You only need to install the ARMS application monitoring component ack-onepilot to monitor Java applications deployed in Container Service for Kubernetes ACK or Container Compute Service ACS, and view monitoring data such as application topology, interface calls, exception transactions, and slow transactions. This topic describes how to install the agent for Java applications in Container Service for Kubernetes ACK and Container Compute Service ACS.
The operations for installing agents in Container Service for Kubernetes ACK and Container Compute Service ACS are the same. This topic uses Container Service for Kubernetes ACK as an example to demonstrate the operations for installing agents.
Ack-onepilot component description
ARMS agent access assistant (ack-onepilot) is an important component for connecting various language agents, which helps ARMS users automatically prepare ARMS agent packages and build the agent reporting environment in container environments. For the basic principles of ARMS agent access assistant (ack-onepilot), see Basic principles of ack-onepilot component.
After installing the ARMS agent, to ensure your optimal user experience, the agent will automatically upgrade to the latest version when your application restarts, following the release of a new agent version. If you do not want to automatically update the agent with each new release, you can manually control the version. For more information, see Control agent version manually.
The old application monitoring component arms-pilot is no longer maintained. You can install the upgraded ack-onepilot component to monitor your applications. ack-onepilot is fully compatible with arms-pilot, so you do not need to modify your application configuration to seamlessly connect to ack-onepilot. For more information, see How to uninstall arms-pilot and install ack-onepilot.
Prerequisites
Create an ACK cluster or ACS cluster.
ACK cluster: Create an ACK managed cluster, Create a registered cluster, Create an ACK dedicated cluster (no longer available for new creation), Create an ACK Serverless cluster.
ACS cluster: Create an ACS cluster.
Create a namespace. For more information, see Manage namespaces and quotas. The namespace name in this example is arms-demo.
Check the version of the JDK. For more information, see Supported JDK versions.
The maximum heap memory of the process must be greater than 256 MB.
Step 1: Install ARMS agent access assistant (ack-onepilot)
Log on to the ACK console. On the Clusters page, click the name of the cluster.
In the left-side navigation pane, choose . On the Add-ons page, search for ack-onepilot.
Click Install on the ack-onepilot card.
NoteBy default, the ack-onepilot component supports 1,000 pods. For every additional 1,000 pods in the cluster, you must add 0.5 CPU cores and 512 MB memory for the component.
In the dialog box that appears, configure the parameters and click OK. We recommend that you use the default values.
NoteAfter you install ack-onepilot, you can upgrade, configure, or uninstall it on the Add-ons page.
Step 2: Grant access permissions on ARMS resources
ACK managed cluster
If ARMS Addon Token does not exist in the ACK managed cluster, perform the following operations to manually grant access permissions on ARMS resources for the cluster. If ARMS Addon Token already exists, skip to Step 3.
If a cluster has ARMS Addon Token, ARMS performs password-free authorization on the cluster. ARMS Addon Token may not exist in some ACK managed clusters. We recommend that you check whether an ACK managed cluster has ARMS Addon Token before you use ARMS to monitor applications in the cluster. If the cluster has no ARMS Addon Token, you must authorize the cluster to access ARMS.
ACK dedicated cluster/registered cluster
If you need to monitor applications in ACK dedicated clusters and ACK One registered clusters, make sure that the corresponding Alibaba Cloud account has the AliyunARMSFullAccess and AliyunSTSAssumeRoleAccess permissions. For information about how to add permissions, see Grant permissions to a RAM user.
After you install the ack-onepilot agent, you must enter the AccessKey ID and AccessKey secret of the Alibaba Cloud account in the configuration file of the ack-onepilot agent.
Method 1: Directly enter the AccessKey ID and AccessKey secret in Helm
Log on to the ACK console. In the left-side navigation pane, click Clusters.
On the Clusters page, click the name of the target cluster. In the left-side navigation pane, choose
. On the page that appears, click Update to the right of the ack-onepilot component.Replace
accessKey
andaccessKeySecret
with the AccessKey of the current account, and then click OK.NoteFor information about how to obtain an AccessKey, see Create an AccessKey.
The AccessKey secret of an Alibaba Cloud account is displayed only when you create the AccessKey pair for the Alibaba Cloud account. You cannot query the AccessKey secret in subsequent operations. This helps reduce the risks of AccessKey pair leaks. Record the AccessKey secret and keep it confidential.
Restart the Deployment application.
Method 2: Import the AccessKey ID and AccessKey secret through a Kubernetes Secret
Log on to the Container Service for Kubernetes console. In the left-side navigation pane, click Clusters.
On the Clusters page, click the name of the target cluster. In the left-side navigation pane, choose
.Select the ack-onepilot namespace, and then create a Secret to add the AccessKey ID and AccessKey secret information.
NoteFor information about how to obtain an AccessKey, see Create an AccessKey.
The AccessKey secret of an Alibaba Cloud account is displayed only when you create the AccessKey pair for the Alibaba Cloud account. You cannot query the AccessKey secret in subsequent operations. This helps reduce the risks of AccessKey pair leaks. Record the AccessKey secret and keep it confidential.
In the left-side navigation pane, choose
. Click the ack-onepilot component (usually in the ack-onepilot namespace, named ack-onepilot-ack-onepilot).In the upper-right corner of the ack-onepilot-ack-onepilot page, click Edit. In the Environment Variables section, add
ONE_PILOT_ACCESSKEY
andONE_PILOT_ACCESSKEY_SECRET
. Replace them with the values saved in the Secret by using the Secret reference method. Click OK.
ACK Serverless cluster/ECI cluster
If you need to monitor applications in ACK Serverless clusters or clusters integrated with ECI, complete the authorization on the Cloud Resource Access Authorization page, and then restart all pods under the ack-onepilot component.
Step 3: Enable Application Monitoring for a Java application
The following YAML template shows how to create a Deployment and enable Application Monitoring for the application:
Log on to the ACK console. In the left-side navigation pane, click Clusters.
On the Clusters page, find the cluster you want to manage and click its name. In the left-side pane, choose .
On the Deployments page, choose
in the Actions column of the target application.To create a new application, click Create From YAML.
Add the following
labels
to the spec.template.metadata level in the YAML file.labels: armsPilotAutoEnable: "on" armsPilotCreateAppName: "<your-deployment-name>" # Replace <your-deployment-name> with the actual application name. armsSecAutoEnable: "on" # If you want to connect the application to Application Security, you must configure this parameter.
NoteFor more information about application security, see What is application security.
For information about application security billing, see Billing.
Click Update.
On the Deployments page, if the ARMS Console button appears in the Actions column of the target application, the application has been connected to ARMS.
FAQ
Why is the monitoring data abnormal after I change the cluster or namespace of an application?
How do I use ack-onepilot when a VPC connection cannot be established?
Why does an ARMS agent fail to be installed for an application in an ACK cluster?
Why are the suffixes of application names missing after I update the applications?