Monitor Kubernetes cluster topology - Container Service for Kubernetes

Alibaba Cloud Application Monitoring eBPF Edition is an all-in-one observability solution designed for Kubernetes clusters. After you install the Application Monitoring eBPF Edition component, you can view the metrics, traces, logs, and events of your Kubernetes cluster.

Warning

The Application Monitoring eBPF Edition observability feature is no longer maintained. In Container Service for Kubernetes (ACK), this feature is known as Cluster topology monitoring and is supported by the ack-arms-cmonitor component. For more information, see [Product Change] Notice of Discontinuation for Application Monitoring eBPF Edition.

Prerequisites

Create a Container Service for Kubernetes (ACK) cluster. For more information, see Create an ACK managed cluster.
Activate Application Real-Time Monitoring Service (ARMS). For more information, see Activate ARMS.
Ensure that your environment supports Application Monitoring eBPF Edition. For more information, see Requirements and limitations for Application Monitoring eBPF Edition.

Background information

In Kubernetes, monitoring workload status and traffic throughput is critical. Application Monitoring eBPF Edition uses a non-intrusive method to collect Rate, Errors, and Duration (RED) performance data from containers to help you quickly identify pod and performance issues. It automatically correlates data with the corresponding Service and controller workloads, such as Deployments, StatefulSets, and DaemonSets, to reduce detection time. For more information, see What is Application Monitoring eBPF Edition?

Onboarding

To connect your Kubernetes cluster to Application Monitoring eBPF Edition, install the following monitoring components:

Managed Service for Prometheus component: ack-arms-prometheus
Note
Metrics in Application Monitoring eBPF Edition depend on Managed Service for Prometheus, so you must install the Managed Service for Prometheus component first.
Application Monitoring eBPF Edition component: ack-arms-cmonitor
Before you install the ack-arms-cmonitor component, you must check whether an ARMS Addon Token exists in the cluster. Otherwise, you will encounter an insufficient permissions error. If the token exists, ARMS performs password-free authorization. After the component is installed, you can use Application Monitoring eBPF Edition. If the token does not exist, you must manually attach the policies for ARMS and Tracing Analysis.
The following sections describe how to check for an ARMS Addon Token and manually attach the required permission policies.
Check for ARMS Addon Token
1. Log on to the ACK console. In the left navigation pane, click Clusters.
2. On the Clusters page, click the name of the target cluster. In the left-side navigation pane, choose Configurations > Secrets.
3. At the top of the Secrets page, select kube-system from the Namespace drop-down list and check whether addon.arms.token exists.
Grant permissions manually
1. Log on to the ACK console. In the left navigation pane, click Clusters.
2. On the Clusters page, click the name of your cluster. In the left navigation pane, click Cluster Information.
3. On the Cluster Information page, click the Basic Information tab. In the Cluster Resources section, click the link to the right of Worker RAM Role.
4. In the RAM console, grant the AliyunTracingAnalysisFullAccess and AliyunARMSFullAccess permissions to the role.
  1. On the Role page, on the Permissions tab, click Attach Policy.
  2. In the Attach Policy panel, find and select the following two policies in the Policies section, and then click OK.
    AliyunTracingAnalysisFullAccess: Grants full permissions for Tracing Analysis.
    AliyunARMSFullAccess: Grants full permissions for ARMS.
Note
- ACK managed cluster: Some ACK managed clusters may not have an ARMS Addon Token. Check for the token first. If it does not exist, you must grant the permissions manually.
- ACK dedicated cluster: These clusters do not have an ARMS Addon Token by default. You must grant the permissions manually.

Integrate with Application Monitoring eBPF Edition

Manual integration

For existing applications

If you have already installed the Application Monitoring eBPF Edition component, go to the Operations > Component Management page for your cluster in the ACK console and ensure that the ack-arms-cmonitor component is version 4.0.0 or later. If it is an earlier version, click Upgrade.

Log on to the ACK console. On the Clusters page, click the name of the target cluster.
In the left-side navigation pane, choose Operations > Cluster Topology.
On the Cluster Topology page, click Install. The ACK console automatically installs the Application Monitoring eBPF Edition component.

Note
The default namespace is arms-prom.
For a dedicated cluster, you must update the AccessKey pair configuration.
1. In the left-side navigation pane, choose Application > Helm.
2. Find arms-cmonitor and click Update. Set the accessKey and accessKeySecret parameters to the AccessKey ID and AccessKey Secret of your Alibaba Cloud account. For more information, see Obtain an AccessKey pair.
  
  Important
  Make sure that the AliyunARMSFullAccess and AliyunSTSAssumeRoleAccess policies are attached to the Alibaba Cloud account.
3. Click OK.

