kind: Deployment
metadata:
  name: arms-springboot-demo
  namespace: arms-demo
  labels:
    app: arms-springboot-demo
spec:
  replicas: 2
  selector:
    matchLabels:
      app: arms-springboot-demo
  template:
    metadata:
      labels:
        app: arms-springboot-demo
        armsPilotAutoEnable: "on"
        armsPilotCreateAppName: "arms-k8s-demo"
    spec:
      containers:
        - resources:
            limits:
              # ...

The following complete sample YAML file creates a Deployment and enables ARMS application monitoring:

apiVersion: v1
kind: Namespace
metadata:
  name: arms-demo
---
apiVersion: apps/v1 # for versions before 1.8.0 use apps/v1beta1
kind: Deployment
metadata:
  name: arms-springboot-demo
  namespace: arms-demo
  labels:
    app: arms-springboot-demo
spec:
  replicas: 2
  selector:
    matchLabels:
      app: arms-springboot-demo
  template:
    metadata:
      labels:
        app: arms-springboot-demo
        armsPilotAutoEnable: "on"
        armsPilotCreateAppName: "arms-k8s-demo"
        one-agent.jdk.version: "OpenJDK11"
    spec:
      containers:
        - resources:
            limits:
              cpu: 0.5
          image: registry.cn-hangzhou.aliyuncs.com/arms-docker-repo/arms-springboot-demo:v0.1
          imagePullPolicy: Always
          name: arms-springboot-demo
          env:
            - name: SELF_INVOKE_SWITCH
              value: "true"
            - name: COMPONENT_HOST
              value: "arms-demo-component"
            - name: COMPONENT_PORT
              value: "6666"
            - name: MYSQL_SERVICE_HOST
              value: "arms-demo-mysql"
            - name: MYSQL_SERVICE_PORT
              value: "3306"
---
apiVersion: apps/v1 # for versions before 1.8.0 use apps/v1beta1
kind: Deployment
metadata:
  name: arms-springboot-demo-subcomponent
  namespace: arms-demo
  labels:
    app: arms-springboot-demo-subcomponent
spec:
  replicas: 2
  selector:
    matchLabels:
      app: arms-springboot-demo-subcomponent
  template:
    metadata:
      labels:
        app: arms-springboot-demo-subcomponent
        armsPilotAutoEnable: "on"
        armsPilotCreateAppName: "arms-k8s-demo-subcomponent"
        one-agent.jdk.version: "OpenJDK11"
    spec:
      containers:
        - resources:
            limits:
              cpu: 0.5
          image: registry.cn-hangzhou.aliyuncs.com/arms-docker-repo/arms-springboot-demo:v0.1
          imagePullPolicy: Always
          name: arms-springboot-demo-subcomponent
          env:
            - name: SELF_INVOKE_SWITCH
              value: "false"
            - name: MYSQL_SERVICE_HOST
              value: "arms-demo-mysql"
            - name: MYSQL_SERVICE_PORT
              value: "3306"
---
apiVersion: v1
kind: Service
metadata:
  labels:
    name: arms-demo-component
  name: arms-demo-component
  namespace: arms-demo
spec:
  ports:
    # the port that this service should serve on
    - name: arms-demo-component-svc
      port: 6666
      targetPort: 8888
  # label keys and values that must match in order to receive traffic for this service
  selector:
    app: arms-springboot-demo-subcomponent
---
apiVersion: apps/v1 # for versions before 1.8.0 use apps/v1beta1
kind: Deployment
metadata:
  name: arms-demo-mysql
  namespace: arms-demo
  labels:
    app: mysql
spec:
  replicas: 1
  selector:
    matchLabels:
      app: mysql
  template:
    metadata:
      labels:
        app: mysql
    spec:
      containers:
        - resources:
            limits:
              cpu: 0.5
          image: registry.cn-hangzhou.aliyuncs.com/arms-docker-repo/arms-demo-mysql:v0.1
          name: mysql
          ports:
            - containerPort: 3306
              name: mysql
---
apiVersion: v1
kind: Service
metadata:
  labels:
    name: mysql
  name: arms-demo-mysql
  namespace: arms-demo
spec:
  ports:
    # the port that this service should serve on
    - name: arms-mysql-svc
      port: 3306
      targetPort: 3306
  # label keys and values that must match in order to receive traffic for this service
  selector:
    app: mysql
---
Note

After you complete the preceding steps, ARMS application monitoring is enabled for the application deployed in the ACK cluster.

Next steps

To view application monitoring details, go to the Deployments page and find the application. In the Actions column, click the image icon and choose ARMS Console. For more information, see application overview .

FAQ

The following topics answer frequently asked questions about application monitoring: