Chapter 5. Using operational features of Service Telemetry Framework

Procedure

1. Log in to Red Hat OpenShift Container Platform.

2. Change to the service-telemetry namespace:

   $ oc project service-telemetry

3. Subscribe to the Grafana Operator by using the community-operators CatalogSource:

   Warning

   Community Operators are Operators which have not been vetted or verified by Red Hat. Community Operators should be used with caution because their stability is unknown. Red Hat provides no support for community Operators.

   Learn more about Red Hat’s third party software support policy

   $ oc apply -f - <<EOF
   apiVersion: operators.coreos.com/v1alpha1
   kind: Subscription
   metadata:
     name: grafana-operator
     namespace: service-telemetry
   spec:
     channel: v4
     installPlanApproval: Automatic
     name: grafana-operator
     source: community-operators
     sourceNamespace: openshift-marketplace
   EOF

4. Verify that the Operator launched successfully. In the command output, if the value of the PHASE column is Succeeded, the Operator launched successfully:

   $ oc get csv --selector operators.coreos.com/grafana-operator.service-telemetry
   
   NAME                       DISPLAY            VERSION   REPLACES                   PHASE
   grafana-operator.v4.10.1   Grafana Operator   4.10.1    grafana-operator.v4.10.0   Succeeded

5. To launch a Grafana instance, create or modify the ServiceTelemetry object. Set graphing.enabled and graphing.grafana.ingressEnabled to true. Optionally, set the value of graphing.grafana.baseImage to the Grafana workload container image that will be deployed:

   $ oc edit stf default
   
   apiVersion: infra.watch/v1beta1
   kind: ServiceTelemetry
   ...
   spec:
     ...
     graphing:
       enabled: true
       grafana:
         ingressEnabled: true
         baseImage: 'registry.redhat.io/rhel8/grafana:7'

6. Verify that the Grafana instance deployed:

   $ oc get pod -l app=grafana
   
   NAME                                  READY   STATUS    RESTARTS   AGE
   grafana-deployment-7fc7848b56-sbkhv   1/1     Running   0          1m

7. Verify that the Grafana data sources installed correctly:

   $ oc get grafanadatasources
   
   NAME                    AGE
   default-datasources     20h

8. Verify that the Grafana route exists:

   $ oc get route grafana-route
   
   NAME            HOST/PORT                                          PATH   SERVICES          PORT   TERMINATION   WILDCARD
   grafana-route   grafana-route-service-telemetry.apps.infra.watch          grafana-service   3000   edge          None

Procedure

1. Ensure that you have the correct version of Grafana:

   $ oc get pod -l "app=grafana" -ojsonpath='{.items[0].spec.containers[0].image}'
   docker.io/grafana/grafana:7.3.10

2. If the running image is older than 8.1.0, patch the ServiceTelemetry object to update the image. Service Telemetry Operator updates the Grafana manifest, which restarts the Grafana deployment:

   $ oc patch stf/default --type merge -p '{"spec":{"graphing":{"grafana":{"baseImage":"docker.io/grafana/grafana:8.1.5"}}}}'

3. Verify that a new Grafana pod exists and has a STATUS value of Running:

   $ oc get pod -l "app=grafana"
   NAME                                 READY     STATUS    RESTARTS   AGE
   grafana-deployment-fb9799b58-j2hj2   1/1       Running   0          10s

4. Verify that the new instance is running the updated image:

   $ oc get pod -l "app=grafana" -ojsonpath='{.items[0].spec.containers[0].image}'
   docker.io/grafana/grafana:8.1.0

Procedure

1. Import the infrastructure dashboard:

   $ oc apply -f https://raw.githubusercontent.com/infrawatch/dashboards/master/deploy/stf-1/rhos-dashboard.yaml
   
   grafanadashboard.integreatly.org/rhos-dashboard-1 created

2. Import the cloud dashboard:

   Warning

   In the stf-connectors.yaml file, ensure you set the value of the collectd virt plugin parameter hostname_format to name uuid hostname, otherwise some of the panels on the cloud dashboard display no information. For more information about the virt plugin, see collectd plugins.

   $ oc apply -f https://raw.githubusercontent.com/infrawatch/dashboards/master/deploy/stf-1/rhos-cloud-dashboard.yaml
   
   grafanadashboard.integreatly.org/rhos-cloud-dashboard-1 created

3. Import the cloud events dashboard:

   $ oc apply -f https://raw.githubusercontent.com/infrawatch/dashboards/master/deploy/stf-1/rhos-cloudevents-dashboard.yaml
   
   grafanadashboard.integreatly.org/rhos-cloudevents-dashboard created

4. Import the virtual machine dashboard:

   $ oc apply -f https://raw.githubusercontent.com/infrawatch/dashboards/master/deploy/stf-1/virtual-machine-view.yaml
   
   grafanadashboard.integreatly.org/virtual-machine-view-1 configured

5. Import the memcached dashboard:

   $ oc apply -f https://raw.githubusercontent.com/infrawatch/dashboards/master/deploy/stf-1/memcached-dashboard.yaml
   
   grafanadashboard.integreatly.org/memcached-dashboard-1 created

6. Verify that the dashboards are available:

   $ oc get grafanadashboards
   
   NAME                         AGE
   memcached-dashboard-1        7s
   rhos-cloud-dashboard-1       23s
   rhos-cloudevents-dashboard   18s
   rhos-dashboard-1             29s
   virtual-machine-view-1       13s

7. Retrieve the Grafana route address:

   $ oc get route grafana-route -ojsonpath='{.spec.host}'
   
   grafana-route-service-telemetry.apps.infra.watch

8. In a web browser, navigate to https://<grafana_route_address>. Replace <grafana_route_address> with the value that you retrieved in the previous step.
9. To view the dashboard, click Dashboards and Manage.

Procedure

1. Log in to Red Hat OpenShift Container Platform.

2. Change to the service-telemetry namespace:

   $ oc project service-telemetry

3. Retrieve the existing username and password from the STF object:

   $ oc get stf default -o jsonpath="{.spec.graphing.grafana['adminUser','adminPassword']}"

4. To modify the default values of the Grafana administrator username and password through the ServiceTelemetry object, use the graphing.grafana.adminUser and graphing.grafana.adminPassword parameters.

   $ oc edit stf default

5. Wait for the grafana pod to restart with the new credentials in place

   $ oc get po -l app=grafana -w

Procedure

1. Log in to Red Hat OpenShift Container Platform.

2. Change to the service-telemetry namespace:

   $ oc project service-telemetry

3. Edit the ServiceTelemetry object:

   $ oc edit stf default

4. Add retention: 7d to the storage section of backends.metrics.prometheus.storage to increase the retention period to seven days:

   Note

   If you set a long retention period, retrieving data from heavily populated Prometheus systems can result in queries returning results slowly.

   apiVersion: infra.watch/v1beta1
   kind: ServiceTelemetry
   metadata:
     name: default
     namespace: service-telemetry
   spec:
     ...
     backends:
       metrics:
         prometheus:
           enabled: true
           storage:
             strategy: persistent
             retention: 7d
       ...

5. Save your changes and close the object.

6. Wait for prometheus to restart with the new settings.

   $ oc get po -l app.kubernetes.io/name=prometheus -w

7. Verify the new retention setting by checking the command line arguments used in the pod.

   $ oc describe po prometheus-default-0 | grep retention.time
         --storage.tsdb.retention.time=24h

Procedure

1. Log in to Red Hat OpenShift Container Platform.

2. Change to the service-telemetry namespace:

   $ oc project service-telemetry

3. Create a PrometheusRule object that contains the alert rule. The Prometheus Operator loads the rule into Prometheus:

   $ oc apply -f - <<EOF
   apiVersion: monitoring.coreos.com/v1
   kind: PrometheusRule
   metadata:
     creationTimestamp: null
     labels:
       prometheus: default
       role: alert-rules
     name: prometheus-alarm-rules
     namespace: service-telemetry
   spec:
     groups:
       - name: ./openstack.rules
         rules:
           - alert: Collectd metrics receive rate is zero
             expr: rate(sg_total_collectd_msg_received_count[1m]) == 0
   EOF

   To change the rule, edit the value of the expr parameter.

4. To verify that the Operator loaded the rules into Prometheus, run the curl command against the default-prometheus-proxy route with basic authentication:

   $ curl -k --user "internal:$(oc get secret default-prometheus-htpasswd -ogo-template='{{ .data.password | base64decode }}')" https://$(oc get route default-prometheus-proxy -ogo-template='{{ .spec.host }}')/api/v1/rules
   
   {"status":"success","data":{"groups":[{"name":"./openstack.rules","file":"/etc/prometheus/rules/prometheus-default-rulefiles-0/service-telemetry-prometheus-alarm-rules.yaml","rules":[{"state":"inactive","name":"Collectd metrics receive count is zero","query":"rate(sg_total_collectd_msg_received_count[1m]) == 0","duration":0,"labels":{},"annotations":{},"alerts":[],"health":"ok","evaluationTime":0.00034627,"lastEvaluation":"2021-12-07T17:23:22.160448028Z","type":"alerting"}],"interval":30,"evaluationTime":0.000353787,"lastEvaluation":"2021-12-07T17:23:22.160444017Z"}]}}