For new applications

Log on to the ACK console. On the Clusters page, find the target cluster and click Applications in the Actions column.
On the Stateless page, click Create from YAML.

Select Sample Template. In the Template (YAML format) editor, add the following labels under the spec.template.metadata section.

labels:
  armseBPFAutoEnable: "on"
  armseBPFCreateAppName: "<your-deployment-name>"    # Replace <your-deployment-name> with your application name.

The following YAML sample creates a Deployment and enables ARMS Application Monitoring eBPF Edition:

Sample YAML

apiVersion: v1
kind: Namespace
metadata:
  name: arms-demo
---
apiVersion: apps/v1 # for versions before 1.8.0 use apps/v1beta1
kind: Deployment
metadata:
  name: arms-springboot-demo
  namespace: arms-demo
  labels:
    app: arms-springboot-demo
spec:
  replicas: 2
  selector:
    matchLabels:
      app: arms-springboot-demo
  template:
    metadata:
      labels:
        app: arms-springboot-demo
        armseBPFAutoEnable: "on"
        armseBPFCreateAppName: "arms-k8s-demo"
    spec:
      containers:
        - resources:
            limits:
              cpu: 0.5
          image: registry.cn-hangzhou.aliyuncs.com/arms-docker-repo/arms-springboot-demo:v0.1
          imagePullPolicy: Always
          name: arms-springboot-demo
          env:
            - name: SELF_INVOKE_SWITCH
              value: "true"
            - name: COMPONENT_HOST
              value: "arms-demo-component"
            - name: COMPONENT_PORT
              value: "6666"
            - name: MYSQL_SERVICE_HOST
              value: "arms-demo-mysql"
            - name: MYSQL_SERVICE_PORT
              value: "3306"
---
apiVersion: apps/v1 # for versions before 1.8.0 use apps/v1beta1
kind: Deployment
metadata:
  name: arms-springboot-demo-subcomponent
  namespace: arms-demo
  labels:
    app: arms-springboot-demo-subcomponent
spec:
  replicas: 2
  selector:
    matchLabels:
      app: arms-springboot-demo-subcomponent
  template:
    metadata:
      labels:
        app: arms-springboot-demo-subcomponent
        armseBPFAutoEnable: "on"
        armseBPFCreateAppName: "arms-k8s-demo-subcomponent"
    spec:
      containers:
        - resources:
            limits:
              cpu: 0.5
          image: registry.cn-hangzhou.aliyuncs.com/arms-docker-repo/arms-springboot-demo:v0.1
          imagePullPolicy: Always
          name: arms-springboot-demo-subcomponent
          env:
            - name: SELF_INVOKE_SWITCH
              value: "false"
            - name: MYSQL_SERVICE_HOST
              value: "arms-demo-mysql"
            - name: MYSQL_SERVICE_PORT
              value: "3306"
---
apiVersion: v1
kind: Service
metadata:
  labels:
    name: arms-demo-component
  name: arms-demo-component
  namespace: arms-demo
spec:
  ports:
    # the port that this service should serve on
    - name: arms-demo-component-svc
      port: 6666
      targetPort: 8888
  # label keys and values that must match in order to receive traffic for this service
  selector:
    app: arms-springboot-demo-subcomponent
---
apiVersion: apps/v1 # for versions before 1.8.0 use apps/v1beta1
kind: Deployment
metadata:
  name: arms-demo-mysql
  namespace: arms-demo
  labels:
    app: mysql
spec:
  replicas: 1
  selector:
    matchLabels:
      app: mysql
  template:
    metadata:
      labels:
        app: mysql
    spec:
      containers:
        - resources:
            limits:
              cpu: 0.5
          image: registry.cn-hangzhou.aliyuncs.com/arms-docker-repo/arms-demo-mysql:v0.1
          name: mysql
          ports:
            - containerPort: 3306
              name: mysql
---
apiVersion: v1
kind: Service
metadata:
  labels:
    name: mysql
  name: arms-demo-mysql
  namespace: arms-demo
spec:
  ports:
    # the port that this service should serve on
    - name: arms-mysql-svc
      port: 3306
      targetPort: 3306
  # label keys and values that must match in order to receive traffic for this service
  selector:
    app: mysql

Automatic integration

Log on to the ARMS console.
In the left-side navigation pane, click Integration Center. In the Server-side Applications section, click the Application Monitoring eBPF Edition card.
Follow the on-screen instructions to complete the integration with Application Monitoring eBPF Edition.
You can view all applications and components integrated with ARMS on the Integration Management page.
On the Integration Management page, click a cluster name to view its basic information, integrated components, and collected metrics, explore metrics, or configure agent settings.