Connect a registered cluster to ARMS - Container Service for Kubernetes

Application Real-Time Monitoring Service (ARMS) offers comprehensive monitoring to help you track your application health. You can install the ARMS monitoring component in a registered cluster to monitor applications running within it.

Prerequisites

Step 1: Install the ARMS component

Using onectl

Install and configure onectl on your local machine. For more information, see Manage registered clusters using onectl.

Run the following command to grant RAM permissions to the ack-onepilot component.

onectl ram-user grant --addon ack-onepilot

Expected output:

Ram policy ack-one-registered-cluster-policy-ack-onepilot granted to ram user **** successfully.

Run the following command to install the ack-onepilot component.
```
onectl addon install ack-onepilot
```
Expected output:
```
Addon ack-onepilot, version **** installed.
```

Using console

Configure RAM permissions. Before installing the component, you must provide it with an AccessKey that grants permissions to access Alibaba Cloud services.
1. Create a RAM user.
2. Create a custom policy. The ack-onepilot component requires the permissions in the following policy:
```
{
    "Version": "1",
    "Statement": [
        {
            "Action": "arms:*",
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": "cms:*",
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}
```
3. Grant permissions to a RAM user. Attach the custom policy that you created in the previous step to the RAM user.
4. Create an AccessKey for the RAM user.
  
  Warning
  For enhanced security, configure a network access control policy for the AccessKey to restrict access to trusted network environments and improve security. For more information, see AccessKey-based network access restriction policies.
5. Use the AccessKey to create a Secret named alibaba-addon-secret in the registered cluster.
  Run the following command to create the Secret for the ack-onepilot component.
  Note
  Before you run the command, replace the values for the access-key-id and access-key-secret parameters with the AccessKey ID and AccessKey Secret that you created in the previous step.
```
kubectl -n ack-onepilot create secret generic alibaba-addon-secret --from-literal='access-key-id=<your AccessKey ID>' --from-literal='access-key-secret=<your AccessKey Secret>'
```
Install the ack-onepilot component.
1. Log on to the ACK console. In the left navigation pane, click Clusters.
2. On the Clusters page, click the name of your cluster. In the left navigation pane, click Components and Add-ons .
3. On the Add-ons page, click the Install tab, find and select the ack-onepilot component, and then click Next.
4. Follow the on-screen instructions to complete the component configuration, and then click Next.
5. Verify the configuration information, and then click OK.

Step 2: Enable ARMS for a Java application

Add three labels to the spec.template.metadata.labels section of your Deployment YAML to enable ARMS monitoring:

labels:
  armsPilotAutoEnable: "on"
  armsPilotCreateAppName: "<your-deployment-name>"    # Replace <your-deployment-name> with your application name.
  aliyun.com/app-language: java

Label	Value	Description
`armsPilotAutoEnable`	`"on"`	Enables automatic agent injection for the pod
`armsPilotCreateAppName`	`"<your-deployment-name>"`	The application name displayed in the ARMS console. Replace with your application name.
`aliyun.com/app-language`	`java`	Specifies the application language for the agent

Apply the labels to an existing Deployment

Log on to the ACK console. Click Clusters, then click the cluster name.
In the left-side navigation pane, choose Workloads > Deployments.
On the Stateless page, click > YAML Edit next to the target application.
Add the three labels to spec.template.metadata.labels and click Update.

Note

For more information about application security, see What is Application Security?.

For more information about application security billing, see Billing.

apiVersion: v1
kind: Namespace
metadata:
  name: arms-demo
---
apiVersion: apps/v1 # for versions before 1.8.0 use apps/v1beta1
kind: Deployment
metadata:
  name: arms-springboot-demo
  namespace: arms-demo
  labels:
    app: arms-springboot-demo
spec:
  replicas: 2
  selector:
    matchLabels:
      app: arms-springboot-demo
  template:
    metadata:
      labels:
        app: arms-springboot-demo
        armsPilotAutoEnable: "on"
        armsPilotCreateAppName: "arms-k8s-demo"
    spec:
      containers:
        - resources:

On the Stateless page, click > ARMS Console in the Actions column of the target application to view the application monitoring details.

Next steps

Uninstall the agent for all applications
Using onectl
1. Run the following command to uninstall the ack-onepilot component.
```
onectl addon uninstall ack-onepilot
```
  Expected output:
```
Addon ack-onepilot uninstalled.
```
2. Restart the application pods to apply the changes.
Using console
1. Log on to the ACK console. In the left navigation pane, click Clusters.
2. On the Clusters page, click the name of your cluster. In the left navigation pane, click Components and Add-ons .
3. On the Add-ons page, find the ack-onepilot component, and then click Uninstall.
4. In the dialog box that appears, click Uinstall.
5. Restart the application pods to apply the changes.
Uninstall the agent for a specific application
1. Log on to the ACK console. In the left navigation pane, click Clusters.
2. On the Clusters page, click the name of your cluster, and in the left-side navigation pane, choose Workloads > Deployments.
3. On the Deployments page, choose More > Edit YAML from the Actions column of the target application. In the Edit YAML dialog box, remove the labels added in Step 2 and click Update.
4. Restart the application pods to apply the changes.