Procedure

1. Use the oc edit command:

   $ oc edit prometheusrules prometheus-alarm-rules

2. Edit the PrometheusRules manifest.
3. Save and close the manifest.

Procedure

1. Log in to Red Hat OpenShift Container Platform.

2. Change to the service-telemetry namespace:

   $ oc project service-telemetry

3. Edit the ServiceTelemetry object for your STF deployment:

   $ oc edit stf default

4. Add the new parameter alertmanagerConfigManifest and the Secret object contents to define the alertmanager.yaml configuration for Alertmanager:

   Note

   This step loads the default template that the Service Telemetry Operator manages. To verify that the changes are populating correctly, change a value, return the alertmanager-default secret, and verify that the new value is loaded into memory. For example, change the value of the parameter global.resolve_timeout from 5m to 10m.

   apiVersion: infra.watch/v1beta1
   kind: ServiceTelemetry
   metadata:
     name: default
     namespace: service-telemetry
   spec:
     backends:
       metrics:
         prometheus:
           enabled: true
     alertmanagerConfigManifest: |
       apiVersion: v1
       kind: Secret
       metadata:
         name: 'alertmanager-default'
         namespace: 'service-telemetry'
       type: Opaque
       stringData:
         alertmanager.yaml: |-
           global:
             resolve_timeout: 10m
           route:
             group_by: ['job']
             group_wait: 30s
             group_interval: 5m
             repeat_interval: 12h
             receiver: 'null'
           receivers:
           - name: 'null'

5. Verify that the configuration has been applied to the secret:

   $ oc get secret alertmanager-default -o go-template='{{index .data "alertmanager.yaml" | base64decode }}'
   
   global:
     resolve_timeout: 10m
   route:
     group_by: ['job']
     group_wait: 30s
     group_interval: 5m
     repeat_interval: 12h
     receiver: 'null'
   receivers:
   - name: 'null'

6. Run the wget command from the prometheus pod against the alertmanager-proxy service to retrieve the status and configYAML contents, and verify that the supplied configuration matches the configuration in Alertmanager:

   $ oc exec -it prometheus-default-0 -c prometheus -- sh -c "wget --header \"Authorization: Bearer \$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)\" https://default-alertmanager-proxy:9095/api/v1/status -q -O -"
   
   {"status":"success","data":{"configYAML":"...",...}}

7. Verify that the configYAML field contains the changes you expect.

8. To clean up the environment, delete the curl pod:

   $ oc delete pod curl
   
   pod "curl" deleted

Procedure

1. Log in to Red Hat OpenShift Container Platform.

2. Change to the service-telemetry namespace:

   $ oc project service-telemetry

3. Create the necessary alertmanager config in a file called alertmanager.yaml, for example:

   $ cat > alertmanager.yaml <<EOF
   global:
     resolve_timeout: 10m
     slack_api_url: <slack_api_url>
   receivers:
     - name: slack
       slack_configs:
       - channel: #stf-alerts
         title: |-
           ...
         text: >-
           ...
   route:
     group_by: ['job']
     group_wait: 30s
     group_interval: 5m
     repeat_interval: 12h
     receiver: 'slack'
   EOF

4. Generate the config manifest and add it to the ServiceTelemetry object for your STF deployment:

   $ CONFIG_MANIFEST=$(oc create secret --dry-run=client generic alertmanager-default --from-file=alertmanager.yaml -o json)
   $ oc patch stf default --type=merge -p '{"spec":{"alertmanagerConfigManifest":'"$CONFIG_MANIFEST"'}}'

5. Verify that the configuration has been applied to the secret:

   Note

   There will be a short delay as the operators update each object

   $ oc get secret alertmanager-default -o go-template='{{index .data "alertmanager.yaml" | base64decode }}'
   
   global:
     resolve_timeout: 10m
     slack_api_url: <slack_api_url>
   receivers:
     - name: slack
       slack_configs:
       - channel: #stf-alerts
         title: |-
           ...
         text: >-
           ...
   route:
     group_by: ['job']
     group_wait: 30s
     group_interval: 5m
     repeat_interval: 12h
     receiver: 'slack'

6. Run the wget command from the prometheus pod against the alertmanager-proxy service to retrieve the status and configYAML contents, and verify that the supplied configuration matches the configuration in Alertmanager:

   $ oc exec -it prometheus-default-0 -c prometheus -- /bin/sh -c "wget --header \"Authorization: Bearer \$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)\" https://default-alertmanager-proxy:9095/api/v1/status -q -O -"
   
   {"status":"success","data":{"configYAML":"...",...}}

7. Verify that the configYAML field contains the changes you expect.

Procedure

1. Log in to Red Hat OpenShift Container Platform.

2. Change to the service-telemetry namespace:

   $ oc project service-telemetry

3. To enable SNMP traps, modify the ServiceTelemetry object:

   $ oc edit stf default

4. Set the alerting.alertmanager.receivers.snmpTraps parameters:

   apiVersion: infra.watch/v1beta1
   kind: ServiceTelemetry
   ...
   spec:
     ...
     alerting:
       alertmanager:
         receivers:
           snmpTraps:
             enabled: true
             target: 10.10.10.10

5. Ensure that you set the value of target to the IP address or hostname of the SNMP trap receiver.

Procedure

1. Log in to Red Hat OpenShift Container Platform.

2. Change to the service-telemetry namespace:

   $ oc project service-telemetry

3. Create a PrometheusRule object that contains the alert rule and an oid label that contains the SNMP trap OID override value:

   $ oc apply -f - <<EOF
   apiVersion: monitoring.coreos.com/v1
   kind: PrometheusRule
   metadata:
     creationTimestamp: null
     labels:
       prometheus: default
       role: alert-rules
     name: prometheus-alarm-rules-snmp
     namespace: service-telemetry
   spec:
     groups:
       - name: ./openstack.rules
         rules:
           - alert: Collectd metrics receive rate is zero
             expr: rate(sg_total_collectd_msg_received_count[1m]) == 0
             labels:
               oid: 1.3.6.1.4.1.50495.15.1.2.1
               severity: critical
   EOF

Verification

1. Verify that the expiry date for the certificates is correct:

   $ oc get secret elasticsearch-es-cert -o jsonpath='{.data.tls\.crt}' | base64 -d  | openssl x509 -in - -text | grep "Not After"
               Not After : Mar  9 21:00:16 2026 GMT
   
   $ oc get secret  default-interconnect-selfsigned -o jsonpath='{.data.tls\.crt}' | base64 -d  | openssl x509 -in - -text | grep "Not After"
               Not After : Mar  9 21:00:16 2033 GMT

Procedure

1. Log in to Red Hat OpenShift Container Platform.

2. Change to the service-telemetry namespace:

   $ oc project service-telemetry

3. Use the oc command to edit the ServiceTelemetry object:

   $ oc edit stf default

4. Add highAvailability.enabled: true to the spec section:

   apiVersion: infra.watch/v1beta1
   kind: ServiceTelemetry
   ...
   spec:
     ...
     highAvailability:
       enabled: true

5. Save your changes and close the object.

Procedure

1. Create a ServiceTelemetry object with the property observabilityStrategy: none in the spec parameter. The manifest shows results in a default deployment of STF that is suitable for receiving telemetry from a single cloud with all metrics collector types.

   $ oc apply -f - <<EOF
   apiVersion: infra.watch/v1beta1
   kind: ServiceTelemetry
   metadata:
     name: default
     namespace: service-telemetry
   spec:
     observabilityStrategy: none
   EOF

2. Delete the left over objects that are managed by community operators

   $ for o in alertmanager/default prometheus/default elasticsearch/elasticsearch grafana/default; do oc delete $o; done

3. To verify that all workloads are operating correctly, view the pods and the status of each pod:

   $ oc get pods
   NAME                                                      READY   STATUS    RESTARTS   AGE
   default-cloud1-ceil-meter-smartgateway-59c845d65b-gzhcs   3/3     Running   0          132m
   default-cloud1-coll-meter-smartgateway-75bbd948b9-d5phm   3/3     Running   0          132m
   default-cloud1-sens-meter-smartgateway-7fdbb57b6d-dh2g9   3/3     Running   0          132m
   default-interconnect-668d5bbcd6-57b2l                     1/1     Running   0          132m
   interconnect-operator-b8f5bb647-tlp5t                     1/1     Running   0          47h
   service-telemetry-operator-566b9dd695-wkvjq               1/1     Running   0          156m
   smart-gateway-operator-58d77dcf7-6xsq7                    1/1     Running   0          47h

Procedure

1. Open the stf-connectors.yaml file and add the CollectdEnableLibpodstats parameter to override the setting in enable-stf.yaml. Ensure that stf-connectors.yaml is called from the openstack overcloud deploy command after enable-stf.yaml:

     CollectdEnableLibpodstats: false

2. Continue with the overcloud deployment procedure. For more information, see Section 4.1.5, “Deploying the overcloud”.

Procedure

1. Open the stf-connectors.yaml and add the CollectdEnableSensubility parameter to override the setting in enable-stf.yaml. Ensure that stf-connectors.yaml is called from the openstack overcloud deploy command after enable-stf.yaml:

   CollectdEnableSensubility: false

2. Continue with the overcloud deployment procedure. For more information, see Section 4.1.5, “Deploying the overcloud”.